BenjiTrapp-MostShittyAV/USAGE_COMPARISON.md

MostShittyAV - Usage Comparison

Two Ways to Use MostShittyAV

MostShittyAV offers two different components that can be used independently:

🆕 AMSI Provider DLL (New - System Integration)

File: MostShittyAVWrapper.dll

What it does:

• Integrates with Windows AMSI (Anti-Malware Scan Interface)
• Automatically scans content in AMSI-aware applications
• Works system-wide once registered

Use Cases:

• ✅ Automatic scanning in PowerShell
• ✅ Integration with Windows Defender
• ✅ System-wide malware detection
• ✅ Real-time protection

Requirements:

• ⚠️ Administrator privileges for registration
• ⚠️ Must be registered via regsvr32 or scripts
• ⚠️ Affects system-wide behavior

Installation:

# As Administrator
.\build_and_register.ps1 -BuildAndRegister

Testing:

# Start a new PowerShell window - provider auto-loads
Write-Host "MALWARE"  # Will be scanned by AMSI

---

📦 Standalone Scanner EXE (Original - No Installation)

File: MostShittyAVScanner.exe

What it does:

• Command-line file scanner
• Scans files on-demand
• Works completely independently

Use Cases:

• ✅ Quick file scanning
• ✅ Batch file scanning
• ✅ Testing/research
• ✅ Portable scanning tool

Requirements:

• ✅ No installation needed
• ✅ No admin privileges required
• ✅ Works immediately

Usage:

# Scan a single file
.\MostShittyAVScanner.exe malware.exe

# Scan multiple files
.\MostShittyAVScanner.exe file1.ps1 file2.bat file3.dll

# Scan test files
.\MostShittyAVScanner.exe test\02_malware.ps1 test\trojan_sample.txt

---

Feature Comparison

Feature	AMSI Provider DLL	Standalone Scanner EXE
Installation Required	Yes (registration)	No
Admin Privileges	Required	Not required
System Integration	Yes (AMSI)	No
Automatic Scanning	Yes	No
On-Demand Scanning	No	Yes
Portable	No	Yes
Affects PowerShell	Yes	No
Works Without Restart	No (needs new process)	Yes (immediate)
Can Scan Multiple Files	N/A (automatic)	Yes
Learning/Testing	✅ See AMSI internals	✅ Simple scanner logic

---

Which One Should You Use?

Use the AMSI Provider DLL if you want to:

• ✅ Learn how AMSI providers work
• ✅ Test system-wide integration
• ✅ Automatically scan PowerShell commands
• ✅ Integrate with Windows security
• ✅ Study AMSI internals with Process Monitor

Best for: Security researchers, AMSI learning, system integration testing

Use the Standalone Scanner EXE if you want to:

• ✅ Quickly scan files
• ✅ Test the scanner logic without system changes
• ✅ Avoid requiring admin privileges
• ✅ Portable scanning tool
• ✅ Batch process files

Best for: Quick file scanning, testing scanner logic, casual use

---

Can I Use Both?

Yes! They work completely independently:

1. Standalone Scanner can be used anytime without affecting the system
2. AMSI Provider runs automatically when registered, affecting AMSI-aware apps
3. Both use the same scanner logic from nim_antimalware_sim.nim

---

Examples

Example 1: Testing Scanner Logic (Use Standalone EXE)

# No installation needed
.\MostShittyAVScanner.exe test\02_malware.ps1

Output:

[2025-11-09 01:30:00] AMSI: Starting scan for file: test\02_malware.ps1
[2025-11-09 01:30:00] AMSI: Threat detected - Signature found
Result: MALICIOUS

Example 2: Testing AMSI Integration (Use DLL)

# Register (as Admin)
.\build_and_register.ps1 -BuildAndRegister

# Open NEW PowerShell window
# Type commands - they're automatically scanned
Write-Host "This is safe"  # ✅ No detection
$malware = "MALWARE"       # ⚠️ May trigger detection

Example 3: Scanning Multiple Files (Use Standalone EXE)

# Scan entire test directory
Get-ChildItem test -Recurse -File | ForEach-Object {
    .\MostShittyAVScanner.exe $_.FullName
}

Example 4: Research AMSI Provider Loading (Use DLL + Process Monitor)

# Register provider
.\build_and_register.ps1 -BuildAndRegister

# Start Process Monitor with filters
# Launch new PowerShell
# Watch DLL load events in Process Monitor

# See TEST_REGISTERED_PROVIDER.md for detailed steps

---

Technical Details

Both Components Share:

• Same scanner engine (nim_antimalware_sim.nim)
• Same signature detection
• Same heuristics
• Same threat analysis logic

Differences:

Aspect	AMSI Provider DLL	Standalone Scanner
Entry Point	DllRegisterServer, DllGetClassObject	main()
Invocation	Called by AMSI automatically	Called by user manually
Context	Runs in host process (PowerShell, etc.)	Runs in own process
Input	AMSI scan requests	Command-line file paths
Output	HRESULT codes	Console logs + exit code

---

Summary

TLDR:

• 🆕 Want system integration? → Use MostShittyAVWrapper.dll (AMSI Provider)
• 📦 Want quick file scanning? → Use MostShittyAVScanner.exe (Standalone)
• 🎓 Learning AMSI? → Use the DLL + Process Monitor
• 🧪 Testing scanner logic? → Use the EXE (faster iteration)
• 🚀 Not sure? → Start with the EXE (no installation)

Both are included in the release package - choose what fits your needs!