Hacking Articles Tips Tricks Videos Tutorials

Documentation
You can find detailed documentation on the Wiki (https://squalr.github.io/SqualrDocs/). There are three ways to use Squalr: Front end GUI Scripting API Back end NuGet packages Below is some brief documentation on the NuGet package APIs
Receiving Engine Output:
If using the NuGet packages, it is important to hook into the engine's output to receive logs of events. These are invaluable for diagnosing issues. using Squalr.Engine.Logging;

...

// Receive logs from the engine
Logger.Subscribe(new EngineLogEvents());

...

class EngineLogEvents : ILoggerObserver
{
public void OnLogEvent(LogLevel logLevel, string message, string innerMessage)
{
Console.WriteLine(message);
Console.WriteLine(innerMessage);
}
}
Attaching The Engine
processes = Processes.Default.GetProcesses(); // Pick a process. For this example, we are just grabbing the first one. Process process = processes.FirstOrDefault(); Processes.Default.OpenedProcess = process; ">using Squalr.Engine.OS;
...

IEnumerable processes = Processes.Default.GetProcesses();

// Pick a process. For this example, we are just grabbing the first one.
Process process = processes.FirstOrDefault();

Processes.Default.OpenedProcess = process;

Manipulating Memory:
(address); Writer.Default.Write(address); Allocator.Alloc(address, 256); IEnumerable regions = Query.GetVirtualPages(requiredProtection, excludedProtection, allowedTypes, startAddress, endAddress); IEnumerable modules = Query.GetModules(); ">using Squalr.Engine.Memory;

...

Reader.Default.Read(address);
Writer.Default.Write(address);
Allocator.Alloc(address, 256);
IEnumerable regions = Query.GetVirtualPages(requiredProtection, excludedProtection, allowedTypes, startAddress, endAddress);
IEnumerable modules = Query.GetModules();
Assembling/Disassembling:
Squalr can assemble and disassemble x86/x64 instructions, leveraging NASM. using Squalr.Engine.Architecture;
using Squalr.Engine.Architecture.Assemblers;

...

// Perform assembly
AssemblerResult result = Assembler.Default.Assemble(assembly: "mov eax, 5", isProcess32Bit: true, baseAddress: 0x10000);

Console.WriteLine(BitConverter.ToString(result.Bytes).Replace("-", " "));

// Disassemble the result (we will get the same instructions back)
Instruction[] instructions = Disassembler.Default.Disassemble(bytes: result.Bytes, isProcess32Bit: true, baseAddress: 0x10000);

Console.WriteLine(instructions[0].Mnemonic);
Scanning:
Squalr has an API for performing high performance (https://www.kitploit.com/search/label/High%20Performance) memory scanning: valueCollectorTask = ValueCollector.CollectValues( SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromActiveSnapshotOrPrefilter, dataType)); // Perform manual scan on value collection complete valueCollectorTask.CompletedCallback += ((completedValueCollection) => { Snapshot snapshot = completedValueCollection.Result; // Constraints ScanConstraintCollection scanConstraints = new ScanConstraintCollection(); scanConstraints.AddConstraint(new ScanConstraint(ScanConstraint.ConstraintType.Equal, 25)); TrackableTask scanTask = ManualScanner.Scan( snapshot, allScanConstraints); SnapshotManager.SaveSnapshot(scanTask.Result); }); for (UInt64 index = 0; index < snapshot.ElementCount; index++) { SnapshotElementIndexer element = snapshot[index]; Object currentValue = element.HasCurrentValue() ? element.LoadCurrentValue() : null; Object previousValue = element.HasPreviousValue() ? element.LoadPreviousValue() : null; } ">using Squalr.Engine.Scanning;
using Squalr.Engine.Scanning.Scanners;
using Squalr.Engine.Scanning.Scanners.Constraints;
using Squalr.Engine.Scanning.Snapshots;

...

DataType dataType = DataType.Int32;

// Collect values
TrackableTask valueCollectorTask = ValueCollector.CollectValues(
SnapshotManager.GetSnapshot(Snapshot.SnapshotRetrievalMode.FromActiveSnapshotOrPrefilter, dataType));

___________________________
@hacking_Attack
@Hacking_Video

12 viewsedited 21:35

// Perform manual scan on value collection complete
valueCollectorTask.CompletedCallback += ((completedValueCollection) =>
{
Snapshot snapshot = completedValueCollection.Result;

// Constraints
ScanConstraintCollection scanConstraints = new ScanConstraintCollection();
scanConstraints.AddConstraint(new ScanConstraint(ScanConstraint.ConstraintType.Equal, 25));

TrackableTask scanTask = ManualScanner.Scan(
snapshot,
allScanConstraints);

Snapsh otManager.SaveSnapshot(scanTask.Result);
});

for (UInt64 index = 0; index < snapshot.ElementCount; index++)
{
SnapshotElementIndexer element = snapshot[index];

Object currentValue = element.HasCurrentValue() ? element.LoadCurrentValue() : null;
Object previousValue = element.HasPreviousValue() ? element.LoadPreviousValue() : null;
}
Debugging:
// Example: Tracing write events on a float
BreakpointSize size = Debugger.Default.SizeToBreakpointSize(sizeof(float));
CancellationTokenSource cancellationTokenSource = Debugger.Default.FindWhatWrites(0x10000, size, this.CodeTraceEvent);

...

// When finished, cancel the instruction collection
cancellationTokenSource.cancel();

...

private void CodeTraceEvent(CodeTraceInfo codeTraceInfo)
{
Console.WriteLine(codeTraceInfo.Instruction.Address.ToString("X"));
Console.WriteLine(codeTraceInfo.Instruction.Mnemonic);
}
Recommended Visual Studio Extensions
Reference Description XAML Formatter (https://marketplace.visualstudio.com/items?itemName=TeamXavalon.XAMLStyler) XAML should be run through this formatter StyleCop (https://marketplace.visualstudio.com/items?itemName=ChrisDahlberg.StyleCop) StyleCop to enforce code conventions. Note that we deviate on some standard conventions. We use the full type name for variables (ex Int32 rather than int). The reasoning is that this is a memory editor, so we prefer to use the type name that is most explicit to avoid coding mistakes.
Build
In order to compile Squalr, you should only need Visual Studio 2017. This should be up to date, we frequently update Squalr to use the latest version of the .NET framework. Here are the important 3rd party libraries that this project uses: Library Description EasyHook (https://github.com/EasyHook/EasyHook) Managed/Unmanaged API Hooking SharpDisasm (https://github.com/spazzarama/SharpDisasm) Udis86 Assembler (https://www.kitploit.com/search/label/Assembler) Ported to C# CsScript (https://github.com/oleg-shilo/cs-script) C# Scripting (https://www.kitploit.com/search/label/Scripting) Library AvalonEdit (https://github.com/icsharpcode/AvalonEdit) Code Editing Library SharpDX (https://github.com/sharpdx/SharpDX) DirectX Wrapper CLRMD (https://github.com/Microsoft/clrmd) .NET Application Inspection Library AvalonDock (https://avalondock.codeplex.com/) Docking Library LiveCharts (https://github.com/beto-rodriguez/Live-Charts) WPF Charts
Planned Features
Library Description Purpose AsmJit (https://github.com/hypeartist/AsmJit) x86/x64 Assembler Replace FASM, improve scripting drastically AsmJit (https://github.com/asmjit/asmjit) x86/x64 Assembler Original C++ project. May port/interop this if the above version does not work (Neither may fully work, and something custom may be needed) WpfHexEditorControl (https://github.com/abbaye/WpfHexEditorControl) Hex Editor Hex editor / Memory Hex Editor OpenTK (https://github.com/opentk/opentk) OpenGL Wrapper Graphics Injection SharpDX (https://github.com/sharpdx/SharpDX) DirectX Wrapper Graphics Injection (https://www.kitploit.com/search/label/Injection) (Currently using SharpDX just for input) SharpPCap (https://github.com/chmorgan/sharppcap) Packet Capture Packet Editor Packet.Net (https://github.com/antmicro/Packet.Net) Packet Capture Packet Editor

___________________________
@hacking_Attack
@Hacking_Video

Visualstudio

XAML Styler - Visual Studio Marketplace

Extension for Visual Studio - XAML Styler is a visual studio extension that formats XAML source code based on a set of styling rules. This tool can help you/your team maintain a better XAML coding style as well as a much better XAML readability.

10 viewsedited 21:35

Hacking Articles Tips Tricks Videos Tutorials

Download Squalr (https://github.com/Squalr/Squalr)

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - Squalr/Squalr: A generic game/software hacking tool written from the ground up in Rust.

A generic game/software hacking tool written from the ground up in Rust. - Squalr/Squalr

8 viewsedited 21:35

Hacking Articles Tips Tricks Videos Tutorials

6 views23:03

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Baltimore County Public Schools' Ransomware Recovery Tops $8M

The school district has spent seven months and a reported $8.1 million recovering from the November attack.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Baltimore County Public Schools' Ransomware Recovery Tops $8M

The school district has spent seven months and a reported $8.1 million recovering from the November attack.

6 viewsedited 23:03

Hacking Articles Tips Tricks Videos Tutorials

5 views23:03

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Data Leaked in Fertility Clinic Ransomware Attack

Reproductive Biology Associates says the data of 38,000 patients may have been compromised in the April cyberattack.

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 23:03

Hacking Articles Tips Tricks Videos Tutorials

5 views23:03

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Did Companies Fail to Disclose Being Affected by SolarWinds Breach?

The SEC has sent out letters to some investment firms and publicly listed companies seeking information, Reuters says.

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 23:03

Hacking Articles Tips Tricks Videos Tutorials

4 views23:10

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
DNS in Detail

https://cdn-images-1.medium.com/max/600/0*XLztAEpbu4QOnCDJ.png
Learn how DNS works and how it helps you access internet services.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

DNS in Detail

Learn how DNS works and how it helps you access internet services.

4 viewsedited 23:10

Hacking Articles Tips Tricks Videos Tutorials

4 views23:10