DeathSleep

A Windows x64 proof of concept for saving a thread's CPU context and active stack, terminating that thread during a sleep interval, then creating a replacement thread and restoring execution. The project changes code-page protections while the process sleeps and schedules restoration through Windows timer/thread-pool mechanisms. It is compiler-sensitive, requires another live process thread, and its README says it was tested only with the MSVC compiler and linker. The implementation also locates an unexported NTDLL callback by byte pattern, so it is version-sensitive. The source does not establish a general EDR-hook bypass or product-specific detection result.