# Framework * do not merge fields, create event filters like in iEDR * output events live # Hooker.dll * write a thread-less hooker.dll, to strip EDRSandblast dependency * allocate memory and write dll (same as before) * relocate addresses from external process (new, instead of reflective loading) * hook functions from external process (new, instead self-hooking) * does MinHook or Detours support this? * do not resolve handle names via syscalls, store them at NtOpenX time * store/output actual values from NtReadVirtualMemory * better resolving of memory regions with NtReadVirtualMemory * output stack trace?
Framework
Hooker.dll