pyNtdllOverwrite - API Unhooking in Python
Overwrite ntdll.dll’s “.text” section using a clean version of the DLL using Python.
Repository: https://github.com/ricardojoserf/pyNtdllOverwrite
It can help to evade security measures that install API hooks such as EDRs.
The unhooked version of the DLL can be obtained from:
- A DLL file already on disk - For example “C:\Windows\System32\ntdll.dll”.
- The KnownDlls folder (“\KnownDlls\ntdll.dll”).
- A process created in debug mode - Processes created in suspended or debug mode have a clean ntdll.dll.
From disk
Get the clean ntdll.dll from disk. You can specify a file path or use the default value “C:\Windows\System32\ntdll.dll”:
python pyNtdllOverwrite.py -o disk [-p PATH]
From KnownDlls folder
Get the clean ntdll.dll from the KnownDlls folder:
python pyNtdllOverwrite.py -o knowndlls
From a debug process
Get the clean ntdll.dll from a new process created with the DEBUG_PROCESS flag. You can specify a binary to create the process or use the default value “C:\Windows\System32\calc.exe”:
python pyNtdllOverwrite.py -o debugproc [-p PATH]
Links
-
.NET implementation: SharpNtdllOverwrite
-
Golang implementation: goNtdllOverwrite
Written on July 9, 2024