Repository files navigation

Thanks to @D1rkMtr for the technique of usingjne from amsi!AmsiOpenSession. I have used his AMSI patch code template and added other methods. This script skips entering amsi!AmsiOpenSession+0x4c viaret, by directly pastingc3 at the beginning of the amsi!AmsiOpenSession. As a result, we end up directly at amsi!AmsiCloseSession.

• The script checks whetherNtProtectVirtualMemory andNtAllocateVirtualMemory are hooked by any security vendor or not.