Bypassing AMSI by exploiting amsiContext structure In one of my previous blog I discussed how both the functions AmsiOpenSession and AmsiScanBuffer checks for various conditions before returning. If any of those conditions fail, they will exit out with an error. For example, if we take a look at AmsiOpenSession code we will find that the amsiContext structure is is first checked and then its second and third QWORD are checked.