Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Fuck-Etw — Bypass the Event Trace Windows(ETW) and unhook ntdll. | Kitploit
Tools/GitHubGitHub/unkvolism/fuck-etw
IDS/IPS EvasionPost-ExploitationRed TeamingAdversarial Attack
GitHubunkvolism/fuck-etw

Fuck-Etw

Bypass the Event Trace Windows(ETW) and unhook ntdll.

View Repository
116152 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

「⚙️」Bypass ETW & Ntdll Unhooking

Bypass the Event Trace Windows(ETW) and unhook ntdll.

root@kitploit:~
         _______           _______  _        _______ _________
        (  ____ \|\     /|(  ____ \| \    /\(  ____ \\__   __/|\     /|
        | (    \/| )   ( || (    \/|  \  / /| (    \/   ) (   | )   ( |
        | (__    | |   | || |      |  (_/ / | (__       | |   | | _ | |
        |  __)   | |   | || |      |   _ (  |  __)      | |   | |( )| |
        | (      | |   | || |      |  ( \ \ | (         | |   | || || |
        | )      | (___) || (____/\|  /  \ \| (____/\   | |   | () () |
        |/       (_______)(_______/|_/    \/(_______/   )_(   (_______)

                                [Made by sorahed]
                                        [v1.0]



[i] Hooked Ntdll Base Address : 0x00007FFA9A110000
[i] Unhooked Ntdll Base Address: 0x00007FF7C970F000

[+] PID Of The Current Proccess: [1956]

[#] Ready For ETW Patch.
[+] Press <Enter> To Patch ETW ...


[+] ETW Patched, No Logs No Crime !
Download Tool