Distinguishing RI8 EDR Bypass Techniques: Syscall, AMSI, and ETW Patch Routing

The RI8 skill in zhaoxuya520/reverse-skill routes three distinct EDR bypass techniques—direct syscalls, AMSI patching, and ETW patching—through a mandatory ETW → AMSI → syscall execution sequence defined in skills/config/routing.json.

The zhaoxuya520/reverse-skill repository implements a modular RI8 EDR bypass framework that treats Windows evasion methodologies as discrete, routable sub-skills. Understanding how the routing layer distinguishes between direct system calls, Antimalware Scan Interface (AMSI) patches, and Event Tracing for Windows (ETW) patches is essential for comprehending the repository's endpoint detection and response (EDR) evasion architecture.

What Is the RI8 Skill?

The RI8 skill serves as the primary entry point for the edr-bypass-re skill family within the reverse-skill ecosystem. According to RULES.md and the master routing matrix in skills/routing.md, this skill encapsulates three classic bypass methodologies that are mapped to distinct execution nodes. The routing configuration treats each technique as a separate sub-skill while maintaining strict orchestration rules to ensure proper evasion sequencing.

The Three Core EDR Bypass Techniques

The repository distinguishes between three technique categories, each targeting different layers of Windows security telemetry and hooking mechanisms.

Direct Syscalls

Direct syscalls bypass user-mode API hooks by invoking Windows kernel system calls directly from the application code, circumventing monitored NTDLL hooks. As documented in skills/edr-bypass-re/SKILL.md, this technique represents the final execution stage, ensuring payload delivery occurs only after telemetry channels have been blinded and scanning interfaces disabled.

AMSI Patch

The AMSI patch technique modifies the AmsiScanBuffer function—often using hardware breakpoints or in-memory patching—to return clean scan results to the Antimalware Scan Interface. According to skills/edr-bypass-re/references/telemetry-blinding.md, this removes script-level anti-malware scanning capabilities, allowing PowerShell or .NET payloads to execute without triggering signature-based detection.

ETW Patch

ETW patching targets the EtwEventWrite stub or unhooks the ETW provider to silence Event Tracing for Windows telemetry. The telemetry-blinding reference documentation specifies that this technique must execute first in the sequence to prevent security solutions from receiving real-time event notifications during subsequent bypass stages.

Skill Routing Configuration and Execution Order

The routing layer defined in skills/config/routing.json maps user-supplied hints to specific technique nodes using a precedence-based fallback system. The execution order is critical for successful evasion:

1. ETW patch – Silences EDR telemetry first to prevent logging of subsequent bypass activities.
2. AMSI patch – Removes script-level scanning after telemetry is disabled.
3. Direct syscall – Executes the payload via clean system calls after all defensive mechanisms are neutralized.

If the routing hint does not specify a particular technique, the router defaults to the full sequence ETW → AMSI → syscall, ensuring comprehensive coverage. This sequencing is strictly enforced by the master routing matrix documented in skills/routing.md and the canonical rule list in RULES.md.

Implementation in the Reverse-Skill Repository

The technical implementation spans several key files that define the RI8 skill's behavior:

• skills/edr-bypass-re/SKILL.md – High-level description of the three bypass methods and their integration points.
• skills/edr-bypass-re/references/telemetry-blinding.md – Detailed technical specifications for AMSI and ETW patching implementations.
• skills/config/routing.json – Hint-to-skill mapping that routes requests to the appropriate sub-skill scripts.
• skills/routing.md – Human-readable routing matrix showing the ETW → AMSI → syscall precedence rules.
• RULES.md – Canonical registry of supported techniques including the RI8 skill identifier.

Practical Routing Examples

Use the master-route.sh script to invoke specific techniques through the routing layer:

# Request ETW patch only (first step in isolation)

bash skills/scripts/master-route.sh --hint "ETW patch"

# Request AMSI patch (router automatically applies ETW first per configuration)

bash skills/scripts/master-route.sh --hint "AMSI patch"

# Request full bypass chain (all three stages in mandatory order)

bash skills/scripts/master-route.sh --hint "RI8 full bypass"

These commands resolve hints via skills/config/routing.json and invoke the corresponding implementation scripts located in skills/edr-bypass-re/, such as etw-patch.ps1, amsi-patch.ps1, and direct-syscall.ps1.

Summary

• RI8 is the entry point skill for the edr-bypass-re family in the zhaoxuya520/reverse-skill repository.
• Three distinct techniques are supported: direct syscalls, AMSI patching, and ETW patching.
• Execution order is mandatory: ETW → AMSI → syscall, ensuring telemetry is blinded before payload delivery.
• Routing logic is centralized in skills/config/routing.json with fallback sequences defined in skills/routing.md.
• The master-route.sh script provides the CLI interface for technique selection and automated sequencing.

Frequently Asked Questions

What is the difference between the RI8 skill and the edr-bypass-re family?

The RI8 skill identifier serves as the routing entry point, while edr-bypass-re represents the technical implementation directory containing the actual bypass scripts and documentation. The routing configuration maps RI8 hints to the specific sub-skills contained within the edr-bypass-re folder structure.

Why must ETW patching execute before AMSI patching?

ETW patching must execute first because Event Tracing for Windows captures real-time telemetry from security providers, including AMSI scan events. If AMSI were disabled before ETW, the ETW subsystem would still log the AMSI modification attempt, creating detection artifacts. Silencing ETW first ensures subsequent AMSI patches occur without generating telemetry alerts.

How does the routing layer handle ambiguous hints?

When the routing hint does not specify a particular technique, the system defaults to the full bypass sequence defined in skills/config/routing.json. This fallback applies all three stages—ETW patch, AMSI patch, and direct syscall—in the prescribed order to ensure maximum evasion capability regardless of the specific EDR solution deployed.

Where are the actual bypass scripts located in the repository?

The implementation scripts reside in the skills/edr-bypass-re/ directory, with specific files including etw-patch.ps1, amsi-patch.ps1, and direct-syscall.ps1. Technical documentation for these implementations is maintained in skills/edr-bypass-re/references/telemetry-blinding.md.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}