Aether Core Pipeline

v0.9-stable :: Memory Analysis & Heuristic Correlation

Reset Pipeline

BUILD MODULE MAP (once per scan)

buildModuleMap(pid)

Execute buildModuleMap

_

SCAN HEAP CHUNK (per 64KB chunk, per RW region)

scanHeapForApiTables(buf, region_base, module_map, results)

Gap Threshold: 2

Initiate Scan

CORRELATE (per candidate run)

correlateRun(state, module_map) → Correlation

Passing pointers through correlateRun()...

EMIT FINDING

emitApiTable(state, module_map, corr, region_base, offset, results)