Bypass In-memory Integrity Checking
In the Memory Patching AMSI Bypass post, I discussed how to patch the AmsiScanBuffer function to prevent it from returning a positive result when scanning content. That process involved: Finding the location of AmsiScanBuffer in memory. Changing the memory permissions to RWX. Copying the patched bytes across. Restoring the memory region back to RX. After