Blind ETW to strip .NET and process telemetry

The CLR and a large share of EDR sensors emit telemetry through Event Tracing for Windows. Patching EtwEventWrite in ntdll to return immediately silences those providers for the current process without touching the kernel.

# overwrite the EtwEventWrite prologue with a ret (0xC3) after making the page writable
# x64: mov eax,0; ret  -> 33 C0 C3

Pair it with the AMSI patch so managed loaders run without either check firing.

# verify no CLR ETW events reach a listener you control while your assembly runs

Pro note: this only kills userland ETW; kernel ETW-TI and Sysmon still see process and image-load events, so combine it with parent spoofing and clean syscalls. Some products re-verify the ntdll prologue, so a hardware-breakpoint hook survives longer than an inline patch.