{"adoption": {"forks": 357, "observed_at": "2026-08-28T04:06:25.729984+00:00", "stars": 2202}, "canonical_url": "https://ross.abutalabs.com/products/edrs", "card": {"archived": false, "artifact_type": "learning-resource", "description": null, "domain": ["security", "penetration-testing", "windows"], "enriched": true, "function": ["security", "reverse-engineering", "developer-tools"], "health_score": 65, "homepage": null, "language": "C", "license": null, "license_family": "other", "maturity": "active", "member_repos": ["Mr-Un1k0d3r/EDRs"], "name": "Mr-Un1k0d3r/EDRs", "platform": ["windows", "cpp"], "pushed_at": "2026-04-03T13:02:13+00:00", "repo": "Mr-Un1k0d3r/EDRs", "stars": 2202, "tags": ["red-team", "edr", "av-evasion", "syscalls", "ntdll-unhooking", "offensive-security", "proof-of-concept"], "topics": [], "urls": [], "use_cases": ["find which ntdll APIs an EDR hooks before an engagement", "dynamically resolve syscall IDs without knowing the Windows version", "unhook the Import Address Table to remove EDR hooks", "patch syscall numbers in ntdll to bypass userland hooks", "compare hooking techniques across CrowdStrike, SentinelOne, Cylance, and Sophos", "contribute hook_finder output to a community EDR dataset"], "what_it_is": "A collection of proof-of-concept C tools and reference data for understanding EDR/AV hooking on Windows, including syscall patching utilities and lists of hooked ntdll.dll APIs per vendor. It is aimed at red team operators researching endpoint detection evasion techniques.", "when_to_avoid": ["you need a production-ready evasion framework with maintenance and support", "you are defending endpoints and want a defensive detection tool", "you need something cross-platform or non-Windows"], "when_to_choose": ["you are a red teamer researching EDR userland hooking on Windows", "you need reference lists of hooked APIs per EDR vendor", "you want working C proof-of-concepts for syscall patching and IAT unhooking"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/edrs", "repo": "Mr-Un1k0d3r/EDRs", "role": "main", "score": 66}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:25.729984+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:47:01.378108+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b57c5f0252423e8367fa9cb509ff5d2a36c5db656046b38366cf6c5f7c85580b", "fetched_at": "2026-08-28T04:06:25.729984+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Mr-Un1k0d3r/EDRs"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 75, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": ["no_releases", "no_license"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2010, "days_push": 152, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 66, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}