You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

52 lines
1.6 KiB

  1. #nullable enable
  2. using System;
  3. using System.Collections.Generic;
  4. using System.Linq;
  5. using System.Runtime.InteropServices;
  6. using System.Text;
  7. using System.Threading.Tasks;
  8. namespace IPA.AntiMalware.ComAPI
  9. {
  10. [ComImport]
  11. [Guid(AmsiConstants.IAntimalwareGuidStr)]
  12. [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
  13. internal interface IAntimalware
  14. {
  15. void Scan([In] IAmsiStream stream, [Out] out AmsiResult result, [Out] out IAntimalwareProvider provider);
  16. void CloseSession([In] ulong session);
  17. }
  18. [ComImport]
  19. [Guid("3e47f2e5-81d4-4d3b-897f-545096770373")]
  20. [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
  21. internal interface IAmsiStream
  22. {
  23. unsafe void GetAttribute([In] AmsiAttribute attribute, [In] uint dataSize, [Out] byte* buffer, [Out] out uint writtenData);
  24. unsafe void Read([In] ulong position, [In] uint dataSize, [Out] byte* buffer, [Out] out uint readSize);
  25. }
  26. [ComImport]
  27. [Guid("b2cabfe3-fe04-42b1-a5df-08d483d4d125")]
  28. [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
  29. internal interface IAntimalwareProvider
  30. {
  31. [return: MarshalAs(UnmanagedType.LPWStr)] string DisplayName();
  32. AmsiResult Scan([In] IAmsiStream stream);
  33. void CloseSession([In] ulong session);
  34. }
  35. internal enum AmsiAttribute
  36. {
  37. AppName = 0,
  38. ContentName = 1,
  39. ContentSize = 2,
  40. ContentAddress = 3,
  41. Session = 4,
  42. RedirectChainSize = 5,
  43. RedirectChainAddress = 6,
  44. AllSize = 7,
  45. AllAddress = 8,
  46. }
  47. }