EDR Unhooking Library
$349.99
EDR Evasion Toolkit: generates REAL, compilable C source for Windows x64 — ntdll unhooking via fresh disk remap, AMSI/ETW in-process patching, direct syscalls with runtime SSN resolution, PPID spoofing, block non-Microsoft DLLs, timestamp stomping and ETW provider enumeration.
Key Features
- • 7 techniques, each emitted as complete C that cross-compiles with mingw (7/7 verified)
- • unhook_ntdll: PEB walk + file mapping + clean .text copy
- • amsi/etw patch: export resolution via PEB loader data + patch bytes
- • direct_syscall: inline syscall stubs with correct SysV register convention
- • --all/--compile output modes
Requirements
- x86_64-w64-mingw32-gcc; Windows x64 target.
Changelog
- v3.0 — rebuilt as C-source generator; all 7 outputs compile (mingw 16).
Package Contents
Exact contents of the download archive (2 files):
| edr_evasion.py | 22,470 B |
| README.md | 2,373 B |
Related Tools
Evasion & Stealth
AMSI Bypass Payload Generator
Evasion & Stealth
PowerShell Obfuscation Engine
Evasion & Stealth
Process Injection Variants Pack
Evasion & Stealth