CodeCaver

A WinDbg extension that scans loaded modules for code caves within executable memory.

You can read a more detailed explanation over here on my blog: nopblog/codecaver.

What Are Code Caves?

Code caves are regions of unused space within a module's executable memory. These are typically padding bytes inserted by the compiler/linker and can be identified by repeating patterns of:

| Byte | Name | Description | |--------|---------|---------------------------------| | 0x90 | NOP | No-operation instruction | | 0xCC | INT3 | Software breakpoint instruction | | 0x00 | PADDING | Null padding bytes |

These regions are particular useful for storing shellcode when exploiting an application.

Features

• Scans any loaded module by name
• Detects NOP, INT3, and NULL padding caves
• Configurable minimum cave size (hex or decimal)
• Reports memory protection for each cave (e.g. PAGE_EXECUTE_READ)
• Efficient page-by-page scanning with automatic skipping of non-executable regions
• Supports both 32-bit and 64-bit targets

Usage

Load the extension in WinDbg:

.load codecaver

Search for code caves by using the following command:

!cave <module_name> [min_size]    Scan a module for code caves
!cave -h                          Show detailed help

Parameters

| Parameter | Description | Default | |---------------|----------------------------------------------------------|----------| | module_name | Name of the loaded module (e.g. kernel32, ntdll) | Required | | min_size | Minimum cave size in bytes, supports hex (0x100) or decimal (256) | 0x40 (64 bytes) |

Examples

!cave kernel32              Scan kernel32 with default min size (64 bytes)
!cave ntdll 0x100           Scan ntdll for caves >= 256 bytes
!cave myapp 10            Scan myapp for caves >= 10 bytes

Sample Output

0:000> !cave ch 0x10

Found 5 code cave(s):

START ADDRESS       END ADDRESS         SIZE        PATTERN     PROTECTION               
------------------  ------------------  ----------  ----------  -------------------------
0x00007ff7a62e2b56  0x00007ff7a62e2b65  0x10        INT3        PAGE_EXECUTE_READ        
0x00007ff7a62e50a5  0x00007ff7a62e50b5  0x11        INT3        PAGE_EXECUTE_READ        
0x00007ff7a62fc136  0x00007ff7a62fc145  0x10        INT3        PAGE_EXECUTE_READ        
0x00007ff7a62fc791  0x00007ff7a62fc7a5  0x15        INT3        PAGE_EXECUTE_READ        
0x00007ff7a62fd6f6  0x00007ff7a62fdfff  0x90a       PADDING     PAGE_EXECUTE_READ     

Building

Requirements

• Visual Studio 2017 or later
• Windows SDK (included with Visual Studio)

Build from Visual Studio

1. Open codecaver.sln
2. Select a configuration: Debug or Release
3. Select a platform: x86 or x64
4. Build the solution (Ctrl+Shift+B)

Build from Command Line

msbuild codecaver.sln /p:Configuration=Release /p:Platform=x64

Output

The build produces codecaver.dll which can be loaded directly into WinDbg.

Loading The Extension

Copy the built codecaver.dll to one of the following locations:

• The winext subdirectory inside the WinDbg installation directory
• A directory in the debugger's extension search path
• Any directory, then load explicitly with .load <full_path_to_dll>

Note: Match the DLL architecture (x86/x64) to the target being debugged.

Author

Created by nop (@thenopcode)