# How EDR Bypass Skills Handle Unhooking: A Complete Technical Guide

> Master EDR bypass skills for unhooking with our technical guide. Learn the three-phase workflow: hook survey, unhook technique selection, and telemetry blinding for effective detection evasion.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: tutorial
- Published: 2026-08-20

---

**EDR bypass skills handle unhooking through a three-phase workflow: hook survey, unhook technique selection, and telemetry blinding—modularizing the process from detection to execution.**

The **EDR‑bypass** skill set in `zhaoxuya520/reverse-skill` models the full workflow of reversing and defeating endpoint detection‑and‑response defenses. Its unhooking stage serves as the core mechanism for neutralizing EDR‑installed hooks in critical Windows APIs. This article breaks down the architecture, implementation details, and code patterns used to achieve clean, unhooked execution.

## The Three-Phase Unhooking Architecture

The skill follows three tightly‑coupled phases orchestrated from [`skills/edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md). Each phase targets a specific layer of EDR instrumentation, creating a comprehensive bypass pipeline.

### Phase 1: Hook Survey

Before any unhooking occurs, the skill gathers a **hook table** of the target EDR. This is documented in [`skills/edr-bypass-re/references/hook-survey.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/hook-survey.md).

The survey enumerates:

- Which kernel‑mode and user‑mode functions are intercepted
- The hooking mechanism: inline patch, import‑address‑table (IAT) redirection, or SSDT replacement
- The associated driver or service name responsible for the hook

This intelligence phase determines which unhook technique will be most effective against the specific EDR implementation.

### Phase 2: Unhook Techniques

Based on the survey results, the skill selects an appropriate method from [`skills/edr-bypass-re/references/unhook-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/unhook-techniques.md). The routing matrix in [`skills/routing_zh.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md) maps targets to these techniques.

#### Direct Syscall / Hell's Gate

**Direct syscall invocation** bypasses the Windows API entirely, invoking underlying syscall numbers directly and avoiding all user‑mode hooks.

```c
// 1. Resolve the system‑call index for NtWriteFile
DWORD syscallId = GetSyscallId("NtWriteFile");

// 2. Build a syscall stub that jumps to the kernel directly
BYTE stub[] = {
    0x4c, 0x8b, 0xd1,          // mov r10, rcx
    0xb8, (BYTE)syscallId,     // mov eax, <syscallId>
    0x0f, 0x05,                // syscall
    0xc3                        // ret
};

// 3. Execute the stub instead of the hooked API
((NTWRITFILE)stub)(handle, buffer, length, ...);

```

This technique appears in the routing matrix under entries for "direct syscall/indirect syscall/Hell's Gate/SysWhispers."

#### PE‑Sieve / In‑Memory Unhook

This technique scans process memory for original function bytes, then restores them to remove inline hooks.

```c
// Locate the original function bytes from a clean module copy
BYTE *cleanBytes = GetCleanModuleBytes("ntdll.dll", "NtCreateFile");

// Overwrite the hooked entry point with the original bytes
WriteProcessMemory(GetCurrentProcess(), targetFuncAddr, cleanBytes, funcSize, NULL);

```

The `GetCleanModuleBytes` function typically parses a fresh copy of `ntdll.dll` from disk or extracts unmodified bytes from an unmapped region, then patches the hooked entry point.

#### Hardware Breakpoint (HWBP) Blindside

Using **hardware breakpoints** to temporarily divert execution away from hooked code, this technique enables clean calls to original routines. It shares infrastructure with the telemetry‑blinding work described in [`skills/edr-bypass-re/references/telemetry-blinding.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/telemetry-blinding.md).

### Phase 3: Telemetry Blinding

After removing hooks, residual EDR telemetry may still report suspicious activity. The skill applies **telemetry‑blinding** patches from [`skills/edr-bypass-re/references/telemetry-blinding.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/telemetry-blinding.md) to mute or spoof these signals.

```c
// Disable ETW EventWrite for the current process
SetEtwProviderStatus(0);

```

Common telemetry targets include:

- **ETW (Event Tracing for Windows)** providers
- **AMSI (Anti-Malware Scan Interface)** callbacks
- Kernel callbacks registered via `PsSetCreateProcessNotifyRoutine`

## How Unhooking Techniques Combine

The modular design enables flexible combination. A practitioner might chain techniques based on EDR sophistication:

1. **Basic EDR**: PE‑Sieve unhook only
2. **Advanced EDR**: Direct syscall + telemetry blinding
3. **Heavily instrumented targets**: HWBP blindside + full telemetry suppression

The routing matrix in [`skills/routing_zh.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md) documents which combinations have proven effective against specific EDR products.

## Key Implementation Files

| File | Purpose |
|------|---------|
| [`skills/edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md) | Central orchestration and practitioner checklist |
| [`skills/edr-bypass-re/references/hook-survey.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/hook-survey.md) | EDR hook catalog and reconnaissance methodology |
| [`skills/edr-bypass-re/references/unhook-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/unhook-techniques.md) | Concrete unhooking implementations |
| [`skills/edr-bypass-re/references/telemetry-blinding.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/telemetry-blinding.md) | Post‑unhook telemetry suppression |
| [`skills/routing_zh.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md) | Technique‑to‑target mapping matrix |

## Summary

- **Hook survey** establishes the target surface in [`hook-survey.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/hook-survey.md) before any modification occurs
- **Three unhook techniques**—direct syscall, PE‑Sieve restoration, and HWBP blindside—provide options for different EDR implementations
- **Telemetry blinding** completes the bypass by silencing residual detection mechanisms
- The workflow is modular, enabling technique combinations tailored to specific defensive products

## Frequently Asked Questions

### What is unhooking in EDR bypass?

Unhooking is the process of removing or neutralizing API hooks installed by endpoint detection‑and‑response software. EDR products typically hook functions like `NtCreateFile`, `NtWriteFile`, and other critical `Nt*` routines to monitor and intercept suspicious activity. Unhooking restores the original function code or bypasses the hooked entry points entirely.

### Why is direct syscall considered the most reliable unhook technique?

Direct syscall is considered the most reliable because it never executes the hooked user‑mode code path. By constructing a custom syscall stub that transitions directly to kernel mode using the `syscall` instruction, the technique avoids all user‑mode instrumentation. However, it requires accurate syscall number resolution, which varies across Windows versions.

### How does PE‑Sieve unhooking differ from direct syscalls?

PE‑Sieve unhooking is a **restoration** technique that repairs hooked functions by writing original bytes back into memory. It operates within the normal API flow, whereas direct syscalls **bypass** that flow entirely. PE‑Sieve may be detected by integrity checks on hooked functions, while direct syscalls leave the hooks intact but unused.

### What telemetry remains after successful unhooking?

Post‑unhook telemetry includes ETW providers that log system events at the kernel level, AMSI scan callbacks that inspect script content and memory buffers, and kernel‑mode callbacks registered through `PsSetCreateProcessNotifyRoutine`. The [`telemetry-blinding.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/telemetry-blinding.md) reference documents techniques to disable or spoof each of these channels.