Skip to content

Latest commit

 

History

History
11 lines (8 loc) · 668 Bytes

README.md

File metadata and controls

11 lines (8 loc) · 668 Bytes

AMSI-Bypasses

Bypass AMSI by patching AmsiScanBuffer two different ways.

Overview

jmp.cs places a mid-function hook in AmsiScanBuffer. A relative jmp instruction is used to jump to the end of the function & return 0 (AMSI_RESULT_CLEAN).

ret.cs places a hook at the beginning of AmsiScanBuffer to return 0 (AMSI_RESULT_CLEAN).

Credits to: Rasta Mouse for some of his code and some of his ideas.

Usage

I'd recommend compiling with Visual Studio and at least .NET 3.5. Use a class library (C# dll) template. Load into PowerShell.exe using your preferred method. Execute with [Bannana]::Peel().