├── eset_unloader
├── eset_unloader.vcxproj.user
├── eset_unloader.vcxproj.filters
├── unload_eset.cpp
└── eset_unloader.vcxproj
├── eset_unloader.sln
├── LICENSE
└── README.md
/eset_unloader/eset_unloader.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/eset_unloader/eset_unloader.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
--------------------------------------------------------------------------------
/eset_unloader.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 17
4 | VisualStudioVersion = 17.13.35913.81 d17.13
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "eset_unloader", "eset_unloader\eset_unloader.vcxproj", "{4CC45A2E-B314-43E6-8A2E-698D170BF827}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x64.ActiveCfg = Debug|x64
17 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x64.Build.0 = Debug|x64
18 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x86.ActiveCfg = Debug|Win32
19 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Debug|x86.Build.0 = Debug|Win32
20 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x64.ActiveCfg = Release|x64
21 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x64.Build.0 = Release|x64
22 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x86.ActiveCfg = Release|Win32
23 | {4CC45A2E-B314-43E6-8A2E-698D170BF827}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {F3B29749-322F-475C-A740-368FEDCBBCA9}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2025 EvilBytecode
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to use the Software for educational and authorized cybersecurity research purposes only, subject to the following conditions:
7 |
8 | The above copyright notice, this permission notice, and the following disclaimer shall be included in all copies or substantial portions of the Software.
9 |
10 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS (INCLUDING EvilBytecode) BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
12 | WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE, COPYING, DOWNLOADING, OR OTHER DEALINGS IN THE SOFTWARE.
13 |
14 | DISCLAIMER: I, EvilBytecode, release this project strictly for educational, academic, and authorized cybersecurity research purposes.
15 | By accessing, downloading, copying, using, or modifying this software, you agree to these terms.
16 | You must obtain explicit written permission from system owners before conducting any testing using this software.
17 | Unauthorized use, distribution, or deployment of this software against any third party, device, network, or system without prior consent is strictly forbidden and illegal.
18 | I, EvilBytecode, disclaim all responsibility, liability, or consequences arising from any misuse, illegal activities, damages, or losses resulting from this software.
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Eset-Unload 💉
2 |
3 | This project is a C++ application designed to help unload or manually load and unload the `ebehmoni.dll` module, a part of the ESET security software. It uses Visual Studio 143 toolset (v143) and ISO C++14.
4 |
5 | ---
6 |
7 | ## 📜 Project Overview
8 |
9 | The main goal of this tool is to:
10 | - Enumerate and find the `ebehmoni.dll` module loaded in the current process.
11 | - If found, unload it.
12 | - If not found, load it manually from a specific path and then unload it.
13 |
14 | This tool works by using Windows API calls to manage DLLs within the process.
15 |
16 | ---
17 |
18 | ## 🔧 How to Build and Run
19 |
20 | ### ⚙️ Prerequisites:
21 | - Visual Studio 143 toolset (v143) or later.
22 | - C++14 or later.
23 | - Windows SDK (for necessary APIs such as `Psapi.h`, `Windows.h`).
24 |
25 | ### 🏗️ Steps to Build:
26 | 1. Clone the repository.
27 | 2. Open the project in Visual Studio.
28 | 3. Build the solution.
29 | 4. The executable will be generated in the output directory.
30 | 5. Run the application to perform the DLL unloading tasks.
31 |
32 | ---
33 |
34 | ## ⚙️ Usage
35 |
36 | 1. **Running the Application:**
37 | - Compile the application.
38 | - When you run it, the following will happen:
39 | - The current process ID is displayed.
40 | - The tool attempts to find and unload the `ebehmoni.dll`.
41 | - If it is not found, it tries to load the DLL from `C:\Program Files\ESET\ESET Security\` and then unloads it.
42 |
43 | 2. **Example Output**:
44 | ```
45 | [before start] press any key to begin module inspection...
46 | Press any key to continue . . .
47 | enumerating loaded modules in process 9100
48 | old base address of ebehmoni.dll: 0x7ffcfc570000
49 | found ebehmoni.dll at: C:\Program Files\ESET\ESET Security\ebehmoni.dll
50 | successfully unloaded module.
51 | attempting to unload ebehmoni.dll...
52 | [after completion] press any key to exit...
53 | Press any key to continue . . .
54 | ```
55 |
56 | ---
57 |
58 | ## ⚙️ Requirements
59 |
60 | - **Windows OS**: This application is built to run on Windows.
61 | - **Visual Studio 143 (v143)**: Required for compilation.
62 | - **C++14 Standard**: The code is written using ISO C++14.
63 |
64 | ---
65 |
66 | ## 🚀 Contributing
67 |
68 | Feel free to fork the repository and create pull requests! Please ensure that your code is compatible with C++14 and follows the general coding standards.
69 |
70 | ---
71 |
72 | ## 📄 License
73 |
74 | This project is open-source under the MIT License. Check the `LICENSE` file for more details.
75 |
76 | ---
77 |
78 | ## ⚠️ Important Notes
79 |
80 | - **Warning**: This tool is intended for educational purposes. Please use it responsibly and ensure you have permission before interacting with system modules.
81 | - **Disclaimer**: I, Evilbytecode, do not take any responsibility for the misuse of this tool. By using it, you acknowledge that you have proper authorization and are solely responsible for any consequences of its usage. Ensure you are using this tool in a legal and ethical manner.
82 |
83 | ## How to verify that it worked
84 | - Open the process (Do not press anything yet)
85 | - Open sysinformer/prochacker and open your process and press on modules tab
86 | - you will see the .dll and go back to your process and press enter. after that go back and .dll wont be there.
87 |
88 |
89 | ## License
90 | This project is licensed under the MIT License. See the LICENSE file for details.
--------------------------------------------------------------------------------
/eset_unloader/unload_eset.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 | #include
4 | #include
5 | #include
6 |
7 | #pragma comment(lib, "psapi.lib")
8 |
9 | class unload_eset {
10 | public:
11 | void run() {
12 | print_intro();
13 | system("pause");
14 | DWORD pid = get_current_pid();
15 | set_color(11);
16 | std::wcout << L"enumerating loaded modules in process " << pid << std::endl;
17 | process_target_module(L"ebehmoni.dll");
18 | set_color(14);
19 | std::wcout << L"attempting to unload ebehmoni.dll..." << std::endl;
20 | set_color(14);
21 | std::wcout << L"[after completion] press any key to exit..." << std::endl;
22 | system("pause");
23 | }
24 |
25 | private:
26 | void set_color(WORD color) {
27 | SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), color);
28 | }
29 | std::wstring to_lower(const std::wstring& input) {
30 | std::wstring out = input;
31 | std::transform(out.begin(), out.end(), out.begin(), ::towlower);
32 | return out;
33 | }
34 | void unload_module(HMODULE module) {
35 | if (FreeLibrary(module)) {
36 | set_color(10);
37 | std::wcout << L"successfully unloaded module." << std::endl;
38 | }
39 | else {
40 | set_color(12);
41 | std::wcerr << L"failed to unload module." << std::endl;
42 | }
43 | set_color(7);
44 | }
45 | void handle_module(const std::wstring& name, HMODULE module, const std::wstring& full_path) {
46 | MODULEINFO mod_info;
47 | if (GetModuleInformation(GetCurrentProcess(), module, &mod_info, sizeof(mod_info))) {
48 | set_color(9);
49 | std::wcout << L"old base address of " << name << L": 0x"
50 | << std::hex << reinterpret_cast(mod_info.lpBaseOfDll) << std::endl;
51 | }
52 | set_color(13);
53 | std::wcout << L"found " << name << L" at: " << full_path << std::endl;
54 | unload_module(module);
55 | }
56 |
57 | bool try_find_module(HMODULE& module, const std::wstring& target_name, std::wstring& path) {
58 | HMODULE h_mods[1024];
59 | DWORD cb_needed;
60 | if (EnumProcessModules(GetCurrentProcess(), h_mods, sizeof(h_mods), &cb_needed)) {
61 | for (unsigned int i = 0; i < cb_needed / sizeof(HMODULE); i++) {
62 | WCHAR sz_mod_name[MAX_PATH];
63 | if (GetModuleFileNameExW(GetCurrentProcess(), h_mods[i], sz_mod_name, MAX_PATH)) {
64 | std::wstring current_path = sz_mod_name;
65 | if (to_lower(current_path).find(to_lower(target_name)) != std::wstring::npos) {
66 | module = h_mods[i];
67 | path = current_path;
68 | return true;
69 | }
70 | }
71 | }
72 | }
73 | return false;
74 | }
75 | void process_target_module(const std::wstring& name) {
76 | HMODULE module = nullptr;
77 | std::wstring path;
78 | if (try_find_module(module, name, path)) {
79 | handle_module(name, module, path);
80 | }
81 | else {
82 | set_color(6);
83 | std::wcout << name << L" not found in process. loading manually..." << std::endl;
84 | std::wstring full_load_path = L"C:\\Program Files\\ESET\\ESET Security\\" + name;
85 | HMODULE forced = LoadLibraryW(full_load_path.c_str());
86 | if (forced) {
87 | MODULEINFO mod_info;
88 | if (GetModuleInformation(GetCurrentProcess(), forced, &mod_info, sizeof(mod_info))) {
89 | set_color(9);
90 | std::wcout << L"forced old base address of " << name << L": 0x"
91 | << std::hex << reinterpret_cast(mod_info.lpBaseOfDll) << std::endl;
92 | }
93 | set_color(13);
94 | std::wcout << L"manually loaded " << name << L" at: " << full_load_path << std::endl;
95 | unload_module(forced);
96 | }
97 | else {
98 | set_color(12);
99 | std::wcerr << L"failed to manually load " << name << std::endl;
100 | }
101 | }
102 | }
103 | void print_intro() {
104 | set_color(14);
105 | std::wcout << L"[before start] press any key to begin module inspection..." << std::endl;
106 | }
107 | DWORD get_current_pid() {
108 | return GetCurrentProcessId();
109 | }
110 | };
111 |
112 | int wmain() {
113 | unload_eset u;
114 | u.run();
115 | return 0;
116 | }
117 |
--------------------------------------------------------------------------------
/eset_unloader/eset_unloader.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 17.0
23 | Win32Proj
24 | {4cc45a2e-b314-43e6-8a2e-698d170bf827}
25 | esetunloader
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v143
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v143
39 | true
40 | Unicode
41 |
42 |
43 | Application
44 | true
45 | v143
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v143
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 |
75 | Level3
76 | true
77 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
78 | true
79 |
80 |
81 | Console
82 | true
83 |
84 |
85 |
86 |
87 | Level3
88 | true
89 | true
90 | true
91 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
92 | true
93 |
94 |
95 | Console
96 | true
97 | true
98 | true
99 |
100 |
101 |
102 |
103 | Level3
104 | true
105 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
106 | true
107 |
108 |
109 | Console
110 | true
111 |
112 |
113 |
114 |
115 | Level3
116 | true
117 | true
118 | true
119 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
120 | true
121 |
122 |
123 | Console
124 | true
125 | true
126 | true
127 |
128 |
129 |
130 |
131 |
132 |
133 |
134 |
135 |
--------------------------------------------------------------------------------