#nullable enable using System; using System.Collections.Generic; using System.Linq; using System.Runtime.InteropServices; using System.Text; using System.Threading.Tasks; namespace IPA.AntiMalware.ComAPI { [ComImport] [Guid(AmsiConstants.IAntimalwareGuidStr)] [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] internal interface IAntimalware { void Scan([In] IAmsiStream stream, [Out] out AmsiResult result, [Out] out IAntimalwareProvider provider); void CloseSession([In] ulong session); } [ComImport] [Guid("3e47f2e5-81d4-4d3b-897f-545096770373")] [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] internal interface IAmsiStream { unsafe void GetAttribute([In] AmsiAttribute attribute, [In] uint dataSize, [Out] byte* buffer, [Out] out uint writtenData); unsafe void Read([In] ulong position, [In] uint dataSize, [Out] byte* buffer, [Out] out uint readSize); } [ComImport] [Guid("b2cabfe3-fe04-42b1-a5df-08d483d4d125")] [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] internal interface IAntimalwareProvider { [return: MarshalAs(UnmanagedType.LPWStr)] string DisplayName(); AmsiResult Scan([In] IAmsiStream stream); void CloseSession([In] ulong session); } internal enum AmsiAttribute { AppName = 0, ContentName = 1, ContentSize = 2, ContentAddress = 3, Session = 4, RedirectChainSize = 5, RedirectChainAddress = 6, AllSize = 7, AllAddress = 8, } }