myzxcg/realblindingedr

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

realblindingedr's Issues

echo_driver.sys

Hello, do you have the driver file for echo_driver.sys? After I downloaded it from the download link of echo_driver.sys, it was a bin file and garbled characters. If you are willing, please send the echo_driver.sys driver file to my email: [email protected]. Thank you in advance.

No update in sources to work with 3 and 4 drivers

There are no updates in sources to work with new drivers.

,问问大佬,如何恢复啊

,问问大佬,如何恢复啊,问问大佬,如何恢复啊,问问大佬,如何恢复啊

加载驱动后报错：Error Code: c000003a.

环境：管理员权限，驱动是正确的。在win11和win10下都是如此
.\K-RealBlindingEDR.exe .\echo_driver.sys 1

Windows version: 10.0.22621 version.
Error Code: c000003a.
Driver loading failed.

驱动加载行为被360拦截

360核晶下，原版echo_driver.sys被检测hash，微调修改hash绕过检测，但是驱动加载行为被检测，行为被拦截。

Releases

can you upload them ready to use for win10 and above? like how you have in your video?

I try with sentinelone .
Build started...
1>------ Build started: Project: RealBlindingEDR, Configuration: Debug x64 ------
1>RealBlindingEDR.cpp
1>C:\Users\asus\Desktop\Kniget\EDR\RealBlindingEDR-1.1\RealBlindingEDR-1.1\RealBlindingEDR\RealBlindingEDR\RealBlindingEDR.cpp(210,7): warning C4996: 'stricmp': The POSIX name for this item is deprecated. Instead, use the ISO C and C++ conformant name: _stricmp. See online help for details.
1>C:\Users\asus\Desktop\Kniget\EDR\RealBlindingEDR-1.1\RealBlindingEDR-1.1\RealBlindingEDR\RealBlindingEDR\RealBlindingEDR.cpp(700,2): warning C4996: 'wcstombs': This function or variable may be unsafe. Consider using wcstombs_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
1>C:\Users\asus\Desktop\Kniget\EDR\RealBlindingEDR-1.1\RealBlindingEDR-1.1\RealBlindingEDR\RealBlindingEDR\RealBlindingEDR.cpp(874,13): warning C4018: '<': signed/unsigned mismatch
1>C:\Users\asus\Desktop\Kniget\EDR\RealBlindingEDR-1.1\RealBlindingEDR-1.1\RealBlindingEDR\RealBlindingEDR\RealBlindingEDR.cpp(951,13): warning C4018: '<': signed/unsigned mismatch
1>RealBlindingEDR.vcxproj -> C:\Users\asus\Desktop\Kniget\EDR\RealBlindingEDR-1.1\RealBlindingEDR-1.1\RealBlindingEDR\x64\Debug\RealBlindingEDR.exe
1>Done building project "RealBlindingEDR.vcxproj".
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Build started at 7:14 PM and took 04.234 seconds ==========

GameGuard

Hi could you add https://gameguard.ac please. It registers callbacks at 320520 and 320521

Happy to donate to add

如何恢复av能力

hello，请问成功清除各类av的callback之后。项目结束后，如何恢复av的能力

请问echo_driver.sys在哪里下载

请问echo_driver.sys在哪里下载 链接下载的是一个bin文件 直接该后缀为.sys吗？？？

hello bro, where can I find wnBio.sys?

驱动hash修改了，但是加载驱动被拦截如何解决，大佬求教