Loads a clean copy of ntdll.dll via file mapping to bypass API inline hooks for stealthy shellcode execution.
Load a fresh new copy of ntdll.dll via file mapping to bypass API inline hook.
This tool is primarily used by penetration testers and red teamers to evade inline API hooks by loading a fresh copy of ntdll.dll directly into memory, allowing execution of unhooked system calls. It enables stealthy shellcode execution and can be adapted for various process injection techniques, enhancing evasion capabilities during offensive security engagements.
Currently only tested on Windows 10 x64; modifications may be required for x86 systems. Usage requires launching through a whitelisted application to avoid detection. The tool can be extended to support various injection techniques, but users should ensure compliance with legal and ethical guidelines when employing it.
Clone the repository from GitHub
Open the project in a C# compatible IDE (e.g., Visual Studio)
Modify <MainFunction.cs> if targeting x86 architecture
Build the project targeting Windows 10 x64
Launch the compiled executable through a whitelisted applicationLaunch the compiled executable via a whitelisted application
Executes the tool to load a clean ntdll.dll copy and run embedded shellcode stealthily