Wrecking AMSI in PowerShell
In the last section, we used reflection to locate vital structures
and variables that, when corrupted, will cause AMSI to be disabled.
In this section, we’ll modify the assembly instructions themselves
instead of the data they are acting upon in a technique known as binary patching.
We can use this technique to hotpatch the code
and force it to fail even if the data structure is valid.