Diabellstar is a lightweight and effective tool written in Rust to bypass Event Tracing for Windows (ETW) by patching the NtTraceEvent API at runtime.
By corrupting the implementation of NtTraceEvent in ntdll.dll, this loader disables ETW-based telemetry and logging mechanisms, which are commonly used by EDRs and Windows internals for monitoring process execution.
This project is intended for educational and research purposes only.
Use responsibly and only in controlled environments.
- Loads
ntdll.dlldynamically at runtime. - Resolves the address of
NtTraceEventviaGetProcAddress. - Uses
VirtualProtectto change memory permissions toPAGE_EXECUTE_READWRITE. - Overwrites the 4th byte of
NtTraceEventwith aRETinstruction (0xC3), effectively short-circuiting its execution. - Restores original memory protection.
This approach ensures that any call to NtTraceEvent will return immediately, disabling most ETW-based telemetry from functioning.
- Rust (stable)
- Windows target
cargo build --release