PatchWerk : A Tool For Cleaning NTDLL Syscall Stubs

PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall hooks without requiring a handle to the NTDLL library.

This innovative approach enables user-land hook evasion, allowing red teamers and security researchers to bypass detection mechanisms employed by Endpoint Detection and Response (EDR) systems.

Developed as a Cobalt Strike Beacon Object File (BOF), PatchWerk simplifies the process of unhooking system calls while maintaining stealth.

Core Functionality

PatchWerk identifies all Nt* system call stubs within the NTDLL library and overwrites them with clean stubs.

This ensures that NTAPI calls originate from NTDLL, avoiding suspicious patterns in call stacks that EDR solutions monitor.

Unlike traditional unhooking methods, PatchWerk avoids mapping ntdll.dll from disk or opening handles to remote processes, reducing the risk of detection.

Key features include:

• Direct Syscall Usage: Utilizes HellsGate and HalosGate techniques for direct syscalls, such as NtOpenProcess, NtWriteVirtualMemory, and NtProtectVirtualMemory.
• Custom Hook Evasion: Implements custom GetModuleHandle and GetProcAddress functions (written in C and assembly) to evade hooks on kernel32.dll.
• Process-Specific Adjustments: For current process patching, it bypasses the need for NtOpenProcess by using hProc = (HANDLE)-1.

PatchWerk can be executed with or without specifying a process ID (PID). When a PID is provided, it patches the NTDLL syscall stubs of the specified remote process. Without a PID, it defaults to patching the current process.

Example usage:

textbeacon> patchwerk 6115
[*] Patchwerk (Bobby Cooke|@0xBoku|github.com/boku7}
[+] host called home, sent 4937
[+] received output:
Patching NTDLL System Call Stubs in Process: 6115 (PID)

• Stealth: By avoiding direct interaction with disk or remote handles, PatchWerk minimizes its footprint.
• Efficiency: It directly patches syscall stubs in memory, ensuring clean execution paths for NTAPI calls.
• Flexibility: Can be used for both local and remote processes.

PatchWerk represents a significant advancement in evading user-mode hooks and maintaining operational security during red team engagements.

By leveraging direct syscalls and innovative patching techniques, it provides an effective method for bypassing modern EDR solutions.