Mr-Un1k0d3r/EDRs resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2202 stars · 357 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of proof-of-concept C tools and reference data for understanding EDR/AV hooking on Windows, including syscall patching utilities and lists of hooked ntdll.dll APIs per vendor. It is aimed at red team operators researching endpoint detection evasion techniques.

Use cases

• find which ntdll APIs an EDR hooks before an engagement
• dynamically resolve syscall IDs without knowing the Windows version
• unhook the Import Address Table to remove EDR hooks
• patch syscall numbers in ntdll to bypass userland hooks
• compare hooking techniques across CrowdStrike, SentinelOne, Cylance, and Sophos
• contribute hook_finder output to a community EDR dataset

When to choose

• you are a red teamer researching EDR userland hooking on Windows
• you need reference lists of hooked APIs per EDR vendor
• you want working C proof-of-concepts for syscall patching and IAT unhooking

When to avoid

• you need a production-ready evasion framework with maintenance and support
• you are defending endpoints and want a defensive detection tool
• you need something cross-platform or non-Windows

Facets

learning-resource · maturity active

security reverse-engineering developer-tools security penetration-testing windows windows cpp red-team edr av-evasion syscalls ntdll-unhooking offensive-security proof-of-concept

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Mr-Un1k0d3r/EDRs")