AmsiScanner Class Reference

#include <PanoptesAMSI.h>

Public Types
enum	AMSI_RESULT_PANO {   AMSI_RESULT_PANO_CLEAN = 0 , AMSI_RESULT_PANO_NOT_DETECTED = 1 , AMSI_RESULT_PANO_BLOCKED_BY_ADMIN_START = 0x4000 , AMSI_RESULT_PANO_BLOCKED_BY_ADMIN_END = 0x4fff ,   AMSI_RESULT_PANO_DETECTED = 32768 }
	The result of the AMSI scan. More...
typedef enum AmsiScanner::AMSI_RESULT_PANO	AMSI_RESULT_PANO
	The result of the AMSI scan.

Static Public Member Functions
static HRESULT	AmsiScanFile (std::string PathToFile, std::string CopyPath, int *AmsiResult)
	Scan a file using Windows built in AMSI feature set.

Detailed Description

Definition at line 15 of file PanoptesAMSI.h.

Member Typedef Documentation

AMSI_RESULT_PANO

typedef enum AmsiScanner::AMSI_RESULT_PANO AmsiScanner::AMSI_RESULT_PANO

The result of the AMSI scan.

Member Enumeration Documentation

AMSI_RESULT_PANO

enum AmsiScanner::AMSI_RESULT_PANO

The result of the AMSI scan.

Enumerator
AMSI_RESULT_PANO_CLEAN
AMSI_RESULT_PANO_NOT_DETECTED
AMSI_RESULT_PANO_BLOCKED_BY_ADMIN_START
AMSI_RESULT_PANO_BLOCKED_BY_ADMIN_END
AMSI_RESULT_PANO_DETECTED

Definition at line 18 of file PanoptesAMSI.h.

    {
        AMSI_RESULT_PANO_CLEAN = 0,
        AMSI_RESULT_PANO_NOT_DETECTED = 1,
        AMSI_RESULT_PANO_BLOCKED_BY_ADMIN_START = 0x4000,
        AMSI_RESULT_PANO_BLOCKED_BY_ADMIN_END = 0x4fff,
        AMSI_RESULT_PANO_DETECTED = 32768
    }   AMSI_RESULT_PANO;

Member Function Documentation

AmsiScanFile()

HRESULT AmsiScanner::AmsiScanFile ( std::string  file_path, std::string  copy_path, int *  amsi_result  )

static

Scan a file using Windows built in AMSI feature set.

Parameters

file_path	The path of the file to scan
copy_path	The path to copy the file to, if empty the file will not be copied
amsi_result	The result of the scan, will be set to the result of the scan

Returns

The result of the scan

Definition at line 10 of file amsi-scan.cpp.

{
    LPWSTR message{};
    HAMSICONTEXT amsiContext = nullptr;
    HAMSISESSION amsiSession = nullptr;
    std::string copy_path_destination;
 
    if (copy_path != "") {
        LPCSTR baseName = PathFindFileNameA(file_path.c_str());
        copy_path_destination = copy_path + baseName;
        CopyFileA(file_path.c_str(), copy_path_destination.c_str(), false);
    }
    else {
        copy_path_destination = file_path;
    }
 
    HRESULT hr = AmsiInitialize(L"Panoptes Scanner", &amsiContext);
    if (FAILED(hr))
    {
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    hr = AmsiOpenSession(amsiContext, &amsiSession);
    if (FAILED(hr))
    {
        AmsiUninitialize(amsiContext);
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    // Check if file exist
    DWORD dwFileAttributes = GetFileAttributesA(copy_path_destination.c_str());
    if (dwFileAttributes == INVALID_FILE_ATTRIBUTES) {
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    HANDLE fileHandle = CreateFileA(copy_path_destination.c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
    if (fileHandle == INVALID_HANDLE_VALUE)
    {
        AmsiUninitialize(amsiContext);
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    DWORD fileSize = GetFileSize(fileHandle, nullptr);
    if (fileSize == INVALID_FILE_SIZE)
    {
        CloseHandle(fileHandle);
        AmsiUninitialize(amsiContext);
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    LPVOID fileBuffer = VirtualAlloc(nullptr, fileSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
    if (fileBuffer == nullptr)
    {
        CloseHandle(fileHandle);
        AmsiUninitialize(amsiContext);
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    DWORD bytesRead;
    if (!ReadFile(fileHandle, fileBuffer, fileSize, &bytesRead, nullptr))
    {
        VirtualFree(fileBuffer, 0, MEM_RELEASE);
        CloseHandle(fileHandle);
        AmsiUninitialize(amsiContext);
        return HRESULT_FROM_WIN32(GetLastError());
    }
 
    const int MAX_RETRIES = 3;
    const int RETRY_DELAY_MS = 1000;
    int retryCount = 0;
    AMSI_RESULT result;
 
    do
    {
        hr = AmsiScanBuffer(amsiContext, fileBuffer, fileSize, nullptr, amsiSession, &result);
        if (FAILED(hr))
        {
            if (hr == HRESULT_FROM_WIN32(ERROR_NOT_READY) && retryCount < MAX_RETRIES)
            {
                retryCount++;
                Sleep(RETRY_DELAY_MS);
            }
            else
            {
                break;
            }
        }
        else {
            *amsi_result = result;
            VirtualFree(fileBuffer, 0, MEM_RELEASE);
            CloseHandle(fileHandle);
            AmsiUninitialize(amsiContext);
            return S_OK;
 
        }
    } while (FAILED(hr) && retryCount < MAX_RETRIES);
 
    VirtualFree(fileBuffer, 0, MEM_RELEASE);
    CloseHandle(fileHandle);
    AmsiUninitialize(amsiContext);
    return E_FAIL;
}

References result.

Referenced by PanoEntry(), AMSI::TEST(), and AMSI::TEST().

---

The documentation for this class was generated from the following files:

• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesAMSI/include/PanoptesAMSI.h
• /home/runner/work/Panoptes/Panoptes/src/extensibility/PanoptesAMSI/src/amsi-scan.cpp