> For the complete documentation index, see [llms.txt](https://www.redteam.fail/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.redteam.fail/osep-notes/amsi/amsi-basics.md).

# AMSI Basics

### Introduction

When a process instantiates amsi.dll gets loaded into the process and following are the series of events which occurs during the life of process

**AMSI Life Cycle**

* amsi.dll invokes AmsiInitialize function which basically create amsiContext (AmsiContext will be used in all upcoming api calls)
* When a user enters a command and press enter, AmsiOpenSession will be called which accept the amsicontext and a pointer called amsiSession
  * amsiSession will be used throughout the analysis of that particular command
* After creating the amsiSession, AmsiScanBuffer will be called with the arguments

**AmsiScanBuffer**

\[Syntax]

```csharp
HRESULT AmsiScanBuffer(
  [in]           HAMSICONTEXT amsiContext,
  [in]           PVOID        buffer,
  [in]           ULONG        length,
  [in]           LPCWSTR      contentName,
  [in, optional] HAMSISESSION amsiSession,
  [out]          AMSI_RESULT  *result
);
```

\[Explanation]

* amsiContext: this is the context which is returned from AmsiInitialize function at the time of process creation.
* Buffer: The buffer from which to read the data to be scanned.
* Length: The length, in bytes, of the data to be read from buffer.
* contentName: The filename, URL, unique script ID, or similar of the content being scanned
* amsiSession: The HAMSISESSION handle provided by amsiOpenSession function.
* Result: The result of the scan.
  * 1 = means no malicious activity detected
  * 32768 = means command is malicious