Skip to content

Commit 8347554

Browse files
fontlosfontlos
authored
feat: Add ci for our first release (#1)
1 parent a300a99 commit 8347554

File tree

3 files changed

+173
-7
lines changed

3 files changed

+173
-7
lines changed

‎.github/workflows/build.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: Build and Release
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
tags:
7+
- 'v*.*.*'
8+
9+
jobs:
10+
build:
11+
runs-on: windows-latest
12+
env:
13+
RELEASE_NAME: ""
14+
TAG_NAME: ""
15+
PRERELEASE: ""
16+
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
21+
# 这会默认启用 Rust Cache, 所以使用 Stable 版本与 Cargo.lock 配合缓存
22+
- name: Setup Rust
23+
uses: actions-rust-lang/setup-rust-toolchain@v1
24+
with:
25+
toolchain: stable
26+
override: true
27+
28+
- name: Build for Windows
29+
run: |
30+
cargo build --release
31+
tar -acf ./Defender-rs.zip -C ./target/release defender.exe defender_core.dll
32+
33+
# 判断是否为预发布
34+
- name: Determine Release Type
35+
run: |
36+
if ${{ github.event_name == 'workflow_dispatch' }}; then
37+
echo "RELEASE_NAME=Defender-rs Nightly Build.$(date -u +'%Y.%m.%d')" >> $GITHUB_ENV
38+
echo "TAG_NAME=nightly" >> $GITHUB_ENV
39+
echo "PRERELEASE=true" >> $GITHUB_ENV
40+
else
41+
echo "RELEASE_NAME=Defender-rs Release Build.${{ github.ref_name }}" >> $GITHUB_ENV
42+
echo "TAG_NAME=${{ github.ref_name }}" >> $GITHUB_ENV
43+
echo "PRERELEASE=false" >> $GITHUB_ENV
44+
fi
45+
46+
- name: Read Release Note
47+
id: read_release_note
48+
run: |
49+
if [ -f "./Release.md" ]; then
50+
# 读取文件内容并处理换行符，以便在后续步骤中使用
51+
notes_content=$(cat "./Release.md")
52+
notes_content="${notes_content//'%'/'%25'}"
53+
notes_content="${notes_content//$'\n'/'%0A'}"
54+
notes_content="${notes_content//$'\r'/'%0D'}"
55+
echo "content=${notes_content}" >> $GITHUB_OUTPUT
56+
else
57+
echo "content=No release notes provided." >> $GITHUB_OUTPUT
58+
echo "::warning file=./Release.md::Release notes file not found. Using default message."
59+
fi
60+
61+
- name: Generate Changelog from PRs
62+
id: generate_changelog
63+
if: env.PRERELEASE == 'false'
64+
uses: mikepenz/release-changelog-builder-action@v5
65+
with:
66+
configurationJson: |
67+
{
68+
"categories": [
69+
{
70+
"title": "## What's Changed",
71+
"labels": []
72+
}
73+
],
74+
"pr_template": "- #{{TITLE}} by @#{{AUTHOR}} (##{{NUMBER}})",
75+
"template": "#{{CHANGELOG}}",
76+
"pr_trim_body": true,
77+
"empty_template": "## No significant changes"
78+
}
79+
env:
80+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
81+
82+
- name: Construct Release Body
83+
id: construct_body
84+
run: |
85+
release_body="${{ steps.read_release_note.outputs.content }}"
86+
if [[ "${{ env.PRERELEASE }}" == "false" && -n "${{ steps.generate_changelog.outputs.changelog }}" ]]; then
87+
release_body="${release_body}\n\n${{ steps.generate_changelog.outputs.changelog }}"
88+
fi
89+
echo "body<<EOF" >> $GITHUB_OUTPUT
90+
echo -e "$release_body" >> $GITHUB_OUTPUT
91+
echo "EOF" >> $GITHUB_OUTPUT
92+
93+
# 创建 Release 并上传构建产物
94+
- name: Create Release
95+
id: create_release
96+
uses: softprops/action-gh-release@v1
97+
with:
98+
name: ${{ env.RELEASE_NAME }}
99+
tag_name: ${{ env.TAG_NAME }}
100+
body: ${{ steps.construct_body.outputs.body }}
101+
draft: false
102+
prerelease: ${{ env.PRERELEASE == 'true' }}
103+
files: ./Defender-rs.zip

‎Readme.md‎

Lines changed: 55 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,59 @@
1-
# Defender-rs: DefendNot Written In Rust
1+
# Defender-rs: Rust Rewrite of DefendNot
22

3-
Inspired by [es3n1n/defendnot](https://github.com/es3n1n/defendnot)
3+
An even funnier way to disable Windows Defender. Inspired by [es3n1n/defendnot](https://github.com/es3n1n/defendnot)
44

5-
## Usage
5+
> [!CAUTION]
6+
> **Permitted Use Notice**:
7+
>
8+
> Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited.
9+
>
10+
> Users assume all legal responsibility for how they use this tool and any consequences thereof. You must comply with all applicable local, state, federal, and international laws when using this tool.
11+
>
12+
> By downloading, installing, or using this tool, you acknowledge that you have read, understood, and agree to these terms.
613
7-
- `--name <NAME>`: Set AV name, default is `Defender-rs`. And regist AV and set auto boot task
8-
- `--disable`: Unregist AV and remove auto boot task
9-
- `--on-login`: Start on login instead of on boot (by default)
14+
A fully Rust rewrite of defendnot, 100% compatible with the original [C++ version](https://github.com/es3n1n/defendnot). You can use the Rust loader to inject the C++ DLL, or the C++ loader to inject the Rust DLL.
1015

11-
So the simplest way to use is `sudo defender`
16+
- Register/unregister custom AV/AS to Windows Security Center (WSC)
17+
- Automatic scheduled task for persistence (boot/login)
18+
- Minimal (Just 300kb), dependency-free
19+
20+
## Installation & Usage
21+
22+
1. Download the [latest release](https://github.com/fontlos/defender-rs/releases/latest)
23+
2. Unzip and run `defender.exe` as administrator. Just
24+
```sh
25+
sudo defender.exe
26+
```
27+
3. Command help
28+
```shell
29+
Set AV display name, register AV and set autorun task
30+
Usage: defender.exe [--name <NAME>] [--disable] [--auto] [--on-login]
31+
32+
Options:
33+
--name Set AV display name (default: Defender-rs)
34+
--disable Unregister AV and remove autorun task
35+
--auto Silent mode (no window, used by scheduled task)
36+
--on-login Schedule autorun on login (default: on boot)
37+
```
38+
39+
## How It Works
40+
41+
Windows Security Center (WSC) allows third-party AV/AS to register themselves. When Defender detects another AV/AS registered, it disables itself. defender-rs communicates with WSC via COM, registering a custom AV/AS product so Defender enters "protected" state.
42+
43+
## Limitations
44+
- **Must stay on disk:** Scheduled task autorun requires binaries to remain for persistence after reboot.
45+
- **No Windows Server support:** WSC is not available on Server editions, so registration is blocked.
46+
- **Defender will flag/block:** You must temporarily disable Defender real-time/tamper protection or add an exclusion to allow the program to remain on disk and execute
47+
48+
## Legitimate Use Cases
49+
- Reduce resource usage in dev/test environments
50+
- Research/education on Windows security mechanisms
51+
- Home lab experimentation
52+
53+
> [!IMPORTANT]
54+
> No support for illegal use. You are responsible for any consequences.
55+
56+
## Credits
57+
- [es3n1n](https://github.com/es3n1n) for original design and reverse engineering
58+
- [mrbruh](https://mrbruh.com) for reverse engineering and testing
59+
- [pindos](https://github.com/pind0s) for WSC debugging support

‎Release.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
## Defender-rs Build.v0.1.0
2+
3+
An even funnier way to disable Windows Defender.
4+
5+
A fully Rust rewrite of defendnot, 100% compatible with the original [C++ version](https://github.com/es3n1n/defendnot). You can use the Rust loader to inject the C++ DLL, or the C++ loader to inject the Rust DLL.
6+
7+
- Register/unregister custom AV/AS to Windows Security Center (WSC)
8+
- Automatic scheduled task for persistence (boot/login)
9+
- Minimal (Just 300kb), dependency-free
10+
11+
**Note:**
12+
13+
Defender will flag/block the binaries. Please temporarily disable Defender real-time/tamper protection or add an exclusion before use.
14+
15+
The first public release!

0 commit comments

Comments
 (0)