Implant drop-in for EDR testing

Windows user-land hooks manipulation tool.

Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"

Reduce Dynamic Analysis Detection Rates With Built-In Unhooker, Anti Analysis Techniques, And String Obfuscator Modules.

Pure-Go offensive-security primitives library: syscalls, evasion (AMSI/ETW/unhook/sleepmask), injection, PE packer, credentials, post-ex, C2. MITRE ATT&CK mapped. Authorized research only.

Unhook DLL via cleaning the DLL 's .text section

Bypassing all EDR hooks while maintaining the cleanest callstack of all time with proxy calls and an exception handler.

AV (BitDefender) function un-hook in C

Full IAT unhooking of all ntdll functions called from kernel32

Advanced payload creation framework for bypassing EDR solutions and Application Whitelisting using DLL side-loading, in-memory unhooking, and indirect syscalls.

This project demonstrates simply a ssdt unhooking technique via NtLoadDriver routine in Windows 11 X64.