About The Project

This project based on taviso/loadlibrary

This demo is a simple PoC of Customizable and Portable Windows Defender

You can make the your own customized functions by hooking functions of Windows Defender.

Getting Started

mploader.exe -f "target_file"

Prerequisites

• ISO C++17 표준(/std:c++17)

• MPEngine and it's AV Container

  https://drive.google.com/drive/folders/1ESzYr4aD7kyrdwrwzVYhdR3A_DQA0H_1?usp=sharing

Installation

1. Clone the repo

   git clone https://github.com/orca-eaa5a/mploader.git

2. Locate the MPEngine and AV Container at "engine" directory

Usage

• Options

  -h  --help                      : print Help page
  -f  --file $filename            : target file to scan
  -r  --relate                    : print related threats
  -u  --unpack                    : enable unpacking method
  -p  --percious                  : makes engine more precisely
  -t  --trace                     : trace the treat detected point
  -l  --log [--reg] [--ignore]    : enable logging api call with stack trace
  -lt --loop-threshold            : modify maximum loop threshold

License

Distributed under the MIT License.