DOCSEARCHbyAlgolia
Submit Docs

mr-un1k0d3r/edrs

repository·main·Indexed 24 days ago

https://github.com/mr-un1k0d3r/edrs

A collection of tools and research data focused on Endpoint Detection and Response (EDR) behavior. It includes utilities for syscall patching, IAT unhooking, and identifying hooked Windows APIs, such as get_syscall64, hook_finder64, and PoCs for dynamic syscall resolution. The repository also maintains curated lists of ntdll.dll APIs hooked by various security vendors including CrowdStrike, SentinelOne, and CarbonBlack.

Tokens
743
Snippets
2
Records
6
Agent score
31%

What's inside edrs

  1. Unhook the Import Address Table (IAT) with unhookIAT.c

    main
    This proof-of-concept (PoC) detects hooks placed in the Import Address Table (IAT) by EDR, AV, or malware and replaces them with the original, legitimate addresses.

  2. Resolve syscall IDs dynamically with patch_syscall_dynamically64.c

    main

    This proof-of-concept (PoC) resolves syscall IDs dynamically, eliminating the need to manually check the Windows version on a remote host.

    Mechanism:

    1. It uses CreateFileMapping and MapViewOfFile Windows APIs to access the DLL on disk (ensuring the data is not tampered with by EDRs).
    2. It parses the DLL to retrieve the original data.
    3. It uses that data to patch the live code in memory.

  3. Patch syscall IDs with patch_syscall64.c

    main

    This proof-of-concept (PoC) allows patching a specific syscall ID directly in the code.

    Mechanism: It patches the live version of a DLL using a hardcoded syscall ID and then reverts the DLL to its original unpatched state.

  4. Contribute EDR hooked API lists

    main

    To contribute new hooked API information to this repository, use the hook_finder64.exe tool against ntdll.dll and submit the resulting output.

    hook_finder64.exe C:\windows\system32\ntdll.dll
    hook_finder64.exe C:\windows\system32\ntdll.dll

  5. Reference lists of hooked ntdll.dll APIs by EDR vendor

    main

    This repository maintains curated lists of APIs hooked by various EDR (Endpoint Detection and Response) vendors. These lists are useful for red team exercises to identify which functions might be monitored.

    Available Vendor Lists:

  6. Retrieve syscall IDs with get_syscall64

    main

    The get_syscall64 utility is used to retrieve the syscall ID associated with a specific Windows API. This is useful for understanding which syscalls are being used by a function.

    Usage: Run the executable followed by the DLL path and the API name.

    get_syscall64.exe <dll_path> <api_name>
    get_syscall64.exe ntdll.dll NtOpenProcess