GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → GetRektBoy724 → SharpUnhooker

GetRektBoy724 / SharpUnhooker

Licence: other
C# Based Universal API Unhooker

Programming Languages

C#
18002 projects

Labels

windowsdllpentestingwindows-apired-teamav-evasion

Projects that are alternatives of or similar to SharpUnhooker

inceptor
Template-Driven AV/EDR Evasion Framework
Stars: ✭ 730 (+186.27%)
Mutual labels:  red-team, av-evasion
Bifrost
Bifrost C2. Open-source post-exploitation using Discord API
Stars: ✭ 37 (-85.49%)
Mutual labels:  red-team
Compiler-Principle
词法分析，LL(1) 文法分析，LR(1) 文法分析
Stars: ✭ 18 (-92.94%)
Mutual labels:  dll
python-installcab
Install individual components from cab installers into wine
Stars: ✭ 28 (-89.02%)
Mutual labels:  dll
UniversalUnityHooks
A framework designed to hook into and modify methods in unity games via dlls
Stars: ✭ 78 (-69.41%)
Mutual labels:  dll
adduser-dll
Simple DLL that add a user to the local Administrators group
Stars: ✭ 48 (-81.18%)
Mutual labels:  dll
metadata-one-liners
retrive metadata endpoint data with these one liners.
Stars: ✭ 38 (-85.1%)
Mutual labels:  red-team
singlefile
featured cs:go internal hack, one file and less than 1000 lines.
Stars: ✭ 47 (-81.57%)
Mutual labels:  dll
Godot3-Win64-LSW-Build
Modularized build of Godot 3 ( Win x64 ) with MSVC without SCons will be updated after Godot 4 is published
Stars: ✭ 18 (-92.94%)
Mutual labels:  dll
dll-diagnostics
Tools for diagnosing DLL dependency loading issues
Stars: ✭ 24 (-90.59%)
Mutual labels:  dll
Phobos
Ares-compatible C&C Red Alert 2: Yuri's Revenge engine extension
Stars: ✭ 123 (-51.76%)
Mutual labels:  dll
MacOS-WPA-PSK
PoC script showing that MacOS leaves the wireless key in NVRAM, in plaintext and accessible to anyone.
Stars: ✭ 29 (-88.63%)
Mutual labels:  red-team
Record-Audio-on-Windows
A Go program that uses winmm.dll to record audio to a WAV file.
Stars: ✭ 28 (-89.02%)
Mutual labels:  dll
Octopus
Octopus - Network Scan/Infos & Web Scan
Stars: ✭ 25 (-90.2%)
Mutual labels:  red-team
InMemoryNET
Exploring in-memory execution of .NET
Stars: ✭ 55 (-78.43%)
Mutual labels:  red-team
XENA
XENA is the managed remote administration platform for botnet creation & development powered by blockchain and machine learning. Aiming to provide an ecosystem which serves the bot herders. Favoring secrecy and resiliency over performance. It's micro-service oriented allowing for specialization and lower footprint. Join the community of the ulti…
Stars: ✭ 127 (-50.2%)
Mutual labels:  red-team
ScareCrow-CobaltStrike
Cobalt Strike script for ScareCrow payloads intergration (EDR/AV evasion)
Stars: ✭ 387 (+51.76%)
Mutual labels:  dll
xamarin-bugly
A bugly SDK for Xamarin Android Bindings
Stars: ✭ 22 (-91.37%)
Mutual labels:  dll
wsudo
Proof of concept sudo for Windows
Stars: ✭ 71 (-72.16%)
Mutual labels:  windows-api
ReverseShellDll
C++ Windows Reverse Shell - Universal DLL Hijack | SSL Encryption | Statically Linked
Stars: ✭ 69 (-72.94%)
Mutual labels:  dll
View All Similar Projects ➔

SharpUnhooker

C# Based Universal API Unhooker - Automatically Unhook API Hives (ntdll.dll, kernel32.dll, advapi32.dll, and kernelbase.dll). SharpUnhooker helps you to evades user-land monitoring done by AVs and/or EDRs by cleansing/refreshing API DLLs that loaded on the process (Offensive Side) or remove API hooks from user-land rootkit (Defensive Side). SharpUnhooker can unhook EAT hooks, IAT hooks, and JMP/Hot-patch/Inline hooks. SharpUnhooker also equipped with AMSI and ETW patcher to break/disable them.

This tool is tested on Windows 10 v21H2 x64

Note

  • If you want to copy the code, Please dont forget to credit me.
  • If you want to see a good demonstration of SharpUnhooker, go check this blog post by Reigada.
  • Github doesn't like my Sublime Text indentation settings, so if you see some "weirdness" on the indentation, Im sorry.

Usage

Simply load the pre-compiled DLL or add the code function and call the Main function from the SharpUnhooker class. You can load the pre-compiled DLL on Powershell with Reflection.Assembly too! This code uses C# 5,so it can be compiled with the built-in CSC from Windows 10. The JMPUnhooker function is used to unhook JMP/Hot-patch/Inline hooks, the EATUnhooker function is used to unhook EAT hooks, and the IATUnhooker function is used to unhook IAT hooks. For now, the IATUnhooker and EATUnhooker cant unhook function import/export that uses ordinals instead of name. The Main function is basically "wrapper" of all of the functionality of SharpUnhooker. If you want to test the capability of SharpUnhooker, you can use the UsageExample function from SUUsageExample class. Its just a simple local shellcode injector.

SharpUnhooker's Main function in action!

SharpUnhookerInAction

To-Do List

  • Add function ordinals ability on EATUnhooker and IATUnhooker
  • Add ability to remove hooks from CLRGuard
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].