# Implementing EDR Bypass Techniques with Direct Syscalls and ETW Patching in Reverse-Skill

> Master EDR bypass techniques using direct syscalls and ETW patching with the reverse-skill framework. Execute low-level evasion code and avoid user-mode hooks.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**The reverse-skill framework implements EDR bypass techniques through direct syscalls and ETW patching by routing tasks to modular skill files that execute low-level evasion code without triggering user-mode hooks.**

The **reverse-skill** repository provides a platform-agnostic orchestration system for security workflows, enabling researchers to implement **EDR bypass techniques** via self-contained skill modules. This modular architecture separates routing logic from execution, allowing advanced evasion methods like direct syscalls and ETW patching to run through standardized automation scripts.

## Understanding the Reverse-Skill Architecture

The framework operates through three distinct layers that handle task detection, execution, and reporting. Each layer is implemented through specific files in the repository root and `skills/` directory.

### Routing Layer

The routing layer maps natural language prompts to concrete skill implementations. In [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), a matrix defines keyword-to-skill mappings, including the entry for "EDR 绕过/AV bypass/免杀" which points to [`edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/edr-bypass-re/SKILL.md). This matrix enables the `master-route.ps1` script to resolve vague hints like "EDR bypass using direct syscalls" into executable workflows.

### Execution Layer

The execution layer handles tool discovery and runtime preparation. The `skills/scripts/bootstrap-reverse.ps1` script automatically installs missing dependencies by querying GitHub releases, winget, pip, and npm repositories. Before running any skill, the system invokes `ToolDiscovery.ps1` to verify that required utilities like `pe-sieve` are available in the environment path.

### Output Layer

After execution, the output layer generates evidence through `docs-generator` and `diagram-generator` components. Results are written to the `reports/` directory as markdown files, while operational knowledge accumulates in the `field-journal` for future reference.

## Locating the EDR Bypass Skill Module

The EDR bypass functionality resides in [`skills/edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md), which serves as the entry point for evasion workflows. This skill references supplementary research in [`skills/edr-bypass-re/references/hook-survey.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/hook-survey.md), documenting common EDR hooking locations in `ntdll.dll` and techniques for identifying user-mode API monitors.

When the routing system processes a hint containing "EDR bypass," it resolves to this module and initiates a four-phase workflow: preparation (hook discovery), bypass execution (syscall/ETW methods), payload delivery, and verification.

## Implementing Direct Syscalls

Direct syscalls bypass user-mode API hooks by invoking kernel functions directly through `ntdll.dll`, avoiding the monitored Windows API surface. The repository includes a reference implementation in [`skills/edr-bypass-re/references/direct-syscalls.c`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/references/direct-syscalls.c).

```c
#include <windows.h>

typedef NTSTATUS (NTAPI *NtCreateThreadEx_t)(
    PHANDLE ThreadHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    HANDLE ProcessHandle,
    PVOID StartRoutine,
    PVOID Argument,
    ULONG CreateFlags,
    SIZE_T ZeroBits,
    SIZE_T StackSize,
    SIZE_T MaximumStackSize,
    PVOID *AttributeList);

int main() {
    HMODULE ntdll = LoadLibraryA("ntdll.dll");
    NtCreateThreadEx_t NtCreateThreadEx = (NtCreateThreadEx_t)
        GetProcAddress(ntdll, "NtCreateThreadEx");
    
    // Direct syscall execution bypasses user-mode EDR hooks
    HANDLE hThread;
    NTSTATUS status = NtCreateThreadEx(
        &hThread, 0x1FFFFF, NULL, GetCurrentProcess(),
        (PVOID)0x12345678, NULL, 0, 0, 0, 0, NULL
    );
    return 0;
}

```

This technique evades EDR solutions that hook higher-level APIs like `CreateThread` by operating at the native API layer where monitoring is more difficult to implement reliably.

## ETW Patching Implementation

ETW (Event Tracing for Windows) patching suppresses telemetry generation by modifying or disabling event providers. The skill module implements this through PowerShell scripts that interact with the `System.Diagnostics.Eventing` namespace.

```powershell

# Disable ETW provider for current process

$providerGuid = [Guid]::Parse('{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}')
$etwProvider = [System.Diagnostics.Eventing.EventProvider]::new($providerGuid)
$etwProvider.Disable()

# Verify suppression with benign syscall

Write-Host "ETW disabled - monitoring events suppressed"

```

By disabling the ETW provider before executing sensitive operations, the technique prevents security solutions from receiving telemetry about process injections or memory allocations.

## Executing the Complete Workflow

To run the EDR bypass skill through the framework's automation layer, invoke the master router with a descriptive hint. The system handles tool validation, dependency installation, and execution sequencing automatically.

```powershell

# Update tool index before execution

.\skills\scripts\refresh-tool-index.ps1

# Execute EDR bypass skill via master router

.\skills\scripts\master-route.ps1 -Hint "Implement EDR bypass techniques through direct syscalls and ETW patching"

```

The `master-route.ps1` script performs the following sequence:
1. Parses the hint and queries [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) for the matching skill path
2. Validates tool requirements against `skills/scripts/tool-index`
3. Invokes `bootstrap-reverse.ps1` if `pe-sieve` or other dependencies are missing
4. Executes [`skills/edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md) workflow steps
5. Generates markdown reports in `reports/` with execution evidence

## Summary

- The **reverse-skill** framework uses [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) to map EDR bypass requests to [`edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/edr-bypass-re/SKILL.md) through keyword matching.
- **Direct syscalls** evade user-mode hooks by calling `ntdll.dll` functions directly, as demonstrated in [`direct-syscalls.c`](https://github.com/zhaoxuya520/reverse-skill/blob/main/direct-syscalls.c).
- **ETW patching** disables event providers through PowerShell's `System.Diagnostics.Eventing` classes to suppress telemetry.
- The `master-route.ps1` script orchestrates the full workflow, while `bootstrap-reverse.ps1` ensures dependencies like `pe-sieve` are available.
- All execution evidence is automatically documented in the `reports/` directory for audit trails.

## Frequently Asked Questions

### What is the reverse-skill framework?

The reverse-skill framework is a modular automation platform for security research tasks. It separates task routing, tool management, and reporting into distinct layers, allowing researchers to add new techniques like EDR bypasses without modifying core engine code.

### How does direct syscall evasion work?

Direct syscall evasion bypasses EDR user-mode hooks by resolving function addresses in `ntdll.dll` and invoking kernel services directly. Since EDR solutions typically hook higher-level Windows APIs rather than the native API layer, direct calls to functions like `NtCreateThreadEx` execute without triggering monitoring callbacks.

### What is ETW patching and why is it used?

ETW patching involves disabling or modifying Event Tracing for Windows providers to prevent security solutions from receiving telemetry about process behavior. The technique targets the `System.Diagnostics.Eventing.EventProvider` class to suppress event generation before executing sensitive operations.

### How do I execute the EDR bypass skill?

Execute the skill by running `.\skills\scripts\master-route.ps1 -Hint "EDR bypass"` from the repository root. The script automatically resolves the skill location via [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md), installs missing tools through `bootstrap-reverse.ps1`, and executes the workflow defined in [`edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/edr-bypass-re/SKILL.md).