How to Use the EDR Bypass Skill Module for Evasion Techniques

The EDR bypass skill module in the zhaoxuya520/reverse-skill repository centralizes advanced evasion techniques such as SysWhispers3, Hell's Gate, and PE-Sieve, enabling operators to bypass Endpoint Detection and Response systems through a routing-based PowerShell interface.

The EDR bypass skill module serves as the primary evasion component within the zhaoxuya520/reverse-skill repository, providing a structured framework for circumventing modern security controls. Located under skills/edr-bypass-re/, this module integrates with the framework's routing configuration to deliver platform-agnostic bypass capabilities. Understanding its architecture and execution workflow enables red team operators to deploy effective evasion techniques against monitored environments.

Architecture of the EDR Bypass Skill Module

The module follows the reverse-skill framework's convention of separating skill definitions from implementation logic. At its core, the [skills/edr-bypass-re/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md) file defines the module's inputs, outputs, and supported bypass techniques. The routing configuration in [skills/routing_zh.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md) maps high-level labels like "EDR bypass" to this skill implementation at line 94, creating the bridge between user intent and execution.

Routing Configuration

The routing system relies on [skills/config/routing.json](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) as the authoritative source for skill dispatch. When a user requests an EDR bypass operation, the master routing script queries this configuration to locate the appropriate handler within skills/edr-bypass-re/.

Reference Documentation

Technical implementation details for various hooking mechanisms reside in [skills/edr-bypass-re/references/hook-survey.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/hook-survey.md), which catalogs known EDR hooking vectors including ntdll hooks, API Monitors, and inline hooks.

Supported Evasion Techniques

The module implements several advanced evasion methodologies through discrete PowerShell scripts, each targeting specific EDR detection mechanisms.

SysWhispers3 Direct System Calls

The syswhispers3.ps1 implementation generates shellcode that invokes Windows Native API functions via direct system calls, bypassing user-mode hooks typically monitored by EDR solutions. This technique avoids the standard import address table (IAT) to minimize detection footprints.

Hell's Gate Stealth Transitions

Implemented in hellgate.ps1, the Hell's Gate technique facilitates stealthy transitions to kernel mode execution by dynamically resolving system call numbers from ntdll.dll memory. This enables syscall invocation without static imports, evading signature-based detection.

PE-Sieve Memory Analysis

The pe-sieve.ps1 script utilizes the PE-Sieve tool to scan process memory for hooked functions and extract unhooked code regions. Operators use this to identify clean memory segments for payload injection while avoiding monitored APIs.

Executing the EDR Bypass Skill

Invocation occurs through the master routing script skills/scripts/master-route.ps1, which handles parameter validation and skill dispatch based on the routing configuration.

Basic Invocation

Execute the skill using the "EDR bypass" routing hint:

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 `
    -Hint "EDR bypass"

Technique-Specific Execution

Specify individual techniques using the -Param hashtable:

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 `
    -Hint "EDR bypass" `
    -Param @{ technique = "SysWhispers3" }

Chaining Multiple Techniques

Combine complementary evasion methods for layered defense bypass:

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 `
    -Hint "EDR bypass" `
    -Param @{ technique = "pe-sieve,hook-injection" }

Integration with Automation Pipelines

For red team automation, wrap the invocation in a reusable function:

function Invoke-EDRBypass {
    param([string]$Technique = "SysWhispers3")
    return & skills/scripts/master-route.ps1 `
        -Hint "EDR bypass" `
        -Param @{ technique = $Technique }
}

Summary

• The EDR bypass skill module resides in skills/edr-bypass-re/ and provides structured evasion capabilities against modern Endpoint Detection and Response systems.
• Routing configuration in skills/routing_zh.md and skills/config/routing.json maps execution requests to the appropriate skill implementation.
• Supported techniques include SysWhispers3 for direct system calls, Hell's Gate for stealthy kernel transitions, and PE-Sieve for memory analysis.
• Execution occurs via skills/scripts/master-route.ps1 with support for single techniques or chained combinations through PowerShell hashtable parameters.

Frequently Asked Questions

What is the EDR bypass skill module?

The EDR bypass skill module is a specialized component within the zhaoxuya520/reverse-skill repository that aggregates multiple evasion techniques into a single, routable interface. It enables operators to bypass Endpoint Detection and Response solutions through documented methods like direct system calls and memory unhooking.

How does the routing system connect to the skill?

The routing system references the skill through line 94 in [skills/routing_zh.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md), which links the "EDR bypass / evasion" label to edr-bypass-re/SKILL.md. The master routing script consults [skills/config/routing.json](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to resolve these mappings at runtime.

Which evasion techniques are supported by the module?

The module supports SysWhispers3 for generating direct syscall shellcode, Hell's Gate for dynamic system call resolution, PE-Sieve for identifying unhooked memory regions, and various hook injection methods documented in the references folder.

How do I invoke the skill from PowerShell?

Use the master routing script with the -Hint parameter set to "EDR bypass" and optionally specify techniques via the -Param hashtable. For example: powershell -File skills/scripts/master-route.ps1 -Hint "EDR bypass" -Param @{ technique = "SysWhispers3" }.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}