{"id":19397961,"url":"https://github.com/chainski/lifetime-amsi-etwpatch","last_synced_at":"2025-04-14T05:52:30.044Z","repository":{"id":246417155,"uuid":"820970987","full_name":"Chainski/Lifetime-Amsi-EtwPatch","owner":"Chainski","description":"Loads a C# binary in memory within powershell profile, patching AMSI + ETW.","archived":false,"fork":false,"pushed_at":"2024-06-27T19:06:24.000Z","size":25,"stargazers_count":4,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-03-27T19:50:17.193Z","etag":null,"topics":["amsi-bypass","amsi-evasion","amsi-patch","etw","etw-bypass","etw-evasion","fud","nim","offensive-security","offensivenim","pentesting-tools","powershell","red-teaming"],"latest_commit_sha":null,"homepage":"https://github.com/Chainski/Lifetime-Amsi-EtwPatch","language":"Nim","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Chainski.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-27T14:43:11.000Z","updated_at":"2024-08-17T12:13:09.000Z","dependencies_parsed_at":"2024-06-27T22:12:34.885Z","dependency_job_id":null,"html_url":"https://github.com/Chainski/Lifetime-Amsi-EtwPatch","commit_stats":null,"previous_names":["chainski/lifetime-amsi-etwpatch"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chainski%2FLifetime-Amsi-EtwPatch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chainski%2FLifetime-Amsi-EtwPatch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chainski%2FLifetime-Amsi-EtwPatch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chainski%2FLifetime-Amsi-EtwPatch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Chainski","download_url":"https://codeload.github.com/Chainski/Lifetime-Amsi-EtwPatch/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248830389,"owners_count":21168272,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amsi-bypass","amsi-evasion","amsi-patch","etw","etw-bypass","etw-evasion","fud","nim","offensive-security","offensivenim","pentesting-tools","powershell","red-teaming"],"created_at":"2024-11-10T11:03:49.000Z","updated_at":"2025-04-14T05:52:30.019Z","avatar_url":"https://github.com/Chainski.png","language":"Nim","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n\u003cimg src=\"https://github.com/Chainski/Lifetime-Amsi-EtwPatch/assets/96607632/1933768a-15b8-4f32-808c-8ebc49a82680\", width=\"800\", height=\"800\"\u003e\n\u003c/p\u003e\n\n\u003ch1 align=\"center\"\u003eLifetime AMSI+ETW Patch\u003c/h1\u003e\n\nThis nim program applies a lifetime patch to PowerShell to disable ETW (Event Tracing for Windows) and AMSI (Antimalware Scan Interface) protections.\n\n### Overview\nThe program modifies the PowerShell profile (`Microsoft.PowerShell_profile.ps1`) to apply two patches:\n\n1. **AMSI Patch**: Disables AMSI by modifying the `AmsiScanBuffer` function, ```{ 0x31, 0xC0, 0xC3 }```.\n2. **ETW Patch**: Modifies the `EtwEventWrite` function in `ntdll.dll` to prevent event tracing, ```{ 0xC3 }```.\n3. Sets File attributes Hidden and System to : `Microsoft.PowerShell_profile.ps1`.\n\n\n### Before\n![before](https://github.com/Chainski/Lifetime-Amsi-EtwPatch/assets/96607632/0de546cf-5f0a-46a0-b7f8-25fd07d688a8)\n\n\n### After\n![after](https://github.com/Chainski/Lifetime-Amsi-EtwPatch/assets/96607632/7ce8fe7a-4cf0-4dc1-948b-e60133bc250f)\n\n\n**Effect: Once applied, PowerShell sessions initiated afterward will have AMSI and ETW bypassed.**\n\n\n### Can this be removed ? \n\nRun the powershell command below as admin to remove it \n\n```ps1\n$file = \"$env:userprofile\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\"\nif (Test-Path $file) { Remove-Item $file -Force } \n```\n\n### Disclaimer\nI, the creator, am not responsible for any actions, and or damages, caused by this software. You bear the full responsibility of your actions and acknowledge that this tool was created for educational purposes only. This tool's main purpose is NOT to be used maliciously, or on any system that you do not own, or have the right to use. By using this software, you automatically agree to the above.\n\n### Credits\n- https://github.com/EvilBytecode\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchainski%2Flifetime-amsi-etwpatch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchainski%2Flifetime-amsi-etwpatch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchainski%2Flifetime-amsi-etwpatch/lists"}