MappedImagesDetector is a native C++20 Windows tool that scans process virtual memory regions to detect malicious DLL injection techniques, including manual mapping, erased PE headers, and suspicious executable memory regions that traditional disk-based antivirus solutions miss. It avoids relying on standard module enumeration methods and instead uses NtQueryVirtualMemory and NtReadVirtualMemory to identify executable regions and analyze import thunk patterns (notably x64 import stubs FF 25) indicative of manually mapped PE images. The tool flags anomalies such as missing or corrupted PE headers and executable memory regions not associated with legitimate modules. It is designed as a defensive research project to enhance visibility into process memory for AV/EDR pipelines and malware research.

This tool addresses the challenge posed by modern malware that operates entirely in memory, bypassing disk-based detection by manually mapping DLLs or erasing PE headers. While MappedImagesDetector itself is not a vulnerability or exploit, it enhances detection capabilities against advanced in-memory malware techniques that evade traditional antivirus solutions. It does not introduce new vulnerabilities but provides defenders with improved visibility into stealthy malicious code residing in process memory.

This is a defensive detection tool and not a vulnerability requiring patching. No remediation or patch is applicable. Security teams and AV/EDR developers can integrate or use MappedImagesDetector to improve detection of manual DLL injection and in-memory malware. The project is research-focused and intended to complement existing security solutions by providing memory-based detection heuristics.