Windforce17/UnhookingPatch

Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime

UnhookingPatch

Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime

References

Reenz0h - HalosGate

• https://blog.sektor7.net/#!res/2021/halosgate.md