{"adoption": {"forks": 174, "observed_at": "2026-08-28T04:03:33.614825+00:00", "stars": 1093}, "canonical_url": "https://ross.abutalabs.com/products/bypass-av-note", "card": {"archived": false, "artifact_type": "learning-resource", "description": "免杀技术大杂烩---乱拳也打不死老师傅", "domain": ["security", "penetration-testing", "windows", "developer-tools"], "enriched": true, "function": ["security", "reverse-engineering", "penetration-testing"], "health_score": 20, "homepage": null, "language": null, "license": null, "license_family": "other", "maturity": "maintenance", "member_repos": ["Airboi/bypass-av-note"], "name": "Airboi/bypass-av-note", "platform": ["windows", "cpp", "c"], "pushed_at": "2021-03-29T13:06:22+00:00", "repo": "Airboi/bypass-av-note", "stars": 1093, "tags": ["av-evasion", "antivirus-bypass", "red-team", "shellcode-loader", "malware-development", "offensive-security", "notes", "process-injection"], "topics": [], "urls": [], "use_cases": ["learn how antivirus engines detect malware", "study shellcode loader techniques like CreateThread and thread hijacking", "understand process injection methods such as VirtualAllocEx and WriteProcessMemory", "research direct syscall techniques to bypass user-mode hooks", "prepare for red team engagements against EDR and antivirus", "find references for encrypting and obfuscating shellcode"], "what_it_is": "A Chinese-language knowledge base of antivirus evasion (bypass AV) techniques, covering signature-based, behavior-based, and cloud detection with code examples for shellcode loaders, thread hijacking, and process injection. It is a curated note collection rather than a runnable tool.", "when_to_avoid": ["you need a production-ready, maintained evasion tool or framework", "you want defensive detection rules rather than offensive techniques", "you need something cross-platform - the content is Windows-focused"], "when_to_choose": ["you are studying offensive security or red team AV evasion concepts", "you want annotated C/C++ code samples of common loader and injection techniques", "you need a reference of which Windows APIs trigger AV behavioral detection"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/bypass-av-note", "repo": "Airboi/bypass-av-note", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:03:33.614825+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T06:47:38.730976+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "17d7ee673dfd92fd5ae932e2f2d9e8cf9b40077be95f3ecb65856862e065687c", "fetched_at": "2026-08-28T04:03:33.614825+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Airboi/bypass-av-note"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2053, "days_push": 1983, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}