amsiscan.cpp

// @richinseattle
// rjohnson@moflow.org

#include <Windows.h>
#include <Amsi.h>
#include <stdio.h>

#pragma comment(lib, "amsi.lib")
#pragma comment(lib, "ole32.lib")

unsigned char EICAR[] = {
    0x58, 0x35, 0x4F, 0x21, 0x50, 0x25, 0x40, 0x41,
    0x50, 0x5B, 0x34, 0x5C, 0x50, 0x5A, 0x58, 0x35,
    0x34, 0x28, 0x50, 0x5E, 0x29, 0x37, 0x43, 0x43,
    0x29, 0x37, 0x7D, 0x24, 0x45, 0x49, 0x43, 0x41,
    0x52, 0x2D, 0x53, 0x54, 0x41, 0x4E, 0x44, 0x41,
    0x52, 0x44, 0x2D, 0x41, 0x4E, 0x54, 0x49, 0x56,
    0x49, 0x52, 0x55, 0x53, 0x2D, 0x54, 0x45, 0x53,
    0x54, 0x2D, 0x46, 0x49, 0x4C, 0x45, 0x21, 0x24,
    0x48, 0x2B, 0x48, 0x2A
};

int main(int argc, char **argv)
{
    HRESULT hres;
    HAMSICONTEXT amsi_ctx;
    AMSI_RESULT amsi_res;

    CoInitializeEx(0, COINIT_MULTITHREADED);
    if(!(hres = AmsiInitialize(L"rich-amsi-test", &amsi_ctx) == S_OK))
    {
        printf("AmsiInitialize error: %x\n", hres);
        return 1;
    }
    if(!(hres = AmsiScanBuffer(amsi_ctx, EICAR, 68, L"EICAR", 0, &amsi_res) == S_OK))
    {
        printf("AmsiScan error: %x\n", hres);
        return 1;
    }
    if(AmsiResultIsMalware(amsi_res))
        printf("SUCCESS: EICAR detected\n");
    else
        printf("ERROR: did not detect EICAR\n");

    AmsiUninitialize(amsi_ctx);
    CoUninitialize();
}