AMSI_ATTRIBUTE enumeration (amsi.h)
The AMSI_ATTRIBUTE enumeration specifies the types of attributes that can be requested by IAmsiStream::GetAttribute.
Syntax
typedef enum AMSI_ATTRIBUTE {
AMSI_ATTRIBUTE_APP_NAME,
AMSI_ATTRIBUTE_CONTENT_NAME,
AMSI_ATTRIBUTE_CONTENT_SIZE,
AMSI_ATTRIBUTE_CONTENT_ADDRESS,
AMSI_ATTRIBUTE_SESSION,
AMSI_ATTRIBUTE_REDIRECT_CHAIN_SIZE,
AMSI_ATTRIBUTE_REDIRECT_CHAIN_ADDRESS,
AMSI_ATTRIBUTE_ALL_SIZE,
AMSI_ATTRIBUTE_ALL_ADDRESS,
AMSI_ATTRIBUTE_QUIET
} ;
Constants
AMSI_ATTRIBUTE_APP_NAME Return the name, version, or GUID string of the calling application, copied from a LPWSTR. |
AMSI_ATTRIBUTE_CONTENT_NAME Return the filename, URL, unique script ID, or similar of the content, copied from a LPWSTR. |
AMSI_ATTRIBUTE_CONTENT_SIZE Return the size of the input, as a ULONGLONG. |
AMSI_ATTRIBUTE_CONTENT_ADDRESS Return the memory address if the content is fully loaded into memory. |
AMSI_ATTRIBUTE_SESSION Session is used to associate different scan calls, such as if the contents to be scanned belong to the sample original script. Return a PVOID to the next portion of the content to be scanned. Return nullptr if the content is self-contained. |
AMSI_ATTRIBUTE_REDIRECT_CHAIN_SIZE |
AMSI_ATTRIBUTE_REDIRECT_CHAIN_ADDRESS |
AMSI_ATTRIBUTE_ALL_SIZE |
AMSI_ATTRIBUTE_ALL_ADDRESS |
AMSI_ATTRIBUTE_QUIET |
Requirements
Requirement | Value |
---|---|
Minimum supported client | Windows 10 [desktop apps only] |
Minimum supported server | Windows Server 2016 [desktop apps only] |
Header | amsi.h |