admin/senzee1984-MutationGate
1
0
Fork 0
mirror of https://github.com/senzee1984/MutationGate synced 2026-06-08 17:23:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Winslow
2024-02-28 14:19:40 -05:00
committed by GitHub
parent 21c1333b27
commit 825c08b2fb
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -5,6 +5,7 @@ It works by calling an unhooked NTAPI and replacing the unhooked NTAPI's SSN wit
The provided project is only a `POC`, not a comprehensive implementation. For instance, you could use this approach to set hardware breakpoints for a set of functions.
The technical article can be read at <https://winslow1984.com/books/malware/page/mutationgate>.
## Description
EDR tends to set inline hooks for various NTAPI, especially those are usually leveraged in malware, such as `NtAllocVirtualMemory`, `NtOpenProcess`, etc. While other NTAPI that are not usually leveraged in malware tend not to have inline hook, such as `NtDrawText`. It is very unlikely that an EDR set inline hook for all NTAPI.