defendnot - GitLite

KO | EN

gitlite — search

#python #react #ai #llm #go #machine-learning #linux #docker #nodejs #java #windows #awesome #kubernetes #vue

defendnot

(★ 3,623)

An even funnier way to disable windows defender (through WSC api)

파일 탐색기

최종 버전 다운로드 (.zip)

- - build.yml
- - com.hpp
  - ctx.hpp
  - defer.hpp
  - ipc.hpp
  - native.hpp
  - strings.hpp
  - util.hpp
- cxx-shared.vcxitems
- cxx-shared.vcxitems.user
- - bootstrap.cpp
  - bootstrap.hpp
- - com.hpp
  - log.hpp
- defendnot.vcxproj
- defendnot.vcxproj.filters
- defendnot.vcxproj.user
- dllmain.cpp
- - autorun.cpp
  - core.hpp
  - ensure_environment.cpp
  - inject.cpp
- - scm.hpp
- defendnot-loader.vcxproj
- defendnot-loader.vcxproj.filters
- defendnot-loader.vcxproj.user
- main.cpp
- argparse
- main.cpp
- wsc-binary-check.vcxproj
- wsc-binary-check.vcxproj.filters
- wsc-binary-check.vcxproj.user
.clang-format
.gitignore
.gitmodules
defendnot.sln
extra-strip.bat
install.ps1
LICENSE
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/es3n1n/defendnot

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd defendnot

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. 공식 설치 스크립트

쉬움 추천

irm https://dnot.sh/ | iex

공식 설치 스크립트를 다운로드해서 바로 실행합니다 (PowerShell). 이 한 줄로 필요한 게 자동으로 설치됩니다.

✅ 설치 후 새 터미널을 열고, 프로그램의 버전 확인 명령(예: --version)으로 정상 설치됐는지 확인하세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. .NET

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# defendnot

<img src="https://i.imgur.com/F9gWA92.png" align="right" width="50%"/>

An even funnier way to disable windows defender.

> [!CAUTION]
> **Permitted Use Notice**: 
> 
> Using this tool to facilitate malware distribution, or any illegal activity is strictly prohibited.
> 
> Users assume all legal responsibility for how they use this tool and any consequences thereof. You must comply with all applicable laws when using this tool.
> 
> By downloading, installing, or using this tool, you acknowledge that you agree to these terms.

## Installation

> [!WARNING]
> You may need to temporarily disable realtime and tamper protection before proceeding, otherwise defender will block defendnot binaries from running.
>
> On newer Windows 11 builds you may also have to turn off Smart App Control.
>
> - Real-time protection: `windowsdefender://threatsettings/`
> - Smart App Control: `windowsdefender://appbrowser/`

### One-liner

Open the powershell as administrator and execute any of these:

```powershell
# Example 1: Basic installation
irm https://dnot.sh/ | iex

# Example 2: With custom AV name and firewall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --name "Custom AV name" --firewall

# Example 3: Without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent

# Example 4: Run once, without allocating console
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --silent --disable-autorun

# Example 5: Uninstall
& ([ScriptBlock]::Create((irm https://dnot.sh/))) --disable
```

### Manual

Download the [latest](https://github.com/es3n1n/defendnot/releases/latest) release, extract it somewhere and launch `defendnot-loader`.

## Usage

```commandline
Usage: defendnot-loader [--help] [--version] [--name VAR] [--disable] [--verbose] [--firewall] [--silent] [--autorun-as-user] [--disable-autorun]

Optional arguments:
  -h, --help         prints help message and exits
  --version          shows version and exits
  -n, --name         av display name [default: "dnot.sh"]
  -d, --disable      disable defendnot
  -v, --verbose      verbose logging
  --firewall         also register a fake firewall
  --silent           do not allocate console
  --autorun-as-user  create autorun task as currently logged in user
  --disable-autorun  disable autorun task creation
```

## Stripping Defender out further (optional)

defendnot only registers a fake AV through WSC, but if you want to strip more Defender stuff out, run the optional `extra-strip.bat` as admin after defendnot is active. It disables a bunch more Defender policies in registry: real-time monitoring, behavior monitoring, cloud reporting, signature updates, etc.

It's a separate script because the keys are finicky and undoing them on `--disable` would mean saving every value first somewhere and writing all of them back, which is _waaay_ more bookkeeping than I feel like implementing.

## Limitations

- **Needs to stay on disk:**  
  To keep the AV registration after reboot, defendnot adds itself to autorun.

## Writeup

[How I ruined my vacation by reverse engineering WSC](https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/)

## Special thanks

* [mrbruh](https://mrbruh.com) for poking me to research this topic
* [pindos](https://github.com/pind0s) for providing their machine for WSC service debugging

## License

Apache-2.0