Metadata-Version: 2.5
Name: bx2-stealth
Version: 0.1.1
Summary: External memory scanner for packed binaries: patches anti-debug in the target, then extracts decrypted strings and IoCs via ReadProcessMemory. Inspired by bx2trace (fareed1-ataf).
Project-URL: Homepage, https://github.com/opsecalyzer/Process-Monitor
Project-URL: Upstream inspiration, https://github.com/fareed1-ataf/Bxtracer
Author: opsecalyzer
Maintainer: opsecalyzer
License: Apache-2.0
License-File: LICENSE
License-File: NOTICE
Keywords: anti-debug,ioc-extraction,malware-analysis,memory-scanner,packer,pyarmor,reverse-engineering,themida,vmprotect
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: Microsoft :: Windows
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.11
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff>=0.5; extra == 'dev'
Description-Content-Type: text/markdown

# bx2-stealth

External memory scanner for packed binaries. Launches a target suspended,
patches common anti-debug checks in-process, resumes it, then extracts
decrypted strings and IoCs via ReadProcessMemory -- no debugger attached.

## Install

    pip install bx2-stealth

## Usage

    bx2-stealth "C:\path\to\packed.exe"
    bx2-stealth "C:\path\to\packed.exe" --poll 0.05 --no-strings
    bx2-stealth --dedupe-file --iocs iocs.txt

## Credits

- [bx2trace](https://github.com/fareed1-ataf/Bxtracer) by
  [fareed1-ataf](https://github.com/fareed1-ataf) -- original framework
  this project is adapted from.
- [Process-Monitor](https://github.com/opsecalyzer/Process-Monitor) --
  related tooling by the same author.

## License

Apache-2.0. See LICENSE and NOTICE.
