ORCx41/KnownDllUnhook

This is stars and forks stats for /ORCx41/KnownDllUnhook repository. As of 03 May, 2024 this repository has 270 stars and 37 forks.

KnownDllUnhook: Replace the .txt section of the current loaded modules from \KnownDlls\ to do api unhooking How Does it Work: first, it loops through the loaded dlls check if the name of the loaded dll is found in \KnownDlls\ dir if found, the dll will be mapped to the current process then, some calculations happen ( to get the address of the .txt section of the current dll & it's size ) change the memory permissions on current dll's .txt to 'PAGE_EXECUTE_WRITECOPY' replace the .txt section from...