ProcessVision is a next-generation, signature-less process memory inspection and threat detection tool written in Rust. It is designed for blue teams, incident responders, and malware analysts to detect sophisticated in-memory threats.
- Advanced Memory Analysis: Detects RWX regions, W^X violations, and executable memory in private/heap regions.
- PE Integrity Engine: Scans for manually mapped PEs, suspicious section names (packers), and malformed headers (anti-forensics).
- Shellcode Heuristics: Detects high-entropy payloads and common instruction patterns (PEB access, direct syscalls).
- Hook & Integrity Detection: Identifies potential API redirections and IAT/EAT hooking via indirect jump patterns.
- Detection Correlation: Automatically strengthens confidence scores when multiple engines flag the same region.
- Modern CLI: Feature-rich terminal interface with progress indicators, colored finding cards, and filtered scan modes.
- OS: Windows (Targeting WinAPI)
- Rust: Latest stable toolchain
git clone https://github.com/ismailtsdln/ProcessVision.git
cd ProcessVision
cargo build --releaseThe binary will be located at ./target/release/processvision.exe.
processvision scan-allprocessvision scan-all --name chrome --min-confidence 70processvision scan-pid 1234| Engine | Technique | Focus |
|---|---|---|
| MemoryRegion | Unbacked Executable Memory | RWX, W^X violations, Guard pages |
| PeAnalysis | Manual Mapping / Hollowing | Section audit, Header integrity |
| Shellcode | Shellcode Heuristics | High entropy, Syscall stubs, PEB access |
| HookEngine | API/IAT Hooking | Indirect jumps, inline hooks |
| ThreadEngine | Suspicious Execution | Private execution entry points |
- Non-Destructive: ProcessVision never modifies the target process. It only queries and reads memory.
- Rust Powered: Leverage's Rust's memory safety to avoid common security pitfalls.
- Structured Errors: Robust handling of UAC (Access Denied) and protected process errors.
Contributions are welcome! If you have ideas for new detection engines or UI improvements, please open an issue or submit a pull request.
Distributed under the MIT License. See LICENSE for more information.
Created by Ismail Tasdelen