{"id":51771240,"url":"https://github.com/anubhavg-icpl/gansi-rs","last_synced_at":"2026-07-20T01:07:03.494Z","repository":{"id":371044579,"uuid":"1298674510","full_name":"anubhavg-icpl/gansi-rs","owner":"anubhavg-icpl","description":"Gansi — Windows AMSI COM provider \u0026 CLI in Rust","archived":false,"fork":false,"pushed_at":"2026-07-13T00:16:39.000Z","size":723,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-13T01:17:14.819Z","etag":null,"topics":["amsi","antivirus","com","named-pipe","powershell","rust","security","windows"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anubhavg-icpl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-12T22:51:57.000Z","updated_at":"2026-07-13T00:16:42.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/anubhavg-icpl/gansi-rs","commit_stats":null,"previous_names":["anubhavg-icpl/gansi-rs"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/anubhavg-icpl/gansi-rs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anubhavg-icpl%2Fgansi-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anubhavg-icpl%2Fgansi-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anubhavg-icpl%2Fgansi-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anubhavg-icpl%2Fgansi-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anubhavg-icpl","download_url":"https://codeload.github.com/anubhavg-icpl/gansi-rs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anubhavg-icpl%2Fgansi-rs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35669307,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-19T02:00:06.923Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amsi","antivirus","com","named-pipe","powershell","rust","security","windows"],"created_at":"2026-07-20T01:06:58.956Z","updated_at":"2026-07-20T01:07:03.487Z","avatar_url":"https://github.com/anubhavg-icpl.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docs/assets/logo-primary.webp\" alt=\"Gansi\" width=\"220\" /\u003e\n\u003c/p\u003e\n\n# gansi-rs\n\n**Gansi** (*Gain* + *AMSI*) — Windows AMSI COM provider and CLI in Rust, by [Anubhav Gain](https://github.com/anubhavg-icpl).\n\nLocal script telemetry: registers as `IAntimalwareProvider2`, heuristically inspects PowerShell (and embedded C#), streams findings over a named pipe. Optional **Microsoft Defender** management via native WMI (no PowerShell).\n\n\u003e Research / lab tool. Windows x64 + admin for registration. Passive by default (report, don’t block).\n\n[![license](https://img.shields.io/badge/license-MIT-3DDCFF?style=flat-square)](LICENSE)\n[![platform](https://img.shields.io/badge/platform-Windows%20x64-8B95A8?style=flat-square)](#requirements)\n\n## Workspace\n\n| Crate | Role |\n|-------|------|\n| `gansi-com` | AMSI COM provider → `gansi_com.dll` |\n| `gansi-cli` | Control plane → `gansi.exe` |\n| `shared` | Pipe protocol, `FfiString`, constants |\n| `macros` | Compile-time keyword / SHA256 helpers |\n| `xtask` | `cargo xtask dist` packaging |\n\n## Requirements\n\n- Windows x64  \n- Rust (edition 2024) + MSVC toolchain  \n- Administrator for COM / AMSI registration and most Defender preference changes  \n\n## Build\n\n```powershell\ncargo build --release -p gansi-com -p gansi-cli\n# or\ncargo xtask dist   # → dist\\gansi_com.dll, dist\\gansi.exe\n```\n\n## Usage\n\n### AMSI provider\n\n```powershell\ngansi register   --dll .\\gansi_com.dll --pipe gansi   # write HKLM CLSID + AMSI\\Providers\ngansi watch      --dll .\\gansi_com.dll                # register + live trace; auto-unregister on Ctrl+C\ngansi trace      --pipe gansi                         # listen only (attach to a registered provider)\ngansi unregister --dll .\\gansi_com.dll                # remove registration\n```\n\n### Defender — inspect (read-only)\n\n```powershell\ngansi defender health                       # dashboard: protection + signatures + key prefs\ngansi defender status  [--json]             # MSFT_MpComputerStatus\ngansi defender prefs   [--json]             # MSFT_MpPreference\ngansi defender threats [-n 25] [--json]     # detection history (MSFT_MpThreatDetection)\ngansi defender catalog [-f EICAR] [-n 20]   # known-threat catalog (MSFT_MpThreatCatalog)\n```\n\n### Defender — scan \u0026 signatures\n\n```powershell\ngansi defender scan --kind quick                  # 1 = Quick\ngansi defender scan --kind full                   # 2 = Full\ngansi defender scan --kind custom --path C:\\dir   # 3 = Custom (requires --path)\ngansi defender update                             # MSFT_MpSignature.Update\n```\n\n### Defender — exclusions\n\n```powershell\ngansi defender exclude list [--json]\ngansi defender exclude add    --path C:\\lab --extension .ps1 --process foo.exe --ip 10.0.0.1\ngansi defender exclude remove --path C:\\lab\ngansi defender lab-prep --dir .\\dist              # exclude gansi.exe / gansi_com.dll for lab use\n```\n\n`--path` / `--extension` / `--process` / `--ip` are each repeatable.\n\n### Defender — protection toggles\n\n`status` · `on` · `off` for each (disabling needs admin; Tamper Protection / GPO may block it):\n\n```powershell\ngansi defender realtime    status     # real-time protection\ngansi defender script-scan on         # AMSI script scanning\ngansi defender behavior    off        # behavior monitoring\ngansi defender ioav        status     # download / attachment (IOAV) scanning\n```\n\n### Defender — preferences \u0026 threats (omit the value flag to show current)\n\n```powershell\ngansi defender cloud   --maps 2 --block-level 2   # MAPS 0/1/2 · block 0/1/2/4/6 · --show to view\ngansi defender cfa     --mode 2                    # controlled folder access: 0 off / 1 on / 2 audit\ngansi defender netprot --mode 1                    # network protection:        0 off / 1 on / 2 audit\ngansi defender remove-threats                      # MSFT_MpThreat.Remove (admin)\n```\n\nAliases: `r` / `u` / `t` / `a` (watch), `def` (defender); `h` (health), `st` (status), `pref` (prefs), `sig` (update).  \nDefaults: DLL `gansi_com.dll`, pipe `\\\\.\\pipe\\gansi`, log `warn` (`--log` / `GANSI_LOG`).  \n`--json` (on `status` / `prefs` / `threats` / `exclude list`) emits raw JSON — the startup banner currently prints to stdout as well.  \nProvider logs land in `C:\\gansi\\amsi-\u003cpid\u003e-\u003ctid\u003e-\u003cdate\u003e.log` (best-effort; skipped if the directory can't be created).\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docs/assets/terminal-cli.webp\" alt=\"gansi CLI\" width=\"100%\" /\u003e\n\u003c/p\u003e\n\n## How it works\n\n```text\nScript host → AMSI → gansi_com.dll (scan + heuristics)\n                         ↓ length-prefixed JSON\n                   \\\\.\\pipe\\gansi → gansi.exe (trace/watch)\n```\n\n1. CLI loads the DLL and calls `DllRegisterServerWithPipe`.  \n2. Provider writes HKLM CLSID + `AMSI\\Providers`.  \n3. `Scan`: SHA cleanlist → PS/C# parse (or tokenize) → heuristics → optional pipe report.  \n4. Detected/Suspicious: **report**, return `AMSI_RESULT_NOT_DETECTED` (passive).  \n\nDefender commands use `IWbemLocator` / `MSFT_Mp*` classes (same surface as the Defender PowerShell module, without spawning PowerShell).\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docs/assets/amsi-diagram.webp\" alt=\"Architecture\" width=\"100%\" /\u003e\n\u003c/p\u003e\n\n## Security notes\n\n- Registration and Defender preference changes need **admin**; Tamper Protection / GPO may block changes.  \n- Script content may appear on the pipe and in logs — treat as sensitive.  \n- Default pipe ACL is lab-friendly; tighten for multi-user hosts.  \n- See [SECURITY.md](SECURITY.md).\n\n## Assets\n\nBrand/product stills: [`docs/assets/`](docs/assets/) (WebP).\n\n## License\n\nMIT — [LICENSE](LICENSE)  \n**Anubhav Gain** — [@anubhavg-icpl](https://github.com/anubhavg-icpl)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanubhavg-icpl%2Fgansi-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanubhavg-icpl%2Fgansi-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanubhavg-icpl%2Fgansi-rs/lists"}