ntdll-unhooking 开源项目推荐（14 个）

ricardojoserf /NativeDump

Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

ricardojoserf /TrickDump

仅用NTAPI函数转储lsass，生成3个JSON和1个ZIP文件......之后生成MiniDump文件！

ricardojoserf /NativeBypassCredGuard

Bypass Credential Guard by patching WDigest.dll using only NTAPI functions

nbs32k /inline-syscall

Inline syscalls made for MSVC supporting x64 and WOW64

reveng007 /ReflectiveNtdll

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

unkvolism /Fuck-Etw

Bypass the Event Trace Windows(ETW) and unhook ntdll.

MaorSabag /Paruns-Fart

NTDLL unhooking via Parun's Fart technique to bypass EDR userland hooks

ricardojoserf /NativeNtdllRemap

Remap ntdll.dll using only NTAPI functions with a suspended process

Hue-Jhan /Ntdll-Early-Bird-Injection-Trojans

Collection of remote shellcode Loaders using Early Bird APC Injection, windows native api, low level utilities and stealth techniques.

ricardojoserf /SharpNtdllOverwrite

Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder, a debugged process or a URL

internetangel /CraftUnhook

Unhooking NTDLL Without Reading It From Disk.

ricardojoserf /pyNtdllOverwrite

Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process

ricardojoserf /goNtdllOverwrite

Overwrite ntdll.dll's ".text" section to bypass API hooking. Getting the clean dll from disk, Knowndlls folder or a debugged process

victorTrofelli /Malicious-Service-With-Ntdll

The project consists of a service that utilizes advanced techniques to inject a Payload into its own process, specifically the Windows RuntimeBroker.exe