Skip to content

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

License

Notifications You must be signed in to change notification settings

sliverarmory/BOF-patchit

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

21 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Cobalt Strike BOF - patchit (Both syscalls and dynamic resolve versions are available)

An all-in-one BOF to patch, check and revert AMSI and ETW for x64 process. Wrote this to avoid redundant AMSI / ETW patch.

Currently, it only checks the first 10+ bytes of AmsiScanBuffer and EtwEventWrite, since most of public available patch bytes are doing on first few lines. If thats not enough, additional bytes / function to compare can be added easily to the source code.

If you are not using the AMSI/ETW patch from this BOF and want to revert, you could refresh the whole AMSI and NTDLL as an alternative.

If there is no amsi.dll in current process, this bof will not load it to the process.

Update on 18 Aug 2022

  • Added a new version doing indirect syscalls for NtApi

Update on 30 Sep 2022

  • Added callback unhook on syscall version

Usage - Cobalt Strike

Load patchit.cna

Check if AMSI & ETW are patched:
beacon> patchit check

Patch both AMSI and ETW:
beacon> patchit all

Patch AMSI:
beacon> patchit amsi

Patch ETW:
beacon> patchit etw

Revert both AMSI and ETW:
beacon> patchit revertAll

Revert AMSI:
beacon> patchit revertAmsi

Revert ETW:
beacon> patchit revertEtw

Screenshot examples

Run patchit check when amsi.dll is not loaded:
image

patchit all:
image image image

patchit revertAll:
image

Compile

make

Reference

About

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • C 99.2%
  • Makefile 0.8%