ESET-Vulnerability-Findings - Open security research on ESET Security's eamsi.dl

项目说明

ESET AMSI Provider (eamsi.dll) — Security Research

Defensi and empirical of ESET Security's AMSI provider DLL (eamsi.dll), build reference 19.1.12.0. This repository documents two cases (, ), ships reproducible PoCs, hooking/injection tooling, and remediation guidance.

> Scope: Authorized security research and disclosure. Do not use against systems you do not own or ha permission to test.

---

Findings at a Glance

| Case ID | Title | Se | Proof |
|---------|-------|----------|-------|
| | Sign-extension length mismatch (cdqe at staging copy path) | High | Static AoB + offline emulation + li (0xC0000005) |
| | Staging buffer descriptor trust in erpc serialization | High | Static AoB + architectural analysis |

posture: FULL_PASS — static signatures, offline cdqe math, undebugged AMSI transport, and stealth injection crash reproduction. See analysis/DISCLOSURE_MANIFEST.md.

---

Repository Layout

---

Prerequisites

| Requirement | Notes |
|-------------|-------|
| Windows 10/11 x64 | AMSI + PowerShell host required |
| ESET Security installed | Provider must register eamsi.dll (or use bundled extracted/binaries/) |
| Python 3.10+ | pip install -r requirements.txt |
| Studio 2022 | MSVC x64 tools (cl.exe, ml64.exe) for rebuilding probes |
| Administrator | Required for run_real_proof.ps1 / debug attach paths only |

---

Quick Start (5 minutes)

Clone the repo, install deps, and run the mandatory static gate:

Full pipeline: docs/QUICKSTART.md

---

Pipeline

Run stages in order. Each stage logs commit=... lines for reproducibility.

Stage 1 — Static AoB gate (required)

every production signature matches exactly once in .text. Anti-hallucination rule: signatures are invalid if zero or multiple hits.

Stage 2 — Offline emulation

Proves r8d = 0x7FFFFFFF → rax = 0xFFFFFFFF80000000 after cdqe.

Stage 3 — Full sweep

Runs static + offline + optional inline_detour.exe compile.

Stage 4 — Benign AMSI event

Triggers a benign AMSI scan through the registered provider (40-char probe string).

Stage 5 — Stealth injection crash proof

Suspended-process LoadLibraryA injection → stealth_detour.dll hooks AmsiScanBuffer → length coercion → STATUS_ACCESS_ (0xC0000005).

Logs: ghidra_output/stealth_inject_run.log, probes/amsi_hook/stealth_detour.log

Stage 6 — Real-process proof (optional, requires Admin)

Output: ghidra_output/.json

> Note: pro.py optionally imports trace_eamsi_provider from a sibling ESET/eset-security/tools directory. Use --skip-debug-pass (default) if that tree is not present.

Details: docs/.md

---

Building Probes

Stealth detour DLL (primary hooking probe)

Uses MinHook from iergiehg/include/minhook-master/. Hooks:

Simple patcher / PE carrier

Strike harness (extended payload modes)

Modes: EICAR, reflection, framework, PeCarrier. Logs to ghidra_output/strike_run.log.

Build details: docs/BUILD.md

---

Key Analysis Documents

| Document | Contents |
|----------|----------|
| analysis/01_.md | /02 specification, disassembly, proof stack |
| analysis/02_DETECTION_GAP_ANALYSIS.md | Anti-debug behavior when Win32 debug port attached |
| analysis/03_REMEDIATION_BLUEPRINT.md | Production patch specs for engineering |
| analysis/DISCLOSURE_MANIFEST.md | gates, signature registry, PSIRT checklist |
| remediation/.cpp | Reference C++ boundary checks (not linked into product) |

---

AoB Signature Registry

Source of truth: ghidra_output/eamsi.dll_aob_catalog.json

| Signature ID | RVA (ref build) | Role |
|--------------|-----------------|------|
| length_field_64bit_extend | 0x3631B | cdqe sign-extension site |
| erpc_buffer_staging_core | 0x363D0 | large staging routine |
| post_staging_length_dword_load | 0x2F721 | Length load after staging call |
| bypass_reference_hresult_epilogue | 0x1DBA8 | Integrity baseline (monitor only) |

RVAs are discovered dynamically by the PoC — ne in scripts. After a rebuild, update catalog masks only.

---

Tooling O

| Tool | Path | Purpose |
|------|------|---------|
| AoB matcher | pocs//test_aob_matcher.py | Mandatory PE static |
| AMSI monitor | probes/amsi_hook/amsi_monitor.py | Emits eamsi_li.log |
| Stealth injector | probes/amsi_hook/inject_stealth_load.ps1 | Suspended spawn + DLL inject |
| Interactive REPL child | probes/amsi_hook/child_amsi_interactive.ps1 | Long-li child |
| MCP build bridge | probes/amsi_hook/mcp_bridge.ps1 | Cursor MCP build_stealth_detour tool |

Extended tooling guide: docs/TOOLING.md

---

Re- After Update

If signatures drift, regenerate masks from Capstone disassembly and update eamsi.dll_aob_catalog.json.

---

Publishing to GitHub

See docs/GITHUB_SETUP.md for step-by-step repo creation, what gets uploaded, and recommended settings.

---

Legal & Responsible Use

This repository contains security research artifacts including proof-of-concept code that demonstrates in third-party software.

---

References

---

License

Research artifacts are provided for educational and defensi purposes. Third-party components (MinHook) retain their original licenses. See repository license file for terms.

项目信息

开发语言：C

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open security research on ESET Security's eamsi.dll AMSI provider. Documents V-AMSI-01/02 with reproducible PoCs, hooking tooling, Ghidra artifacts, and remediation guidance. For education and defensive security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。