myzxcg/RealBlindingEDR

Health v2 · maintenance only

Adoption not part of the score

1324 stars · 221 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Windows offensive security tool that uses arbitrary kernel read/write via a signed driver to remove AV/EDR kernel callbacks (ObRegisterCallbacks, CmRegisterCallback, MiniFilter, and process/thread/image notify routines). It can blind, permanently disable, or kill endpoint security products on 64-bit Windows 7 through Windows Server 2022.

Use cases

• blind EDR kernel callbacks during red team operations
• remove ObRegisterCallbacks to kill protected AV processes
• delete minifilter and registry callbacks to permanently disable antivirus
• clear process and thread notify routines to evade detection
• research Windows kernel callback structures
• test endpoint security resilience on Windows servers

When to choose

• you need to neutralize kernel-level AV/EDR telemetry on Windows during authorized penetration tests
• you are researching Windows kernel callback removal techniques
• you need to disable Windows Defender or Chinese enterprise AV products from kernel

When to avoid

• you need a defensive or detection tool rather than an offensive one
• you require open-source code for all versions (post-v1.5 releases are exe-only)
• your target environment is not 64-bit Windows
• you lack authorization to modify endpoint security software

Facets

cli-tool · maturity maintenance

security reverse-engineering security penetration-testing windows windows cli edr-evasion kernel-callbacks red-team offensive-security av-bypass windows-kernel driver kernel

Member repositories

For agents

markdown · JSON · MCP: product_card(name="myzxcg/RealBlindingEDR")