逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来， 再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。 触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike…
安装
npx skills add zhaoxuya520/reverse-skill --skill edr-bypass-renpx skills add zhaoxuya520/reverse-skill --skill edr-bypass-re -a claude-code -gnpx skills add zhaoxuya520/reverse-skill --skill edr-bypass-re -a codex -ggemini skills install https://github.com/zhaoxuya520/reverse-skill.git --path skills/edr-bypass-regh skill install zhaoxuya520/reverse-skill edr-bypass-regit clone --depth 1 https://github.com/zhaoxuya520/reverse-skill /tmp/zhaoxuya520__reverse-skill
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/zhaoxuya520__reverse-skill/skills/edr-bypass-re ~/.claude/skills/edr-bypass-re # Claude Code
cp -R /tmp/zhaoxuya520__reverse-skill/skills/edr-bypass-re ~/.agents/skills/edr-bypass-re # Codex, Cursor, Gemini CLI, Copilot, OpenCode