Windows internals learning path
Windows internals learning path
Before I dive deeper into the topic of EDR evasion, I need a basic understanding of the Windows binary structure and what happens when it gets executed.
| # | Topic | Description |
|---|---|---|
| [1. Portable Executable Structure](1. Portable Executable Structure.md) | Portable Executable Structure | Understanding PE format and how binaries are structured in Windows |
| [2. From PE to Memory](2. From PE to Memory.md) | From PE to Memory | How PE files are loaded into memory |
| [3. Flow of System Calls - ntdll.dll, kernel32.dll](3. Flow of System Calls - ntdll.dll, kernel32.dll.md) | Flow of System Calls - ntdll.dll, kernel32.dll | Understanding how system calls work in Windows |
| [4. Win32 API and Windows Native API](4. Win32 API and Windows Native API.md) | Win32 API and Windows Native API | Differentiating between user-mode and native APIs |
| [4a. NTDLL.DLL - Overview and Functionality](4a. NTDLL.DLL - Overview and Functionality.md) | NTDLL.DLL - Overview and Functionality | Details on ntdll.dll and its role in system calls |
| [5. Syscalls Flow](5. Syscalls Flow.md) | Syscalls Flow | Overview of how syscalls operate in Windows |
| [5a. Syscalls Deep dive](5a. Syscalls Deep dive.md) | Syscalls Deep Dive | In-depth analysis of syscalls |
| [5b. From Memory - PEB_TEB](5b. From Memory - PEB_TEB.md) | From Memory - PEB_TEB | Understanding Process and Thread Environment Blocks |
| [2. Direct syscalls intro](../../../../1_RTO/1.1 Red Teaming 101/1.1.1 OW64/Windows Tradecraft/EDR Evasion/2. Direct syscalls intro.md) | Direct Syscalls Intro | Bypassing API hooks using direct syscalls |
| [2a. Direct Syscalls cpp](../../../../1_RTO/1.1 Red Teaming 101/1.1.1 OW64/Windows Tradecraft/EDR Evasion/2a. Direct Syscalls cpp.md) | Direct Syscalls in C++ | Practical implementation in C++ |
| [2b. Indirect Syscalls intro](../../../../1_RTO/1.1 Red Teaming 101/1.1.1 OW64/Windows Tradecraft/EDR Evasion/2b. Indirect Syscalls intro.md) | Indirect Syscalls Intro | Evasion by dynamically resolving syscall addresses |
| [2c. Indirect Syscalls -Tool](../../../../1_RTO/1.1 Red Teaming 101/1.1.1 OW64/Windows Tradecraft/EDR Evasion/2c. Indirect Syscalls -Tool.md) | Indirect Syscalls - Tool | Using tools for syscall evasion |
| [3. API Hooking](../../../../1_RTO/1.1 Red Teaming 101/1.1.1 OW64/Windows Tradecraft/EDR Evasion/3. API Hooking.md) | Unhooking | Bypassing monitoring mechanisms like EDR hooks |
Resources:
https://doxygen.reactos.org/dir_a7ad942ac829d916497d820c4a26c555.html
http://undocumented.ntinternals.net/
https://klezvirus.github.io/RedTeaming/AV_Evasion/NoSysWhisper/
https://redops.at/en/blog/exploring-hells-gate