Hat's Multitool v6.3.4

What's Changed in v6.3.4

🛡️ Antivirus False Positive Elimination & Architecture Modernization

• Eliminated Dynamic Injection & ConPTY Pseudo-Console: Completely removed ProcessRunnerEngine and dynamic API resolution (UpdateProcThreadAttribute, CreateProcessW). System diagnostics (SFC, DISM, ChkDsk, .NET 3.5) now execute in native, standalone elevated command prompt windows, eliminating heuristic triggers for Trojan.MSIL.Injector (IKARUS) and generic behavioral blockers.
• Dropper-Free Self-Cleanup: Removed intermediate %TEMP% batch script generation (del /f /q ... del "%~f0"). Directory cleanup of %LOCALAPPDATA%\HMT\ExtPrograms is now executed directly in managed code, and self-deletion for temporary runs utilizes an inline delay command, eliminating detections for Trojan:Win32Wacatac.H!ml (Defender) and Trojan.MSIL.Agent.qwjbfw (Kaspersky).
• Dynamic External Tools Manifest: Externalized third-party tool metadata and URLs to a dynamic GitHub repository manifest (ExternalTools.json) with automated web server fallback. All NirSoft password recovery utilities and hardcoded remote URLs have been stripped from the binary, eliminating detections for TR/W32.MalwareX (Avira) and Win32:MalwareX-gen (Avast/AVG).
• Decoupled NinjaOne Agent Removal: Removed sensitive inline PowerShell service-killing scripts from the compiled executable. NinjaOne agent uninstallation is now securely pulled and executed on-demand from the official server endpoint over TLS 1.2.
• Modern Roslyn Build Pipeline (.NET SDK): Migrated from Mono mcs to the official .NET SDK compiler with Microsoft.NETFramework.ReferenceAssemblies. Roslyn natively generates compliant Windows Subsystem 6.0 headers, proper localized Explorer Details metadata (000004b0 / 040904b0), and clean open-source metadata with no proprietary copyright notice.

Full Changelog: v6.3.3...v6.3.4