- install rustup
- install mingw
rustup target add x86_64-pc-windows-gnu
cargo build --target=x86_64-pc-windows-gnu 2>&1
regsvr32.exe <path-to-amsi-provider.dll>
note: this will create the following registry keys,
HKLM\Software\Microsoft\AMSI\Providers\<SID in lib.rs>
HKLM\Software\Classes\CLSID\<SID in lib.rs>
HKLM\Software\Classes\CLSID\<SID in lib.rs>\InprocServer32
see DllRegisterServer
in lib.rs
for more details.
to degister the dll, run the following command,
regsvr32.exe -u <path-to-amsi-provider.dll>
see DllUnregisterServer
in lib.rs
for more details.
- load sigma rules from a file into some data structure