{"componentChunkName":"component---src-templates-post-template-js","path":"/amsi-create-interface-en","result":{"data":{"markdownRemark":{"id":"b3fc0779-0b56-5117-9673-a189302a9866","html":"
\n

This page has been machine-translated from the original page.

\n
\n

Following the previous post, AMSI Overview and How It Works, this time I will summarize an application that issues AMSI scan requests by using the AMSI COM interface, along with its implementation.

\n\n

Table of Contents

\n\n

Issuing AMSI Scan Requests from a Custom Application

\n

Broadly speaking, there seem to be two ways to integrate the AMSI interface into an application: using the AMSI Win32 API, or using the AMSI COM interface.

\n

Reference: Developer audience and sample code - Win32 apps | Microsoft Learn

\n

Since the PowerShell example examined in the previous article uses the AMSI Win32 API, this time I decided to try an implementation that uses the AMSI COM interface.

\n

The official sample code is a good reference for creating an application that uses the AMSI COM interface.

\n

You can obtain this sample code by downloading amsistream-sample.zip from the following repository.

\n

Reference: Release MicrosoftDocs-Samples · microsoft/Windows-classic-samples

\n

This sample program scans in-memory data and file contents by using the AMSI COM interface.

\n

\n \n \n \n \n \n \n \n \n

\n

Scanning a File Stream

\n

If the sample program is run without command-line arguments, the memory scan discussed in the previous section is performed.

\n

On the other hand, if a file path is included in the command-line arguments, the CAmsiFileStream class is initialized and the file is scanned.

\n
else\n{\n    // Scan the files passed on the command line.\n    for (int i = 1; i < argc; i++)\n    {\n        LPWSTR fileName = argv[i];\n\n        wprintf(L\"Creating stream object with file name: %s\\n\", fileName);\n        ComPtr<IAmsiStream> stream;\n        hr = MakeAndInitialize<CAmsiFileStream>(&stream, fileName);\n        if (FAILED(hr)) {\n            return hr;\n        }\n\n        hr = scanner.ScanStream(stream.Get());\n        if (FAILED(hr))\n        {\n            return hr;\n        }\n    }\n}
\n

When the sample program is executed with the file path to be scanned specified, you can confirm in the debugger that the file path is obtained from the command-line arguments.

\n

\n \n \n \n \n \n \n \n \n

\n

Also, just like CAmsiMemoryStream, the CAmsiFileStream class defines GetAttribute and Read methods for the IAmsiStream interface.

\n

Unlike CAmsiMemoryStream, the GetAttribute method of the CAmsiFileStream class appears to simply call the BaseGetAttribute method of the base class.

\n

Also, in the Read method, the file data is stored into buffer by using the file handle obtained from m_fileHandle.

\n
// IAmsiStream\n\nSTDMETHOD(GetAttribute)(\n    _In_ AMSI_ATTRIBUTE attribute,\n    _In_ ULONG bufferSize,\n    _Out_writes_bytes_to_(bufferSize, *actualSize) PBYTE buffer,\n    _Out_ ULONG* actualSize)\n{\n    return BaseGetAttribute(attribute, bufferSize, buffer, actualSize);\n}\n\nSTDMETHOD(Read)(\n    _In_ ULONGLONG position,\n    _In_ ULONG size,\n    _Out_writes_bytes_to_(size, *readSize) PBYTE buffer,\n    _Out_ ULONG* readSize)\n{\n    wprintf(L\"Read() called with: position = %I64u, size = %u\\n\", position, size);\n\n    OVERLAPPED o = {};\n    o.Offset = LODWORD(position);\n    o.OffsetHigh = HIDWORD(position);\n\n    if (!ReadFile(m_fileHandle.Get(), buffer, size, readSize, &o))\n    {\n        HRESULT hr = HRESULT_FROM_WIN32(GetLastError());\n        wprintf(L\"ReadFile failed with 0x%x\\n\", hr);\n        return hr;\n    }\n\n    return S_OK;\n}
\n

Finally, by calling the ScanStream method, the file contents are scanned just like in the memory-scan case.

\n

Summary

\n

This time, I read through sample code for a custom application that issues scan requests by using the AMSI interface.

","fields":{"slug":"/amsi-create-interface-en","tagSlugs":["/tag/windows/","/tag/anti-virus/","/tag/amsi/","/tag/english/"]},"frontmatter":{"date":"2025-06-28","description":"This article summarizes how a custom application can issue AMSI scan requests.","tags":["Windows","AntiVirus","AMSI","English"],"title":"Issuing AMSI Scan Requests from a Custom Application","socialImage":{"publicURL":"/static/4c95aac07a4438cb8a911e06531b610c/amsi-create-interface.png"}}}},"pageContext":{"slug":"/amsi-create-interface-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}