A simple C++ script that first checks if NtProtectVirtualMemory
and NtAllocateVirtualMemory
are hooked or not. Then it loads the ntdll.dll
with LoadLibrary and gets the address of the function EtwEventWrite
using GetProcAddress. Finally, it writes the patch bytes into the process.
gurpreet06 / etw-patcher Goto Github PK
View Code? Open in Web Editor NEWBypassing Event Tracing for Windows (ETW) with CSharp