P/Invoke
  • README
  • ADVAPI32
    • AdjustTokenGroups
    • AdjustTokenPrivileges
    • ChangeServiceConfigW
    • CloseServiceHandle
    • ControlService
    • CreateProcessAsUserW
    • CreateProcessWithTokenW
    • CreateServiceW
    • CryptDecrypt
    • CryptEncrypt
    • DeleteService
    • DuplicateTokenEx
    • GetTokenInformation
    • ImpersonateLoggedOnUser
    • ImpersonateNamedPipeClient
    • LogonUserW
    • OpenProcessToken
    • OpenSCManagerW
    • OpenServiceW
    • OpenThreadToken
    • RtlDecryptMemory
    • RtlEncryptMemory
    • SetTokenInformation
    • StartServiceW
    • LsaNtStatusToWinError
    • GetSidSubAuthorityCount
    • GetSidSubAuthority
    • CreateProcessWithLogonW
    • ChangeServiceConfigA
    • CreateProcessAsUserA
    • CreateServiceA
    • LogonUserA
    • LogonUserExW
    • LogonUserExA
    • LookupAccountSidW
    • OpenSCManagerA
    • OpenServiceA
    • StartServiceA
    • LsaEnumerateTrustedDomains
    • LsaClose
    • LsaQueryDomainInformationPolicy
  • KERNEL32
    • CloseHandle
    • ConnectNamedPipe
    • ConvertFiberToThread
    • ConvertThreadToFiber
    • CreateFiber
    • CreateFileW
    • CreateMailslotW
    • CreateNamedPipeW
    • CreatePipe
    • CreateProcessW
    • CreateRemoteThread
    • CreateThread
    • DeleteFiber
    • DeleteProcThreadAttributeList
    • DeviceIoControl
    • DisconnectNamedPipe
    • DuplicateHandle
    • FlushInstructionCache
    • FreeLibrary
    • GetCurrentProcess
    • GetCurrentProcessId
    • GetCurrentThread
    • GetCurrentThreadId
    • GetModuleHandleW
    • GetProcAddress
    • GetProcessHeap
    • GetStdHandle
    • GetThreadInformation
    • HeapAlloc
    • HeapFree
    • InitializeProcThreadAttributeList
    • IsWow64Process
    • LoadLibraryW
    • LoadLibraryExW
    • LocalAlloc
    • LocalFree
    • OpenProcess
    • PeekNamedPipe
    • QueueUserAPC
    • ReadProcessMemory
    • ResumeThread
    • SuspendThread
    • SwitchToFiber
    • UpdateProcThreadAttribute
    • VirtualAlloc
    • VirtualAllocEx
    • VirtualFree
    • VirtualFreeEx
    • VirtualProtect
    • VirtualProtectEx
    • WriteProcessMemory
    • CreateFileA
    • CreateMailslotA
    • CreateNamedPipeA
    • CreateProcessA
    • GetModuleHandleA
    • LoadLibraryA
    • LoadLibraryExA
  • SECUR32
    • LsaLookupAuthenticationPackage
    • LsaCallAuthenticationPackage
    • LsaRegisterLogonProcess
    • LsaDeregisterLogonProcess
    • LsaEnumerateLogonSessions
    • LsaGetLogonSessionData
    • AcquireCredentialsHandleW
    • InitializeSecurityContextW
    • DeleteSecurityContext
    • LsaConnectUntrusted
    • LsaFreeReturnBuffer
    • AcquireCredentialsHandleA
    • InitializeSecurityContextA
  • NTDLL
    • NtAllocateVirtualMemory
    • NtClose
    • NtCreateSection
    • NtMapViewOfSection
    • NtOpenFile
    • NtOpenProcess
    • NtProtectVirtualMemory
    • NtUnmapViewOfSection
    • NtWriteVirtualMemory
    • RtlInitUnicodeString
    • NtFreeVirtualMemory
    • LdrLoadDll
    • LdrUnloadDll
    • NtCreateThreadEx
    • NtOpenProcessToken
    • NtOpenThreadToken
    • NtDuplicateToken
    • NtSetInformationThread
    • NtAdjustPrivilegesToken
    • NtQueryInformationProcess
  • AMSI
    • AmsiInitialize
    • AmsiOpenSession
    • AmsiScanBuffer
    • AmsiCloseSession
    • AmsiUninitialize
  • FOUNDATION
    • ACCESS_MASK
    • BOOL
    • CLIENT_ID
    • DUPLICATE_HANDLE_OPTIONS
    • HANDLE
    • HLOCAL
    • HMODULE
    • HINSTANCE
    • HRESULT
    • HWND
    • FARPROC
    • LUID
    • NTSTATUS
    • OBJECT_ATTRIBUTES
    • PAPCFUNC
    • PCWSTR
    • PWSTR
    • PSID
    • UNICODE_STRING
    • PSTR
    • PCSTR
    • USER_THREAD_START_ROUTINE
    • PS_ATTRIBUTE_LIST
    • THREAD_INFORMATION_CLASS
    • BOOLEAN
  • THREADING
    • CREATE_PROCESS_LOGON_FLAGS
    • LPFIBER_START_ROUTINE
    • LPPROC_THREAD_ATTRIBUTE_LIST
    • LPTHREAD_START_ROUTINE
    • PROC_THREAD_ATTRIBUTE
    • PROCESS_ACCESS_RIGHTS
    • PROCESS_CREATION_FLAGS
    • PROCESS_CREATION_MITIGATION_POLICY
    • PROCESS_INFORMATION
    • STARTUPINFOEXW
    • STARTUPINFOW
    • STARTUPINFO_FLAGS
    • THREAD_CREATION_FLAGS
    • STARTUPINFOA
    • PROCESS_BASIC_INFORMATION
  • SECURITY
    • LOGON32_LOGON
    • LOGON32_PROVIDER
    • LUID_AND_ATTRIBUTES
    • SC_HANDLE
    • SECURITY_ATTRIBUTES
    • SECURITY_IMPERSONATION_LEVEL
    • SID_AND_ATTRIBUTES
    • TOKEN_ACCESS_MASK
    • TOKEN_GROUPS
    • TOKEN_INFORMATION_CLASS
    • TOKEN_PRIVILEGES
    • TOKEN_PRIVILEGES_ATTRIBUTES
    • TOKEN_TYPE
    • SecHandle
    • TOKEN_MANDATORY_LABEL
    • TOKEN_USER
    • TOKEN_STATISTICS
    • QUOTA_LIMITS
    • SECURITY_QUALITY_OF_SERVICE
    • SID_NAME_USE
  • SERVICES
    • ENUM_SERVICE_TYPE
    • SERVICE_ERROR
    • SERVICE_START_TYPE
    • SERVICE_STATUS
    • SERVICE_STATUS_CURRENT_STATE
  • MEMORY
    • HEAP_FLAGS
    • LOCAL_ALLOC_FLAGS
    • PAGE_PROTECTION_FLAGS
    • VIRTUAL_ALLOCATION_TYPE
    • VIRTUAL_FREE_TYPE
  • FILESYSTEM
    • FILE_CREATION_DISPOSITION
    • FILE_FLAGS_AND_ATTRIBUTES
    • FILE_SHARE_MODE
  • ANTIMALWARE
    • AMSI_RESULT
    • HAMSICONTEXT
    • HAMSISESSION
  • PIPES
    • NAMED_PIPE_MODE
  • LIBRARY LOADER
    • LOAD_LIBRARY_FLAGS
  • IO
    • IO_STATUS_BLOCK
  • WDK
    • SECTION_INHERIT
    • PROCESSINFOCLASS
  • CONSOLE
    • STD_HANDLE
  • AUTHENTICATION
    • LSA_STRING
    • LSA_UNICODE_STRING
    • SECURITY_LOGON_SESSION_DATA
    • SECPKG_CRED
    • SEC_GET_KEY_FN
    • ISC_REQ_FLAGS
    • SecBufferDesc
    • SecBuffer
    • LSA_HANDLE
    • POLICY_DOMAIN_INFORMATION_CLASS
  • DEBUG
    • RtlLookupFunctionEntry
    • IMAGE_RUNTIME_FUNCTION_ENTRY
    • IMAGE_DATA_DIRECTORY
    • IMAGE_DLL_CHARACTERISTICS
    • IMAGE_FILE_HEADER
    • IMAGE_FILE_CHARACTERISTICS
    • IMAGE_OPTIONAL_HEADER32
    • IMAGE_OPTIONAL_HEADER64
    • IMAGE_OPTIONAL_HEADER_MAGIC
    • IMAGE_RUNTIME_FUNCTION_ENTRY
    • IMAGE_SECTION_HEADER
    • IMAGE_SECTION_CHARACTERISTICS
    • IMAGE_SUBSYSTEM
    • UNWIND_HISTORY_TABLE
    • UNWIND_HISTORY_TABLE_ENTRY
  • SYSTEM INFORMATION
    • IMAGE_FILE_MACHINE
  • SYSTEM SERVICES
    • IMAGE_BASE_RELOCATION
  • WINDOWS PROGRAMMING
    • IMAGE_THUNK_DATA32
    • IMAGE_THUNK_DATA64
    • LDR_DATA_TABLE_ENTRY
  • KERNEL
    • LIST_ENTRY
  • IDENTITY
    • KERB_ETYPE
    • KERB_CRYPTO_KEY
    • KERB_EXTERNAL_NAME
    • KERB_EXTERNAL_TICKET
    • KERB_RETRIEVE_TKT_RESPONSE
    • KERB_RETRIEVE_TKT_REQUEST
    • KERB_PROTOCOL_MESSAGE_TYPE
    • LSA_UNICODE_STRING
    • KERB_CRYPTO_KEY_TYPE
    • KERB_TICKET_FLAGS
    • KERB_QUERY_TKT_CACHE_REQUEST
    • KERB_QUERY_TKT_CACHE_RESPONSE
    • KERB_TICKET_CACHE_INFO
    • KERB_TICKET_CACHE_INFO_EX
    • KERB_SUBMIT_TKT_REQUEST
    • KERB_CRYPTO_KEY32
  • CRYPT32
    • CryptProtectData
    • CryptUnprotectData
  • Cryptography
    • CRYPTPROTECT_PROMPTSTRUCT
    • CRYPT_INTEGER_BLOB
Powered by GitBook
On this page
Edit on GitHub
  1. AMSI

AmsiUninitialize

[DllImport("Amsi.dll", ExactSpelling = true)]
[DefaultDllImportSearchPaths(DllImportSearchPath.System32)]
public static extern void AmsiUninitialize(HAMSICONTEXT amsiContext);

HAMSICONTEXT

Last updated 1 year ago