Companion artifact for https://trexnegro.github.io/posts/patchless-amsi-bypass-hwbp/
Ships the validated subset of the technique covered in the post:
- BP_AMSI_HWBP : DR0 + VEH on amsi!AmsiScanBuffer
- BP_ETW_PATCH : DR1 + VEH on ntdll!EtwEventWrite
~500 lines of C across six files. Cross-compiles from Linux via
mingw-w64 (build.sh) into a self-test exe that calls AmsiScanBuffer on
the standard AMSI test string and asserts AMSI_RESULT_CLEAN.
Excluded from this entry (will land as separate entries once empirically
validated against current EDR products in lab):
- ntdll selective refresh from \KnownDlls
- Indirect syscalls (Hells/Halos/Tartarus gate)
OPSEC: author strings and engagement-specific notes scrubbed before
publication.
MIT-licensed (see root LICENSE).
SixSixSix