Edit

AMSI_ATTRIBUTE enumeration (amsi.h)

  • Article

The AMSI_ATTRIBUTE enumeration specifies the types of attributes that can be requested by IAmsiStream::GetAttribute.

Syntax

typedef enum AMSI_ATTRIBUTE {
  AMSI_ATTRIBUTE_APP_NAME,
  AMSI_ATTRIBUTE_CONTENT_NAME,
  AMSI_ATTRIBUTE_CONTENT_SIZE,
  AMSI_ATTRIBUTE_CONTENT_ADDRESS,
  AMSI_ATTRIBUTE_SESSION,
  AMSI_ATTRIBUTE_REDIRECT_CHAIN_SIZE,
  AMSI_ATTRIBUTE_REDIRECT_CHAIN_ADDRESS,
  AMSI_ATTRIBUTE_ALL_SIZE,
  AMSI_ATTRIBUTE_ALL_ADDRESS,
  AMSI_ATTRIBUTE_QUIET
} ;

Constants

 
AMSI_ATTRIBUTE_APP_NAME
Return the name, version, or GUID string of the calling application, copied from a LPWSTR.
AMSI_ATTRIBUTE_CONTENT_NAME
Return the filename, URL, unique script ID, or similar of the content, copied from a LPWSTR.
AMSI_ATTRIBUTE_CONTENT_SIZE
Return the size of the input, as a ULONGLONG.
AMSI_ATTRIBUTE_CONTENT_ADDRESS
Return the memory address if the content is fully loaded into memory.
AMSI_ATTRIBUTE_SESSION
Session is used to associate different scan calls, such as if the contents to be scanned belong to the sample original script. Return a PVOID to the next portion of the content to be scanned. Return nullptr if the content is self-contained.
AMSI_ATTRIBUTE_REDIRECT_CHAIN_SIZE
AMSI_ATTRIBUTE_REDIRECT_CHAIN_ADDRESS
AMSI_ATTRIBUTE_ALL_SIZE
AMSI_ATTRIBUTE_ALL_ADDRESS
AMSI_ATTRIBUTE_QUIET

Requirements

Requirement Value
Minimum supported client Windows 10 [desktop apps only]
Minimum supported server Windows Server 2016 [desktop apps only]
Header amsi.h