Tag: etw

• InfinityHook on Modern Windows: An ETW-Based Hook That Survives PatchGuard

  2024-04-22

  InfinityHook on modern Windows: an ETW-based syscall hook that survives PatchGuard, with the reverse-engineered pieces the original writeup left out, with the setup and commands all covered.

• Reversing InfinityHook: Hooking Every System Call via the ETW CpuClock

  2020-03-26

  A line-by-line analysis of InfinityHook, the Windows technique that hooks every system call by abusing ETW's CpuClock provider, with the SSDT resolution flow fully explained.