⚠️ Disclaimer: This tool is strictly for educational purposes, academic research, and authorized Red Team / Blue Team operations. The author is not responsible for any misuse, damage, or illegal activities caused by the use of this software. Do not use this tool on systems you do not own or have explicit permission to test.

Lee este documento en Español: README-es.md

JMP-AMSI is a Proof of Concept (PoC) script that demonstrates how to manipulate managed code pointers at runtime using .NET Reflection and JIT Detouring (Hooking). Instead of targeting traditional native DLLs, this tool intercepts the execution flow of the Antimalware Scan Interface (AMSI) managed methods within the PowerShell runtime, forcing it to return a clean status.

This project serves as an educational resource to understand how modern adversaries manipulate memory to bypass telemetry and how defenders can monitor PAGE_EXECUTE_READWRITE memory allocations and P/Invoke abuse.

Unlike traditional AMSI bypasses that overwrite AmsiScanBuffer (which is highly monitored and flagged by AV/EDR), JMP-AMSI operates directly on the compiled JIT (Just-In-Time) memory of the PowerShell application domain.

1. Reflection: It uses .NET Reflection to locate the target ScanContent method and dynamically generates a benign "Dummy" method.

2. P/Invoke: It avoids noisy wrappers by dynamically importing native Windows APIs like VirtualProtect and FlushInstructionCache.

3. JIT Detour (JMP): It obtains the native memory pointers of both methods and overwrites the first bytes of the original method with a relative jump (JMP or PUSH/RET depending on the architecture) pointing to our dynamically generated dummy method.

• Native Memory Manipulation: Uses precise native APIs, completely avoiding highly monitored functions like WriteProcessMemory.

• In-Memory Execution: Leaves no artifacts on disk. By avoiding the Add-Type cmdlet (which compiles code to a temporary DLL on disk), it evades static signature detection.

• Multi-Architecture: Automatically calculates pointer sizes to deploy 64-bit or 32-bit Assembly patches on the fly.

• ETW Tail Jump Patching (Optional): Includes an option to patch NtTraceEvent in ntdll.dll via a stealthy Tail Jump (RET patching) to interrupt Event Tracing for Windows telemetry at a low level.

Run the following commands directly in a PowerShell session:

1. Basic AMSI JIT Detour:

Invoke-JMPAMSI

2. AMSI + ETW Telemetry Interruption:

Invoke-JMPAMSI -etw

3. Verbose Mode (Recommended for debugging & research): Shows memory addresses, offsets, and JIT pointer locations in real-time.

Invoke-JMPAMSI -v -etw

When running the tool in "Verbose" mode (-v), the script will dynamically reveal the managed memory addresses and assembly offsets before injecting the patch:

• PowerShell Reflection techniques inspired by the research of Matt Graeber @mattifestation.
• Base memory patching logic studied from the concepts of PracSec @pracsec.