klez.virusBYOUD — Bring Your Own Unwind Data
BYOUD is a framework for x64 stack spoofing on Windows. It tackles a complete opposite approach from classic stack spoofing, manipulating unwind metadata to hide arbitrary chunks of the call chain in debuggers and EDRs.
For a full technical breakdown of how it works, see the blog post.
Techniques
| # | Name | Description |
|---|---|---|
| 1 | UNWIND_DATA_TAMPER |
Modifies the target function's UNWIND_INFO in place to expand the frame size |
| 2 | UNWIND_DATA_HIJACK |
Replaces the UnwindData RVA of the target's RUNTIME_FUNCTION with a donor's |
| 3 | RT_FUNCTION_HIJACK |
Hijacks an existing .pdata entry to cover the shellcode's address range |
| 4 | RT_FUNCTION_INJECT |
Appends a new RUNTIME_FUNCTION and UNWIND_INFO to the module's exception directory |
| 5 | RTFI_JIT_SYSINFORMER |
Registers a dynamic RUNTIME_FUNCTION via RtlAddFunctionTable with cache bypass — visible to SystemInformer |
| 6 | RTFI_JIT_WINDBG |
Same as above with additional LdrpInvertedFunctionTable manipulation — visible to WinDbg |
| 7 | RTFI_JIT_NORMAL_VA |
Registers a dynamic RUNTIME_FUNCTION for shellcode in a plain VirtualAlloc'd region |
Techniques 1–4 and 7 work correctly regardless of /GS compilation settings. Techniques 5 and 6 have known issues when the calling DLL is compiled with stack cookies. Compile with /GS- to avoid this.
Components
byoud.dll — the framework. Exposes ShieldedExecution (runs a technique end-to-end) and CallGate (the assembly stub copied into target modules).
udinject.exe — test harness for exercising the framework, inspecting stack traces, and validating unwind behavior across techniques.
For everything else, see the blog post.
References and Acknowledgements
- namazso because his original work on stack spoofing has laid the groundwork for all current research on the topic
- Gabriel Landau for the shadow stack analysis research
- Alex Ionescu and Yarden Shafir for their CET internals work