OnTheEdge

OnTheEdge is a small Windows research PoC written in C for studying credential-related data that may be present in the memory of Microsoft Edge processes while the browser is running. The project provides two variants:

• Standalone executable — intended for local testing and research.
• BOF — intended for controlled C2 laboratory environments.

Disclaimer: This project is intended for authorized security research, malware analysis, testing environments, and educational use only. Do not use it against systems or accounts without explicit authorization.

Output

The tool displays information discovered during the memory scan using a simple console format. Example:

================================================
                  OnTheEdge
================================================

[*] looking for msedge.exe processes...
[+] found 9 msedge.exe process(es)
[*] checking PID 9164...
[+] 1 credential(s) found

Results depend on the Edge version, process layout, browser state, and the contents currently present in memory. ![[test.png]] Tested on Windows 11 Pro

Limitations

Memory-based pattern matching is inherently dependent on the runtime representation of data. Results may therefore vary depending on:

• Microsoft Edge version
• Browser state
• Process layout
• User session
• Profile configuration
• Runtime changes to Edge