unhooking

Windows user-land hooks manipulation tool.

Implant drop-in for EDR testing

Slides and POC demo for my talk at Divizion Zero on EDR evasion titled "Evasion Adventures"

Pure-Go offensive-security primitives library: syscalls, evasion (AMSI/ETW/unhook/sleepmask), injection, PE packer, credentials, post-ex, C2. MITRE ATT&CK mapped. Authorized research only.

Reduce Dynamic Analysis Detection Rates With Built-In Unhooker, Anti Analysis Techniques, And String Obfuscator Modules.

Unhook DLL via cleaning the DLL 's .text section

Bypassing all EDR hooks while maintaining the cleanest callstack of all time with proxy calls and an exception handler.

AV (BitDefender) function un-hook in C

Full IAT unhooking of all ntdll functions called from kernel32

This project demonstrates simply a ssdt unhooking technique via NtLoadDriver routine in Windows 11 X64.