EDR Unhooking: Patching Falcon hooks without VirtualProtect | Inbits Blog

https://inbits-sec.com/posts/in-memory-unhooking/