Detect manualmapped images remotely, without hassle

• Extreme Injector -> detected
• Xenos -> detected (even with Add Loader reference enabled)

MapDetection has two modes, deep and quick.

Iterates every process thread, collecting allocation bases from thread starts and instruction pointers. It then scans every unique allocation base for any anomalies.

Run quick scan, then traverse the virtual memory space for any executable pages that do not belong to a module. (Will lead to false positives)

• Valid PE headers (MZ signature, PE magic bytes and architecture)
• Module is linked correctly to module list
• Valid allocation type (MEM_IMAGE)
• Valid allocation flags