> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/remote-settings/binary-trace-plugin.md).

# Binary Trace Plugin

The BinaryTrace Plugin is a native module that monitors binary execution flow, detects unauthorized code injection from external processes, and calculates cryptographic integrity proofs for in-memory modules.

***

## Technical Capabilities

{% stepper %}
{% step %}

### Section Hash Verification

Continuously computes cryptographic integrity checksums of all loaded modules in the process.
{% endstep %}

{% step %}

### Dynamic Unlinked Page Scan

Scans private virtual memory regions (`PAGE_EXECUTE_READWRITE`, `PAGE_EXECUTE_READ`) for unbacked PE headers indicating manual-mapped DLLs or shellcode.
{% endstep %}

{% step %}

### Thread Origin Tracking

Analyzes the thread start address of all active threads to ensure they originate from legitimate disk-backed images rather than anonymous memory regions.
{% endstep %}
{% endstepper %}

## C# Usage

```csharp
using System;
using qPapelEasyAuth;

public class BinaryTraceService
{
    public static void StartTraceMonitoring()
    {
        // Enable BinaryTrace plugin in native core
        qPapelEasyAuth.qPapelEasyAuth.EnablePlugin("binary_trace");

        Console.WriteLine("[+] BinaryTrace execution monitor running.");
    }
}
```

## Detection Matrix

| Threat Type                | Vector                     | BinaryTrace Detection                       |
| -------------------------- | -------------------------- | ------------------------------------------- |
| **Manual Mapped DLLs**     | `VirtualAlloc` + Shellcode | Flags unbacked executable memory pages.     |
| **Remote Thread Creation** | `CreateRemoteThread`       | Identifies foreign thread creation origins. |
| **Section Byte Patching**  | `VirtualProtect` + JMP     | Flags CRC32 divergence from baseline.       |
| **Injected Shellcode**     | Trampolines / VEH hooks    | Detects non-module thread start addresses.  |

{% hint style="info" %}
BinaryTrace operates with negligible CPU overhead by leveraging incremental page hashing during watchdog ticks.
{% endhint %}