search

myzxcg / RealBlindingEDR

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...
MIT License
955 stars 174 forks source link

WPF filter #15

Closed sec13b closed 1 month ago

sec13b commented 1 month ago

is it possible to apply WPF filter to some specific driver ? Thanks,

myzxcg commented 1 month ago

This project has not yet implemented the processing of WPF filter. There are other open source projects that have implemented WPF filter to block EDR communication.

sec13b commented 1 month ago
  1. i love your work
  2. for WPF filter i will search.
  3. a second question , (is for me ) how i convert .sys file in driver shellcode , i think is more ok to use the lol drivers in unsigned char shellcode edr/xdr dont cant smell
  4. how i convert .sys file in .bin

thank you

myzxcg commented 1 month ago
  1. As far as I know, since the absolute path of the driver needs to be specified when registering and loading the driver, it is not possible to convert the driver into shellcode and load it in memory at the same time. However, this is not absolute, and there may still be other ways that have not been discovered yet.
  2. The .bin file is just the name on the loldrivers website, you just need to change it to a .sys suffix.
sec13b commented 1 month ago

bin/sys is instant detected

myzxcg commented 1 month ago

It is normal to be detected. This is an open source project and is only used for testing.

myzxcg commented 1 month ago

If you want to exploit, you need to find an undisclosed exploitable driver and integrate it into this project.