{"adoption": {"forks": 221, "observed_at": "2026-08-28T04:04:22.410055+00:00", "stars": 1324}, "canonical_url": "https://ross.abutalabs.com/products/realblindingedr", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...", "domain": ["security", "penetration-testing", "windows"], "enriched": true, "function": ["security", "reverse-engineering"], "health_score": 27, "homepage": null, "language": "C++", "license": "MIT", "license_family": "permissive", "maturity": "maintenance", "member_repos": ["myzxcg/RealBlindingEDR"], "name": "myzxcg/RealBlindingEDR", "platform": ["windows", "cli"], "pushed_at": "2024-06-21T03:16:55+00:00", "repo": "myzxcg/RealBlindingEDR", "stars": 1324, "tags": ["edr-evasion", "kernel-callbacks", "red-team", "offensive-security", "av-bypass", "windows-kernel", "driver", "kernel"], "topics": [], "urls": [], "use_cases": ["blind EDR kernel callbacks during red team operations", "remove ObRegisterCallbacks to kill protected AV processes", "delete minifilter and registry callbacks to permanently disable antivirus", "clear process and thread notify routines to evade detection", "research Windows kernel callback structures", "test endpoint security resilience on Windows servers"], "what_it_is": "A Windows offensive security tool that uses arbitrary kernel read/write via a signed driver to remove AV/EDR kernel callbacks (ObRegisterCallbacks, CmRegisterCallback, MiniFilter, and process/thread/image notify routines). It can blind, permanently disable, or kill endpoint security products on 64-bit Windows 7 through Windows Server 2022.", "when_to_avoid": ["you need a defensive or detection tool rather than an offensive one", "you require open-source code for all versions (post-v1.5 releases are exe-only)", "your target environment is not 64-bit Windows", "you lack authorization to modify endpoint security software"], "when_to_choose": ["you need to neutralize kernel-level AV/EDR telemetry on Windows during authorized penetration tests", "you are researching Windows kernel callback removal techniques", "you need to disable Windows Defender or Chinese enterprise AV products from kernel"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/realblindingedr", "repo": "myzxcg/RealBlindingEDR", "role": "main", "score": 18}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:22.410055+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:47:01.088565+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "bd0ee5d7264be809b623482a011e14160ac983986fd6d560de7c8c4d6cb16133", "fetched_at": "2026-08-28T04:04:22.410055+00:00", "kind": "readme", "missing": false, "url": "https://github.com/myzxcg/RealBlindingEDR"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 74, "rhythm": 8}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1040, "days_push": 803, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 18, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}