private static ScanResult ScanResultFromAmsiResult(AmsiResult result)
=> result switch
{
private static extern void AmsiScanBuffer(IntPtr context,
[MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 2)] byte[] buffer, uint length,
[MarshalAs(UnmanagedType.LPWStr)] string contentName,
IntPtr session,
[Out] out AmsiResult result);
internal static bool AmsiResultIsMalware(AmsiResult result)
{
return(result >= AmsiResult.AMSI_RESULT_DETECTED);
}
internal static extern int AmsiScanBuffer(AmsiContextSafeHandle amsiContext, byte[] buffer, uint length, string contentName, AmsiSessionSafeHandle session, out AmsiResult result);
internal static extern int AmsiScanString(AmsiContextSafeHandle amsiContext, [In, MarshalAs(UnmanagedType.LPWStr)] string payload, [In, MarshalAs(UnmanagedType.LPWStr)] string contentName, AmsiSessionSafeHandle session, out AmsiResult result);
internal static extern int AmsiScanBuffer(AmsiContextSafeHandle amsiContext, byte[] buffer, uint length, [In, MarshalAs(UnmanagedType.LPWStr)] string contentName, AmsiSessionSafeHandle session, out AmsiResult result);
