EvilBytecode / ETW-Bypass-Codepulze

Bypassing Event Tracing for Windows (ETW) in golang.

GoCodepulzeETWKiller

• Bypassing Event Tracing for Windows (ETW) in golang.

---

ETW-Bypass-Codepulze

• A simple Go script that first checks if NtProtectVirtualMemory and NtAllocateVirtualMemory are hooked or not. Then it loads the ntdll.dll with LoadLibrary and gets the address of the function EtwEventWrite using GetProcAddress. Finally, it writes the patch bytes into the process.

---

Prepare :

• go mod init codepulzeetwbypass
• go get github.com/mszatanik/goloader/pkg/win32
• go get golang.org/x/sys/windows
• go build etwbypasscodepulze.go

Usage

.\etwbypasscodepulze.exe <pid>

(Without) Before Patch:

(After) Patch:

Showcase