How EDR Bypass Skills Handle Unhooking: A Complete Technical Guide

EDR bypass skills handle unhooking through a three-phase workflow: hook survey, unhook technique selection, and telemetry blinding—modularizing the process from detection to execution.

The EDR‑bypass skill set in zhaoxuya520/reverse-skill models the full workflow of reversing and defeating endpoint detection‑and‑response defenses. Its unhooking stage serves as the core mechanism for neutralizing EDR‑installed hooks in critical Windows APIs. This article breaks down the architecture, implementation details, and code patterns used to achieve clean, unhooked execution.

The Three-Phase Unhooking Architecture

The skill follows three tightly‑coupled phases orchestrated from skills/edr-bypass-re/SKILL.md. Each phase targets a specific layer of EDR instrumentation, creating a comprehensive bypass pipeline.

Phase 1: Hook Survey

Before any unhooking occurs, the skill gathers a hook table of the target EDR. This is documented in skills/edr-bypass-re/references/hook-survey.md.

The survey enumerates:

• Which kernel‑mode and user‑mode functions are intercepted
• The hooking mechanism: inline patch, import‑address‑table (IAT) redirection, or SSDT replacement
• The associated driver or service name responsible for the hook

This intelligence phase determines which unhook technique will be most effective against the specific EDR implementation.

Phase 2: Unhook Techniques

Based on the survey results, the skill selects an appropriate method from skills/edr-bypass-re/references/unhook-techniques.md. The routing matrix in skills/routing_zh.md maps targets to these techniques.

Direct Syscall / Hell's Gate

Direct syscall invocation bypasses the Windows API entirely, invoking underlying syscall numbers directly and avoiding all user‑mode hooks.

// 1. Resolve the system‑call index for NtWriteFile
DWORD syscallId = GetSyscallId("NtWriteFile");

// 2. Build a syscall stub that jumps to the kernel directly
BYTE stub[] = {
    0x4c, 0x8b, 0xd1,          // mov r10, rcx
    0xb8, (BYTE)syscallId,     // mov eax, <syscallId>
    0x0f, 0x05,                // syscall
    0xc3                        // ret
};

// 3. Execute the stub instead of the hooked API
((NTWRITFILE)stub)(handle, buffer, length, ...);

This technique appears in the routing matrix under entries for "direct syscall/indirect syscall/Hell's Gate/SysWhispers."

PE‑Sieve / In‑Memory Unhook

This technique scans process memory for original function bytes, then restores them to remove inline hooks.

// Locate the original function bytes from a clean module copy
BYTE *cleanBytes = GetCleanModuleBytes("ntdll.dll", "NtCreateFile");

// Overwrite the hooked entry point with the original bytes
WriteProcessMemory(GetCurrentProcess(), targetFuncAddr, cleanBytes, funcSize, NULL);

The GetCleanModuleBytes function typically parses a fresh copy of ntdll.dll from disk or extracts unmodified bytes from an unmapped region, then patches the hooked entry point.

Hardware Breakpoint (HWBP) Blindside

Using hardware breakpoints to temporarily divert execution away from hooked code, this technique enables clean calls to original routines. It shares infrastructure with the telemetry‑blinding work described in skills/edr-bypass-re/references/telemetry-blinding.md.

Phase 3: Telemetry Blinding

After removing hooks, residual EDR telemetry may still report suspicious activity. The skill applies telemetry‑blinding patches from skills/edr-bypass-re/references/telemetry-blinding.md to mute or spoof these signals.

// Disable ETW EventWrite for the current process
SetEtwProviderStatus(0);

Common telemetry targets include:

• ETW (Event Tracing for Windows) providers
• AMSI (Anti-Malware Scan Interface) callbacks
• Kernel callbacks registered via PsSetCreateProcessNotifyRoutine

How Unhooking Techniques Combine

The modular design enables flexible combination. A practitioner might chain techniques based on EDR sophistication:

1. Basic EDR: PE‑Sieve unhook only
2. Advanced EDR: Direct syscall + telemetry blinding
3. Heavily instrumented targets: HWBP blindside + full telemetry suppression

The routing matrix in skills/routing_zh.md documents which combinations have proven effective against specific EDR products.

Key Implementation Files

File	Purpose
skills/edr-bypass-re/SKILL.md	Central orchestration and practitioner checklist
skills/edr-bypass-re/references/hook-survey.md	EDR hook catalog and reconnaissance methodology
skills/edr-bypass-re/references/unhook-techniques.md	Concrete unhooking implementations
skills/edr-bypass-re/references/telemetry-blinding.md	Post‑unhook telemetry suppression
skills/routing_zh.md	Technique‑to‑target mapping matrix

Summary

• Hook survey establishes the target surface in hook-survey.md before any modification occurs
• Three unhook techniques—direct syscall, PE‑Sieve restoration, and HWBP blindside—provide options for different EDR implementations
• Telemetry blinding completes the bypass by silencing residual detection mechanisms
• The workflow is modular, enabling technique combinations tailored to specific defensive products

Frequently Asked Questions

What is unhooking in EDR bypass?

Unhooking is the process of removing or neutralizing API hooks installed by endpoint detection‑and‑response software. EDR products typically hook functions like NtCreateFile, NtWriteFile, and other critical Nt* routines to monitor and intercept suspicious activity. Unhooking restores the original function code or bypasses the hooked entry points entirely.

Why is direct syscall considered the most reliable unhook technique?

Direct syscall is considered the most reliable because it never executes the hooked user‑mode code path. By constructing a custom syscall stub that transitions directly to kernel mode using the syscall instruction, the technique avoids all user‑mode instrumentation. However, it requires accurate syscall number resolution, which varies across Windows versions.

How does PE‑Sieve unhooking differ from direct syscalls?

PE‑Sieve unhooking is a restoration technique that repairs hooked functions by writing original bytes back into memory. It operates within the normal API flow, whereas direct syscalls bypass that flow entirely. PE‑Sieve may be detected by integrity checks on hooked functions, while direct syscalls leave the hooks intact but unused.

What telemetry remains after successful unhooking?

Post‑unhook telemetry includes ETW providers that log system events at the kernel level, AMSI scan callbacks that inspect script content and memory buffers, and kernel‑mode callbacks registered through PsSetCreateProcessNotifyRoutine. The telemetry-blinding.md reference documents techniques to disable or spoof each of these channels.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}