{"componentChunkName":"component---src-templates-post-template-js","path":"/amsi-create-provider-en","result":{"data":{"markdownRemark":{"id":"0033a114-3b4d-50b2-8d08-49b24a3992ff","html":"
\n

This page has been machine-translated from the original page.

\n
\n

Following on from an overview of AMSI and how it works and issuing AMSI scan requests from a custom application, this time I will read through the sample code for a provider that processes scan requests using the AMSI interface.

\n

Reference: Windows-classic-samples/Samples/AmsiProvider at main · microsoft/Windows-classic-samples

\n\n

Table of Contents

\n\n

Registering the provider

\n

You can register AmsiProvider.dll, built from the AmsiProvider sample code, on the system with the command regsvr32 AmsiProvider.dll.

\n

This command calls the DllRegisterServer function.

\n

Reference: Implementing DllRegisterServer - Win32 apps | Microsoft Learn

\n

In the sample code, the DllRegisterServer function is implemented as follows, and performs several registry operations required to register the DLL as an AMSI provider.

\n
HRESULT SetKeyStringValue(_In_ HKEY key, _In_opt_ PCWSTR subkey, _In_opt_ PCWSTR valueName, _In_ PCWSTR stringValue)\n{\n    LONG status = RegSetKeyValue(key, subkey, valueName, REG_SZ, stringValue, (wcslen(stringValue) + 1) * sizeof(wchar_t));\n    return HRESULT_FROM_WIN32(status);\n}\n\n\nSTDAPI DllRegisterServer()\n{\n    wchar_t modulePath[MAX_PATH];\n    if (GetModuleFileName(g_currentModule, modulePath, ARRAYSIZE(modulePath)) >= ARRAYSIZE(modulePath))\n    {\n        return E_UNEXPECTED;\n    }\n\n    // Create a standard COM registration for our CLSID.\n    // The class must be registered as \"Both\" threading model\n    // and support multithreaded access.\n    wchar_t clsidString[40];\n    if (StringFromGUID2(__uuidof(SampleAmsiProvider), clsidString, ARRAYSIZE(clsidString)) == 0)\n    {\n        return E_UNEXPECTED;\n    }\n\n    wchar_t keyPath[200];\n    HRESULT hr = StringCchPrintf(keyPath, ARRAYSIZE(keyPath), L\"Software\\\\Classes\\\\CLSID\\\\%ls\", clsidString);\n    if (FAILED(hr)) return hr;\n\n    hr = SetKeyStringValue(HKEY_LOCAL_MACHINE, keyPath, nullptr, L\"SampleAmsiProvider\");\n    if (FAILED(hr)) return hr;\n\n    hr = StringCchPrintf(keyPath, ARRAYSIZE(keyPath), L\"Software\\\\Classes\\\\CLSID\\\\%ls\\\\InProcServer32\", clsidString);\n    if (FAILED(hr)) return hr;\n\n    hr = SetKeyStringValue(HKEY_LOCAL_MACHINE, keyPath, nullptr, modulePath);\n    if (FAILED(hr)) return hr;\n\n    hr = SetKeyStringValue(HKEY_LOCAL_MACHINE, keyPath, L\"ThreadingModel\", L\"Both\");\n    if (FAILED(hr)) return hr;\n\n    // Register this CLSID as an anti-malware provider.\n    hr = StringCchPrintf(keyPath, ARRAYSIZE(keyPath), L\"Software\\\\Microsoft\\\\AMSI\\\\Providers\\\\%ls\", clsidString);\n    if (FAILED(hr)) return hr;\n\n    hr = SetKeyStringValue(HKEY_LOCAL_MACHINE, keyPath, nullptr, L\"SampleAmsiProvider\");\n    if (FAILED(hr)) return hr;\n\n    return S_OK;\n}
\n

This function performs the following registry key operations:

\n
    \n
  1. Using the sample provider’s UUID, {2E5D8A62-77F9-4F7B-A90C-2744820139B2}, it registers the provider name SampleAmsiProvider under HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2E5D8A62-77F9-4F7B-A90C-2744820139B2}.
    2. \n
  2. It adds HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2E5D8A62-77F9-4F7B-A90C-2744820139B2}\\InProcServer32 and registers the file path of the provider DLL.
    3. \n
  3. It also adds a string value named ThreadingModel directly under the same key and sets its value to Both.
    4. \n
\n

\n \n