[badmilf]

If you’re still letting EDRs hook your API calls, you’re essentially giving the security team a play-by-play of your operation. Modern EDRs don't just look for "malicious" behavior; they monitor the entry points to the kernel. Every time you call a standard function like

VirtualAllocEx

, the EDR has already intercepted it through a

jmp

instruction placed in the prologue of the function in

ntdll.dll

.
Here is how you frame the discussion on "Ghosting" your execution.
If your payload is still relying on the Windows API to allocate memory or create threads, you aren't evading anything. You’re just waiting to be flagged. The industry is currently split between two schools of thought: Unhooking (restoring the state of

ntdll

) and Direct Syscalls (bypassing the DLL entirely).
1. NTDLL Unhooking: The "Refresh" MethodThe concept is simple: The EDR loads its hooks into the process’s memory space at runtime. If you can acquire a clean, unhooked copy of

ntdll.dll

from disk and map it over the existing, hooked version in memory, you effectively "clean" the API.

• The Logic:
  • Read
    C:\Windows\System32\ntdll.dll
    from disk into a buffer.
    
  • Find the
    .text
    section of the loaded
    
    ntdll
    in your current process.
    
  • Use
    VirtualProtect
    to make that section writable.
    
  • Overwrite the hooked bytes with the clean bytes from your disk-read buffer.
    
  • Restore protection to
    READ_EXECUTE
    .
    

2. Manual Mapping: The Ultimate StealthStandard

LoadLibrary

calls are loud. They trigger

Ldr

notification callbacks that EDRs monitor to see when new modules are being mapped. Manual mapping involves manually parsing the PE (Portable Executable) headers of your own payload, allocating memory, and mapping the sections yourself.

• The Workflow:
  • Map the headers (DOS/NT/Section).
    
  • Resolve imports by manually parsing the Export Address Table (EAT) of required DLLs.
    
  • Perform base relocations if the preferred base address is occupied.
    
  • Execute the Entry Point.
    

3. Technical PoC: Direct Syscall InvocationIf you want to skip the unhooking dance entirely, you invoke the kernel directly. This avoids

ntdll.dll

hooks by using the

syscall

instruction.
asm

; Example of a direct NtAllocateVirtualMemory syscall
; You need the SSN (System Service Number) for your specific Windows version
mov r10, rcx
mov eax, 0x18 ; Syscall index for NtAllocateVirtualMemory (Win 10/11 varies)
syscall
ret