ModuleStomped

ModuleStomped is a proof-of-concept tool designed to detect module-stomped DLLs by analyzing the pdata section of various processes, which remains unchanged and thus provides a more reliable detection mechanism than analyzing the .text section. It features two primary modes: a process scanner that inspects all accessible processes for anomalies, and an ETW mode that monitors image load events for specified DLLs. Notably, the tool emphasizes the correlation of stack frames with pdata as a potential detection strategy, while acknowledging potential evasion techniques.