ReflectiveNtdll

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber. Maintained by reveng007 on GitHub, where it has earned 179 stars from the community.

It's actively developed around antivirus, bypass, bypass-antivirus, and is a solid reference for anyone building with these tools.