EDR Unhooking Library

EDR Unhooking Library

Restaura ntdll.dll limpia for deletesr hooks installsdos by EDRs:

n
• KnownDlls method — Carga copies limpia of ntdll from KnownDllsntdll.dll and replaces the .text section hookeada.
n
• Disk read method — Lee ntdll.dll from C:WindowsSystem32 and restaura bytes original.
n
• Suspended process — Crea process suspendido, reads its ntdll (still no hookeada), uses esos bytes.
n
• Direct syscalls fallback — Si unhooking falla, uses syscall stubs directos (Nt* functions) as alternativa.
n
• Verification — Comfor bytes of ntdll in memory vs disk for consignsr that the hooks fueron removidos.
n