New Obex Tools Blocks Runtime Loading of EDR Dynamic Libraries

Obex is a newly released proof-of-concept utility by security researcher dis0rder0x00 that demonstrates a simple but effective user‑mode method to stop unwanted security and monitoring modules from loading into Windows processes. The tool launches a target process under debugger control and enforces a configurable DLL blocklist, preventing both startup and runtime loads of designated libraries, and it defaults to blocking amsi.dll when no list is provided.

It creates the child process in a debug state to intercept module load notifications during initialization, and it compares DLL names in a case-insensitive fashion against the blocklist, suppressing any that match so the module remains absent from the process’s address space. A demonstration shows Obex spawning PowerShell while ensuring amsi.dll is never mapped, highlighting practical bypass potential against in‑process inspection.

Obex logs or reports the blocked events for operator visibility and offers features such as zero dependencies, dual‑phase protection for both startup and dynamically loaded DLLs, and configurable DLL blocking, making it a compact tool with clear implications for EDR visibility and detection rules.