|
@ -54,9 +54,9 @@ namespace IPA.AntiMalware |
|
|
{ |
|
|
{ |
|
|
contentName ??= $"unknown_data_{Guid.NewGuid()}"; |
|
|
contentName ??= $"unknown_data_{Guid.NewGuid()}"; |
|
|
|
|
|
|
|
|
|
|
|
AmsiScanBuffer(handle, data, (uint)data.Length, contentName, IntPtr.Zero, out var result); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Logger.AntiMalware.Debug($"Scanned data named '{contentName}' with {provider.DisplayName()}, and got '{result}'"); |
|
|
|
|
|
|
|
|
Logger.AntiMalware.Debug($"Scanned data named '{contentName}' and got '{result}'"); |
|
|
return ScanResultFromAmsiResult(result); |
|
|
return ScanResultFromAmsiResult(result); |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
@ -99,6 +99,8 @@ namespace IPA.AntiMalware |
|
|
[DefaultDllImportSearchPaths(DllImportSearchPath.System32)] |
|
|
[DefaultDllImportSearchPaths(DllImportSearchPath.System32)] |
|
|
private static extern void AmsiScanBuffer(IntPtr context, |
|
|
private static extern void AmsiScanBuffer(IntPtr context, |
|
|
[MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] byte[] buffer, uint length, |
|
|
[MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] byte[] buffer, uint length, |
|
|
[MarshalAs(UnmanagedType.LPWStr)] string contentName, IntPtr session, [Out] out AmsiResult result); |
|
|
|
|
|
|
|
|
[MarshalAs(UnmanagedType.LPWStr)] string contentName, |
|
|
|
|
|
IntPtr session, |
|
|
|
|
|
[Out] out AmsiResult result); |
|
|
} |
|
|
} |
|
|
} |
|
|
} |