SixSixSix c976b9f152 add patchless-amsi-bypass — reference port of HW BP AMSI/ETW evasion ...

Companion artifact for https://trexnegro.github.io/posts/patchless-amsi-bypass-hwbp/

Ships the validated subset of the technique covered in the post:
  - BP_AMSI_HWBP : DR0 + VEH on amsi!AmsiScanBuffer
  - BP_ETW_PATCH : DR1 + VEH on ntdll!EtwEventWrite

~500 lines of C across six files. Cross-compiles from Linux via
mingw-w64 (build.sh) into a self-test exe that calls AmsiScanBuffer on
the standard AMSI test string and asserts AMSI_RESULT_CLEAN.

Excluded from this entry (will land as separate entries once empirically
validated against current EDR products in lab):
  - ntdll selective refresh from \KnownDlls
  - Indirect syscalls (Hells/Halos/Tartarus gate)

OPSEC: author strings and engagement-specific notes scrubbed before
publication.

MIT-licensed (see root LICENSE).

2026-06-01 23:57:23 +00:00

..

bypass.h

add patchless-amsi-bypass — reference port of HW BP AMSI/ETW evasion

2026-06-01 23:57:23 +00:00