timwhitez / Doge-ReMap

Unhook full dll by Section ReMap

Doge-ReMap

Unhook full dll by Section ReMap

NtCreateFile
NtCreateSection
NtMapViewOfSection

Ref

偶然看到了个代码: https://github.com/slaeryan/AQUARMOURY/blob/master/Shellycoat/Src/SectionRemap.h

想到大佬的文章: https://idiotc4t.com/defense-evasion/load-ntdll-too

便动手写了个golang的