UnhookingPatch

Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime

References

Reenz0h - HalosGate

• https://blog.sektor7.net/#!res/2021/halosgate.md