Implementing EDR Bypass Techniques with Direct Syscalls and ETW Patching in Reverse-Skill

The reverse-skill framework implements EDR bypass techniques through direct syscalls and ETW patching by routing tasks to modular skill files that execute low-level evasion code without triggering user-mode hooks.

The reverse-skill repository provides a platform-agnostic orchestration system for security workflows, enabling researchers to implement EDR bypass techniques via self-contained skill modules. This modular architecture separates routing logic from execution, allowing advanced evasion methods like direct syscalls and ETW patching to run through standardized automation scripts.

Understanding the Reverse-Skill Architecture

The framework operates through three distinct layers that handle task detection, execution, and reporting. Each layer is implemented through specific files in the repository root and skills/ directory.

Routing Layer

The routing layer maps natural language prompts to concrete skill implementations. In skills/routing.md, a matrix defines keyword-to-skill mappings, including the entry for "EDR 绕过/AV bypass/免杀" which points to edr-bypass-re/SKILL.md. This matrix enables the master-route.ps1 script to resolve vague hints like "EDR bypass using direct syscalls" into executable workflows.

Execution Layer

The execution layer handles tool discovery and runtime preparation. The skills/scripts/bootstrap-reverse.ps1 script automatically installs missing dependencies by querying GitHub releases, winget, pip, and npm repositories. Before running any skill, the system invokes ToolDiscovery.ps1 to verify that required utilities like pe-sieve are available in the environment path.

Output Layer

After execution, the output layer generates evidence through docs-generator and diagram-generator components. Results are written to the reports/ directory as markdown files, while operational knowledge accumulates in the field-journal for future reference.

Locating the EDR Bypass Skill Module

The EDR bypass functionality resides in skills/edr-bypass-re/SKILL.md, which serves as the entry point for evasion workflows. This skill references supplementary research in skills/edr-bypass-re/references/hook-survey.md, documenting common EDR hooking locations in ntdll.dll and techniques for identifying user-mode API monitors.

When the routing system processes a hint containing "EDR bypass," it resolves to this module and initiates a four-phase workflow: preparation (hook discovery), bypass execution (syscall/ETW methods), payload delivery, and verification.

Implementing Direct Syscalls

Direct syscalls bypass user-mode API hooks by invoking kernel functions directly through ntdll.dll, avoiding the monitored Windows API surface. The repository includes a reference implementation in skills/edr-bypass-re/references/direct-syscalls.c.

#include <windows.h>

typedef NTSTATUS (NTAPI *NtCreateThreadEx_t)(
    PHANDLE ThreadHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    HANDLE ProcessHandle,
    PVOID StartRoutine,
    PVOID Argument,
    ULONG CreateFlags,
    SIZE_T ZeroBits,
    SIZE_T StackSize,
    SIZE_T MaximumStackSize,
    PVOID *AttributeList);

int main() {
    HMODULE ntdll = LoadLibraryA("ntdll.dll");
    NtCreateThreadEx_t NtCreateThreadEx = (NtCreateThreadEx_t)
        GetProcAddress(ntdll, "NtCreateThreadEx");
    
    // Direct syscall execution bypasses user-mode EDR hooks
    HANDLE hThread;
    NTSTATUS status = NtCreateThreadEx(
        &hThread, 0x1FFFFF, NULL, GetCurrentProcess(),
        (PVOID)0x12345678, NULL, 0, 0, 0, 0, NULL
    );
    return 0;
}

This technique evades EDR solutions that hook higher-level APIs like CreateThread by operating at the native API layer where monitoring is more difficult to implement reliably.

ETW Patching Implementation

ETW (Event Tracing for Windows) patching suppresses telemetry generation by modifying or disabling event providers. The skill module implements this through PowerShell scripts that interact with the System.Diagnostics.Eventing namespace.

# Disable ETW provider for current process

$providerGuid = [Guid]::Parse('{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}')
$etwProvider = [System.Diagnostics.Eventing.EventProvider]::new($providerGuid)
$etwProvider.Disable()

# Verify suppression with benign syscall

Write-Host "ETW disabled - monitoring events suppressed"

By disabling the ETW provider before executing sensitive operations, the technique prevents security solutions from receiving telemetry about process injections or memory allocations.

Executing the Complete Workflow

To run the EDR bypass skill through the framework's automation layer, invoke the master router with a descriptive hint. The system handles tool validation, dependency installation, and execution sequencing automatically.

# Update tool index before execution

.\skills\scripts\refresh-tool-index.ps1

# Execute EDR bypass skill via master router

.\skills\scripts\master-route.ps1 -Hint "Implement EDR bypass techniques through direct syscalls and ETW patching"

The master-route.ps1 script performs the following sequence:

1. Parses the hint and queries skills/routing.md for the matching skill path
2. Validates tool requirements against skills/scripts/tool-index
3. Invokes bootstrap-reverse.ps1 if pe-sieve or other dependencies are missing
4. Executes skills/edr-bypass-re/SKILL.md workflow steps
5. Generates markdown reports in reports/ with execution evidence

Summary

• The reverse-skill framework uses skills/routing.md to map EDR bypass requests to edr-bypass-re/SKILL.md through keyword matching.
• Direct syscalls evade user-mode hooks by calling ntdll.dll functions directly, as demonstrated in direct-syscalls.c.
• ETW patching disables event providers through PowerShell's System.Diagnostics.Eventing classes to suppress telemetry.
• The master-route.ps1 script orchestrates the full workflow, while bootstrap-reverse.ps1 ensures dependencies like pe-sieve are available.
• All execution evidence is automatically documented in the reports/ directory for audit trails.

Frequently Asked Questions

What is the reverse-skill framework?

The reverse-skill framework is a modular automation platform for security research tasks. It separates task routing, tool management, and reporting into distinct layers, allowing researchers to add new techniques like EDR bypasses without modifying core engine code.

How does direct syscall evasion work?

Direct syscall evasion bypasses EDR user-mode hooks by resolving function addresses in ntdll.dll and invoking kernel services directly. Since EDR solutions typically hook higher-level Windows APIs rather than the native API layer, direct calls to functions like NtCreateThreadEx execute without triggering monitoring callbacks.

What is ETW patching and why is it used?

ETW patching involves disabling or modifying Event Tracing for Windows providers to prevent security solutions from receiving telemetry about process behavior. The technique targets the System.Diagnostics.Eventing.EventProvider class to suppress event generation before executing sensitive operations.

How do I execute the EDR bypass skill?

Execute the skill by running .\skills\scripts\master-route.ps1 -Hint "EDR bypass" from the repository root. The script automatically resolves the skill location via routing.md, installs missing tools through bootstrap-reverse.ps1, and executes the workflow defined in edr-bypass-re/SKILL.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}