Skip to content

WinDefCtl v2.1 — 11.2026

Latest
Latest

Choose a tag to compare

View all tags
@wesmar wesmar released this 06 Nov 08:51
· 2 commits to main since this release
v2.1.0
7654704

⚡ WinDefCtl v2.1 — Zero-CRT Native Architecture & Sub-100KB Size Record

Release: 11.2026

🔐 PASSWORD: github.com

Extract WinDefCtl.7z with password: github.com

📥 DOWNLOAD

File Size Description
WinDefCtl.7z 156K Password-protected archive (github.com) — contains WinDefCtl.exe (x64 Zero-CRT) + WinDefCtl_arm64.exe (ARM64 v1.1.2 spoiler)

Run as Administrator.

SmartScreen warning?
Download WinDefCtl.7z, extract with password github.com, then run the exe inside.
SmartScreen does not scan password-protected archives.

🚀 QUICK START

WinDefCtl kill          # Kill Defender engine (IFEO + kernel kill, no restart)
WinDefCtl restore       # Restore Defender (remove IFEO + start services)
WinDefCtl rtp off       # Disable Real-Time Protection
WinDefCtl rtp on        # Enable Real-Time Protection
WinDefCtl tp off        # Disable Tamper Protection
WinDefCtl tp on         # Enable Tamper Protection
🔍 Spoiler: ARM64 edition (v1.1.2) inside the archive

WinDefCtl.7z also contains WinDefCtl_arm64.exe — a native ARM64 build that emerged as a side effect of the Analyze Defender research into hooking the SecHealthUI XAML tree. It exposes individual controls for all five Threat Settings sliders (rtp/tp/cdp/ass/ddp) — something the x64 line does not do. Source code is not published for this build.

✅ WHAT'S NEW IN v2.1

🚀 Changelog: Key Architecture Highlights

⚡ Sub-100KB Size Record & Zero-CRT (~80 KB)

  • 100% Native OS APIs (/NODEFAULTLIB) — eliminated all C/C++ runtime library dependencies (libcmt.lib, vcruntime*.dll, msvcrt.dll). Executable dropped from ~380 KB down to 80.5 KB (>78% reduction). Automated dumpbin /dependents in CI/CD pipeline enforces 0 CRT imports.
  • Custom Native CRT Runtime — handwritten implementations for memory (memset, memcpy, memmove), string algorithms (StrLen, StrEqual, StrCopy, StrConcat, IntToStr, HexToStr), and float/hex formatters running directly on Win32 without standard library overhead.
  • Micro-Icon PNG CAB Compression — transformed embedded multi-res icon to optimized 48x48 PNG format (1,088 B header), slashing icon resource overhead and total binary size.

🛡️ Dual Kernel BYOVD Architecture & Extension Independence

  • Two-tier Driver Redundancy — engine kill upgraded from a single driver to dual signed kernel drivers (1 and 2), packed into a single LZX compressed CAB stream within the icon.
  • Extension-Independent Driver Loading — drivers extract and load directly without .sys extensions (%SystemRoot%\System32\drivers\1 and \2). Windows SCM CreateServiceW and kernel loader resolve native PE headers directly.
  • Automated Driver Teardown — automated cleanup purges both driver files from disk and stops services immediately after the kill cycle completes.

🔒 Low-Level String & Telemetry Obfuscation (x64 MASM)

  • Zero Plaintext Driver Identifiers — driver service names and device identifiers completely purged from executable .rdata string tables.
  • Algorithmic Assembly Decoders — implemented x64 MASM routines (wdc1.asm and wdc2.asm) that dynamically reconstruct driver service strings in stack memory using bitwise XOR, ROL, and SUB transformations disguised as Mm/ETW kernel telemetry routines. Verified clean via dumpbin and binary string inspection.

⏱️ UI Automation & Zero Cursor Delay (0 ms)

  • Instant Busy Cursor Cancellation (IDC_WAIT / IDC_APPSTARTING) — integrated MsgWaitForMultipleObjects(0, nullptr, FALSE, 0, QS_ALLINPUT) at entry point, overlay creation, and post-ShellExecuteW. Satisfies WaitForInputIdle instantly (0 ms), eliminating the spinning wheel wait cursor on Windows 11.
  • Overlay Window Cursor Enforcement — registered IDC_ARROW cursor and handled WM_SETCURSOR in the Direct2D fullscreen overlay (WDCOverlay), preventing shell wait cursor leakage over the "PLEASE WAIT" screen.

📐 Procedural Banner & Clean Systems Engineering

  • Dynamic Mathematical Banner Lines — replaced hardcoded banner string literals (====, +----+, space paddings) in .rdata with procedural loop-fill console routines (PrintRepeated, PrintLineRepeated, PrintDoubleBorder, PrintSingleBorder), saving .rdata memory.
  • Codebase Sanitization — completely purged informal/script-kiddie jargon ("payload", etc.) in favor of professional systems engineering nomenclature across comments, identifiers, and logs.
  • Synchronized Build System — automated alignment between WinDefCtl.vcxproj and WinDefCtl.vcxproj.filters with integrated MASM toolchain.

📋 COMMANDS

=== Engine Kill (IFEO + Dual Kernel BYOVD) ===
  kill        Terminate Defender engine (IFEO block + kernel kill)
  restore     Re-enable Defender (remove IFEO, start services)

=== Real-Time Protection (UI automation + overlay) ===
  rtp status  Check current RTP status
  rtp on      Enable Real-Time Protection
  rtp off     Disable Real-Time Protection

=== Tamper Protection (UI automation + overlay) ===
  tp status   Check current Tamper Protection state
  tp on       Enable Tamper Protection
  tp off      Disable Tamper Protection

📞 CONTACT & SUPPORT

Release Date: 11.2026
© WESMAR 2026

Assets 3
Loading