sync/es3n1n-defendnot
1
0
Fork 0
mirror of https://github.com/es3n1n/defendnot.git synced 2026-08-02 10:32:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(installer): add powershell installer

Browse Source
This commit is contained in:
es3n1n
2025-05-20 11:58:22 +09:00
parent cc2b52b86a
commit a11a1fe7b6
2 changed files with 86 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
README.md
View File

@@ -6,16 +6,29 @@ Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender)
![](https://i.imgur.com/VGE8g6a.jpeg)
## How it works
## Installation
There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
### One-liner
The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.
Open the powershell as administrator and execute any of these:
## Limitations
```powershell
# Example 1: Basic installation
irm https://es3n1n.io/defendnot.ps1 | iex
Sadly, to keep this WSC stuff even after reboot, defendnot adds itself to the autorun. Thus, you would need to keep the defendnot binaries on your disk :(
# Example 2: With custom AV name
irm https://es3n1n.io/defendnot.ps1 | iex --name "Custom AV name"
# Example 3: Without allocating console
irm https://es3n1n.io/defendnot.ps1 | iex --silent
```
> [!NOTE]
> You can pass arguments to iex and installer script will forward your arguments to `defendnot-loader` as seen in examples 2 and 3. For reference what commandline arguments are allowed, see the `Usage` section below.
### Manual
Download the [latest](https://github.com/es3n1n/defendnot/releases/latest) release, extract it somewhere and launch `defendnot-loader`.
## Usage
@@ -33,6 +46,17 @@ Optional arguments:
--disable-autorun disable autorun task creation
```
## How it works
There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.
This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.
## Limitations
Sadly, to keep this WSC stuff even after reboot, defendnot adds itself to the autorun. Thus, you would need to keep the defendnot binaries on your disk :(
## Writeup
[How I ruined my vacation by reverse engineering WSC](https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/)