Meziantou.Framework

AmsiSession Class

Namespace
Meziantou.Framework.Win32
Assembly
Meziantou.Framework.Win32.Amsi.dll
Package
Meziantou.Framework.Win32.Amsi 3.0.9
Source
AmsiSession.cs
Available in package assets
net10.0net11.0
  • Supported on windows10.0.10240

Represents an AMSI session that correlates multiple scan requests within the same context.

[SupportedOSPlatform("windows10.0.10240")]
public sealed class AmsiSession : IDisposable

Example

using var context = AmsiContext.Create("MyApplication");

// The scans of a session are correlated, e.g. the fragments of a script
using var session = context.CreateSession();
Assert.False(session.IsMalware("Hello world", "file1.txt"));
Assert.True(session.IsMalware(@"X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*", "file2.txt"));
Implements

Methods

NameDescription
Dispose()
IsMalware(byte[], string)Scans a byte buffer for malware within this session.
IsMalware(string, string)Scans a string for malware within this session.
Scan(byte[], string)Scans a byte buffer for malware within this session.
Scan(string, string)Scans a string for malware within this session.

Dispose()

AmsiSession.cs
public void Dispose()

No documentation is available.

IsMalware overloads

IsMalware(byte[], string)

AmsiSession.cs

Scans a byte buffer for malware within this session.

public bool IsMalware(byte[] payload, string contentName)
Parameters
payload byte[]
The byte buffer to scan.
contentName string
The name or identifier of the content being scanned.
Returns

bool true if the content is detected as malware; otherwise, false.

Exceptions
COMException
Thrown when the scan operation fails.
ObjectDisposedException
Thrown when the session or its context has been disposed.
Remarks

Content blocked by administrator policy is not reported as malware. Use AmsiSession.Scan and AmsiResultExtensions.ShouldBlock to cover that case.

IsMalware(string, string)

AmsiSession.cs

Scans a string for malware within this session.

public bool IsMalware(string payload, string contentName)
Parameters
payload string
The string content to scan.
contentName string
The name or identifier of the content being scanned.
Returns

bool true if the content is detected as malware; otherwise, false.

Exceptions
COMException
Thrown when the scan operation fails.
ObjectDisposedException
Thrown when the session or its context has been disposed.
Remarks

Content blocked by administrator policy is not reported as malware. Use AmsiSession.Scan and AmsiResultExtensions.ShouldBlock to cover that case.

Scan overloads

Scan(byte[], string)

AmsiSession.cs

Scans a byte buffer for malware within this session.

public AmsiResult Scan(byte[] payload, string contentName)
Parameters
payload byte[]
The byte buffer to scan.
contentName string
The name or identifier of the content being scanned.
Returns

AmsiResult The result reported by the antimalware provider.

Exceptions
COMException
Thrown when the scan operation fails.
ObjectDisposedException
Thrown when the session or its context has been disposed.

Scan(string, string)

AmsiSession.cs

Scans a string for malware within this session.

public AmsiResult Scan(string payload, string contentName)
Parameters
payload string
The string content to scan.
contentName string
The name or identifier of the content being scanned.
Returns

AmsiResult The result reported by the antimalware provider.

Exceptions
COMException
Thrown when the scan operation fails.
ObjectDisposedException
Thrown when the session or its context has been disposed.