> For the complete documentation index, see [llms.txt](https://steve-s.gitbook.io/0xtriboulet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://steve-s.gitbook.io/0xtriboulet/archive/notice/unholy-unhooking.md).

# Unholy Unhooking

- [Unholy Unhooking: byoDLL](https://steve-s.gitbook.io/0xtriboulet/archive/notice/unholy-unhooking/unholy-unhooking-byodll.md): Using our own copy of ntdll.dll, our implant will clear AV hooks and execute a malicious payload.
- [Unholy Unhooking: FrByoDLL](https://steve-s.gitbook.io/0xtriboulet/archive/notice/unholy-unhooking/unholy-unhooking-frbyodll.md): Using pe2shc, we'll load a clean copy of ntdll.dll in memory, unhook our program, and execute our malicious payload.
- [Unholy Unhooking: Rusty Fart](https://steve-s.gitbook.io/0xtriboulet/archive/notice/unholy-unhooking/unholy-unhooking-rusty-fart.md): An overview of Perun's Fart implemented in Rust