Hacking Tools

PatchWerk : A Tool For Cleaning NTDLL Syscall Stubs

PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall hooks without requiring a handle to the NTDLL library.

This innovative approach enables user-land hook evasion, allowing red teamers and security researchers to bypass detection mechanisms employed by Endpoint Detection and Response (EDR) systems.

Developed as a Cobalt Strike Beacon Object File (BOF), PatchWerk simplifies the process of unhooking system calls while maintaining stealth.

Core Functionality

PatchWerk identifies all Nt* system call stubs within the NTDLL library and overwrites them with clean stubs.

This ensures that NTAPI calls originate from NTDLL, avoiding suspicious patterns in call stacks that EDR solutions monitor.

Unlike traditional unhooking methods, PatchWerk avoids mapping ntdll.dll from disk or opening handles to remote processes, reducing the risk of detection.

Key features include:

  • Direct Syscall Usage: Utilizes HellsGate and HalosGate techniques for direct syscalls, such as NtOpenProcess, NtWriteVirtualMemory, and NtProtectVirtualMemory.
  • Custom Hook Evasion: Implements custom GetModuleHandle and GetProcAddress functions (written in C and assembly) to evade hooks on kernel32.dll.
  • Process-Specific Adjustments: For current process patching, it bypasses the need for NtOpenProcess by using hProc = (HANDLE)-1.

PatchWerk can be executed with or without specifying a process ID (PID). When a PID is provided, it patches the NTDLL syscall stubs of the specified remote process. Without a PID, it defaults to patching the current process.

Example usage:

textbeacon> patchwerk 6115
[*] Patchwerk (Bobby Cooke|@0xBoku|github.com/boku7}
[+] host called home, sent 4937
[+] received output:
Patching NTDLL System Call Stubs in Process: 6115 (PID)
  • Stealth: By avoiding direct interaction with disk or remote handles, PatchWerk minimizes its footprint.
  • Efficiency: It directly patches syscall stubs in memory, ensuring clean execution paths for NTAPI calls.
  • Flexibility: Can be used for both local and remote processes.

PatchWerk represents a significant advancement in evading user-mode hooks and maintaining operational security during red team engagements.

By leveraging direct syscalls and innovative patching techniques, it provides an effective method for bypassing modern EDR solutions.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

1 week ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

1 week ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

1 week ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

1 week ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

2 weeks ago