mlg's blog

Windows 10 have a new mechanism that will allow software developers to integrate their applications with the antimalware programs exist on users’ computers. The goal of the new Antimalware Scan Interface (AMSI) is to let applications send content to the locally installed antivirus product to be checked for malware. C# sample code is not available in msdn. Here is the sample C# code to communicate with antimalware product installed in your machine. I have Windows Defender installed in my machine and this code communicates to windows defender internally to get the job done. public enum AMSI_RESULT 3: { 4: AMSI_RESULT_CLEAN = 0, 5: AMSI_RESULT_NOT_DETECTED = 1, 6: AMSI_RESULT_DETECTED = 32768 7: } 8: 9: [DllImport("Amsi.dll", EntryPoint = "AmsiInitialize", CallingConvention = CallingConvention.StdCall)] 10: public static extern int AmsiInitialize([MarshalAs(UnmanagedType.LPWStr)]string appName, out IntPtr amsi...

      May be this topic is one the most confusing part in C# and a quick stackoverflow search would return a pretty huge amount of Q&A on this. This writing would be more for my reference as I myself getting confused with this topic overtime and every time I need to do lot of search to get the exact stuffs. So I will consolidate the abstracts here. I will keep the references in the footer so the reader can have a in-depth read on the same. Value Types The typical convention is “ Value types always goes to stack ”. This is an incorrect statement and the statement should be " value types can be stored on the stack and the heap " There are three kinds of storage locations: stack locations, heap locations, and registers. Long-lived objects are always heap locations. Short-lived objects are always stack locations or registers. References and instances of value types are essentially the same thing as far as their storage is concerned; they go on either ...