├── eset_unloader ├── eset_unloader.vcxproj.user ├── eset_unloader.vcxproj.filters ├── unload_eset.cpp └── eset_unloader.vcxproj ├── eset_unloader.sln ├── LICENSE └── README.md /eset_unloader/eset_unloader.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /eset_unloader/eset_unloader.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /eset_unloader.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.13.35913.81 d17.13 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "eset_unloader", "eset_unloader\eset_unloader.vcxproj", "{4CC45A2E-B314-43E6-8A2E-698D170BF827}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x64.ActiveCfg = Debug|x64 17 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x64.Build.0 = Debug|x64 18 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x86.ActiveCfg = Debug|Win32 19 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x86.Build.0 = Debug|Win32 20 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x64.ActiveCfg = Release|x64 21 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x64.Build.0 = Release|x64 22 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x86.ActiveCfg = Release|Win32 23 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {F3B29749-322F-475C-A740-368FEDCBBCA9} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2025 EvilBytecode 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to use the Software for educational and authorized cybersecurity research purposes only, subject to the following conditions: 7 | 8 | The above copyright notice, this permission notice, and the following disclaimer shall be included in all copies or substantial portions of the Software. 9 | 10 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 11 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS (INCLUDING EvilBytecode) BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 12 | WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE, COPYING, DOWNLOADING, OR OTHER DEALINGS IN THE SOFTWARE. 13 | 14 | DISCLAIMER: I, EvilBytecode, release this project strictly for educational, academic, and authorized cybersecurity research purposes. 15 | By accessing, downloading, copying, using, or modifying this software, you agree to these terms. 16 | You must obtain explicit written permission from system owners before conducting any testing using this software. 17 | Unauthorized use, distribution, or deployment of this software against any third party, device, network, or system without prior consent is strictly forbidden and illegal. 18 | I, EvilBytecode, disclaim all responsibility, liability, or consequences arising from any misuse, illegal activities, damages, or losses resulting from this software. -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Eset-Unload 💉 2 | 3 | This project is a C++ application designed to help unload or manually load and unload the `ebehmoni.dll` module, a part of the ESET security software. It uses Visual Studio 143 toolset (v143) and ISO C++14. 4 | 5 | --- 6 | 7 | ## 📜 Project Overview 8 | 9 | The main goal of this tool is to: 10 | - Enumerate and find the `ebehmoni.dll` module loaded in the current process. 11 | - If found, unload it. 12 | - If not found, load it manually from a specific path and then unload it. 13 | 14 | This tool works by using Windows API calls to manage DLLs within the process. 15 | 16 | --- 17 | 18 | ## 🔧 How to Build and Run 19 | 20 | ### ⚙️ Prerequisites: 21 | - Visual Studio 143 toolset (v143) or later. 22 | - C++14 or later. 23 | - Windows SDK (for necessary APIs such as `Psapi.h`, `Windows.h`). 24 | 25 | ### 🏗️ Steps to Build: 26 | 1. Clone the repository. 27 | 2. Open the project in Visual Studio. 28 | 3. Build the solution. 29 | 4. The executable will be generated in the output directory. 30 | 5. Run the application to perform the DLL unloading tasks. 31 | 32 | --- 33 | 34 | ## ⚙️ Usage 35 | 36 | 1. **Running the Application:** 37 | - Compile the application. 38 | - When you run it, the following will happen: 39 | - The current process ID is displayed. 40 | - The tool attempts to find and unload the `ebehmoni.dll`. 41 | - If it is not found, it tries to load the DLL from `C:\Program Files\ESET\ESET Security\` and then unloads it. 42 | 43 | 2. **Example Output**: 44 | ``` 45 | [before start] press any key to begin module inspection... 46 | Press any key to continue . . . 47 | enumerating loaded modules in process 9100 48 | old base address of ebehmoni.dll: 0x7ffcfc570000 49 | found ebehmoni.dll at: C:\Program Files\ESET\ESET Security\ebehmoni.dll 50 | successfully unloaded module. 51 | attempting to unload ebehmoni.dll... 52 | [after completion] press any key to exit... 53 | Press any key to continue . . . 54 | ``` 55 | 56 | --- 57 | 58 | ## ⚙️ Requirements 59 | 60 | - **Windows OS**: This application is built to run on Windows. 61 | - **Visual Studio 143 (v143)**: Required for compilation. 62 | - **C++14 Standard**: The code is written using ISO C++14. 63 | 64 | --- 65 | 66 | ## 🚀 Contributing 67 | 68 | Feel free to fork the repository and create pull requests! Please ensure that your code is compatible with C++14 and follows the general coding standards. 69 | 70 | --- 71 | 72 | ## 📄 License 73 | 74 | This project is open-source under the MIT License. Check the `LICENSE` file for more details. 75 | 76 | --- 77 | 78 | ## ⚠️ Important Notes 79 | 80 | - **Warning**: This tool is intended for educational purposes. Please use it responsibly and ensure you have permission before interacting with system modules. 81 | - **Disclaimer**: I, Evilbytecode, do not take any responsibility for the misuse of this tool. By using it, you acknowledge that you have proper authorization and are solely responsible for any consequences of its usage. Ensure you are using this tool in a legal and ethical manner. 82 | 83 | ## How to verify that it worked 84 | - Open the process (Do not press anything yet) 85 | - Open sysinformer/prochacker and open your process and press on modules tab 86 | - you will see the .dll and go back to your process and press enter. after that go back and .dll wont be there. 87 | 88 | 89 | ## License 90 | This project is licensed under the MIT License. See the LICENSE file for details. -------------------------------------------------------------------------------- /eset_unloader/unload_eset.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #pragma comment(lib, "psapi.lib") 8 | 9 | class unload_eset { 10 | public: 11 | void run() { 12 | print_intro(); 13 | system("pause"); 14 | DWORD pid = get_current_pid(); 15 | set_color(11); 16 | std::wcout << L"enumerating loaded modules in process " << pid << std::endl; 17 | process_target_module(L"ebehmoni.dll"); 18 | set_color(14); 19 | std::wcout << L"attempting to unload ebehmoni.dll..." << std::endl; 20 | set_color(14); 21 | std::wcout << L"[after completion] press any key to exit..." << std::endl; 22 | system("pause"); 23 | } 24 | 25 | private: 26 | void set_color(WORD color) { 27 | SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), color); 28 | } 29 | std::wstring to_lower(const std::wstring& input) { 30 | std::wstring out = input; 31 | std::transform(out.begin(), out.end(), out.begin(), ::towlower); 32 | return out; 33 | } 34 | void unload_module(HMODULE module) { 35 | if (FreeLibrary(module)) { 36 | set_color(10); 37 | std::wcout << L"successfully unloaded module." << std::endl; 38 | } 39 | else { 40 | set_color(12); 41 | std::wcerr << L"failed to unload module." << std::endl; 42 | } 43 | set_color(7); 44 | } 45 | void handle_module(const std::wstring& name, HMODULE module, const std::wstring& full_path) { 46 | MODULEINFO mod_info; 47 | if (GetModuleInformation(GetCurrentProcess(), module, &mod_info, sizeof(mod_info))) { 48 | set_color(9); 49 | std::wcout << L"old base address of " << name << L": 0x" 50 | << std::hex << reinterpret_cast(mod_info.lpBaseOfDll) << std::endl; 51 | } 52 | set_color(13); 53 | std::wcout << L"found " << name << L" at: " << full_path << std::endl; 54 | unload_module(module); 55 | } 56 | 57 | bool try_find_module(HMODULE& module, const std::wstring& target_name, std::wstring& path) { 58 | HMODULE h_mods[1024]; 59 | DWORD cb_needed; 60 | if (EnumProcessModules(GetCurrentProcess(), h_mods, sizeof(h_mods), &cb_needed)) { 61 | for (unsigned int i = 0; i < cb_needed / sizeof(HMODULE); i++) { 62 | WCHAR sz_mod_name[MAX_PATH]; 63 | if (GetModuleFileNameExW(GetCurrentProcess(), h_mods[i], sz_mod_name, MAX_PATH)) { 64 | std::wstring current_path = sz_mod_name; 65 | if (to_lower(current_path).find(to_lower(target_name)) != std::wstring::npos) { 66 | module = h_mods[i]; 67 | path = current_path; 68 | return true; 69 | } 70 | } 71 | } 72 | } 73 | return false; 74 | } 75 | void process_target_module(const std::wstring& name) { 76 | HMODULE module = nullptr; 77 | std::wstring path; 78 | if (try_find_module(module, name, path)) { 79 | handle_module(name, module, path); 80 | } 81 | else { 82 | set_color(6); 83 | std::wcout << name << L" not found in process. loading manually..." << std::endl; 84 | std::wstring full_load_path = L"C:\\Program Files\\ESET\\ESET Security\\" + name; 85 | HMODULE forced = LoadLibraryW(full_load_path.c_str()); 86 | if (forced) { 87 | MODULEINFO mod_info; 88 | if (GetModuleInformation(GetCurrentProcess(), forced, &mod_info, sizeof(mod_info))) { 89 | set_color(9); 90 | std::wcout << L"forced old base address of " << name << L": 0x" 91 | << std::hex << reinterpret_cast(mod_info.lpBaseOfDll) << std::endl; 92 | } 93 | set_color(13); 94 | std::wcout << L"manually loaded " << name << L" at: " << full_load_path << std::endl; 95 | unload_module(forced); 96 | } 97 | else { 98 | set_color(12); 99 | std::wcerr << L"failed to manually load " << name << std::endl; 100 | } 101 | } 102 | } 103 | void print_intro() { 104 | set_color(14); 105 | std::wcout << L"[before start] press any key to begin module inspection..." << std::endl; 106 | } 107 | DWORD get_current_pid() { 108 | return GetCurrentProcessId(); 109 | } 110 | }; 111 | 112 | int wmain() { 113 | unload_eset u; 114 | u.run(); 115 | return 0; 116 | } 117 | -------------------------------------------------------------------------------- /eset_unloader/eset_unloader.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 17.0 23 | Win32Proj 24 | {4cc45a2e-b314-43e6-8a2e-698d170bf827} 25 | esetunloader 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | Level3 76 | true 77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 78 | true 79 | 80 | 81 | Console 82 | true 83 | 84 | 85 | 86 | 87 | Level3 88 | true 89 | true 90 | true 91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 92 | true 93 | 94 | 95 | Console 96 | true 97 | true 98 | true 99 | 100 | 101 | 102 | 103 | Level3 104 | true 105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 106 | true 107 | 108 | 109 | Console 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | true 118 | true 119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 120 | true 121 | 122 | 123 | Console 124 | true 125 | true 126 | true 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | --------------------------------------------------------------------------------