Patch AMSI in memory before loading tooling

AMSI hands script and .NET content to the registered AV before execution. Because the check runs in your own process, you can neuter it by patching AmsiScanBuffer in amsi.dll so it returns a clean result without scanning.

# resolve the export, flip protection, force AMSI_RESULT_CLEAN
$a=[Ref].Assembly.GetType('System.Management.Automation.Amsi'+'Utils')
$f=$a.GetField('amsi'+'Context','NonPublic,Static')
# common variant: overwrite AmsiScanBuffer prologue with a return of E_INVALIDARG

Confirm the bypass held before staging anything noisy.

'AmsiScanBuffer patched' # if this line ran through a normally-flagged loader, AMSI is down

Pro note: mature EDR watches for the exact patch bytes and for RWX changes on amsi.dll, so hardware breakpoints on AmsiScanBuffer or a fresh, unhooked copy of the DLL are quieter. Patch once per process; every child process needs its own bypass.