Detecting Hooked Syscalls
It's possible to enumerate which Windows API calls are hooked by an EDR using inline patcihng technique, where a jmp instruction is inserted at the beginning of the syscall stub to be hooked.
65eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2A6M7X3g2V1i4K6u0W2N6r3g2S2L8g2)9J5c8X3!0X3k6X3g2F1M7$3W2$3k6g2)9J5k6s2y4W2j5%4g2J5K9i4c8&6i4K6u0r3k6r3g2X3k6h3&6K6k6g2)9J5k6r3g2$3j5i4y4A6L8$3&6Q4x3V1k6V1k6i4c8W2j5%4c8A6L8X3N6Q4x3X3c8Z5L8$3!0C8k6h3c8Q4x3X3c8K6P5i4y4U0j5h3I4D9i4K6u0V1k6Y4g2F1j5%4c8A6L8$3&6K6
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
