🔍 Bypasses AMSI by remotely patching AmsiScanBuffer function in target processes.

AMSI-PeParse-Patch.exe powershell.exe  # By name
AMSI-PeParse-Patch.exe 1234            # By PID (you can use in powershell $pid)

1. 🎯 Target Process

   • Opens handle to remote process with PROCESS_ALL_ACCESS

2. 🔎 Find amsi.dll

   • Lists loaded modules with EnumProcessModules
   • Locates amsi.dll in target process

3. 🧠 Memory Analysis

   • Explicit individual ReadProcessMemory() calls:
     1. Reads DOS header from module base address
     2. Reads NT headers from base + e_lfanew offset
     3. Stores RVAs of import/export directories
   • Creates Pe structure with pointers to remote memory structures

4. 🔍 Locate Function

   • Reads export tables remotely
   • Searches for "AmsiScanBuffer" string
   • Translates to actual memory address

5. 💉 Patch Memory

   • Changes protection with VirtualProtectEx
   • Writes patch B8 00 00 00 00 C3 (mov eax, 0; ret)
   • AmsiScanBuffer now returns "clean" for ANY content

• 🧩 Works on x86 and x64 processes
• 🪄 No process restart needed
• 🏭 Common target: powershell.exe.

Copyright © 2025 EvilBytecode. All rights reserved.