From 842058b23a5efd0d73c090cc68901aa7ccc05e30 Mon Sep 17 00:00:00 2001
From: Steve Lee <slee@microsoft.com>
Date: Wed, 14 Dec 2022 16:17:42 -0800
Subject: [PATCH 1/2] Hide the console for WinRM remoting (#86)

---
 .../nativemsh/pwrshplugin/pwrshclrhost.cpp                 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp b/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp
index d2e56e5..69068f3 100644
--- a/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp
+++ b/src/powershell-native/nativemsh/pwrshplugin/pwrshclrhost.cpp
@@ -39,6 +39,13 @@ unsigned int PowerShellCoreClrWorker::LaunchClr(
 {
     // Allocate a console so that the codepage is setup correctly
     AllocConsole();
+    HWND console = GetConsoleWindow();
+    if (console != NULL)
+    {
+        // Hide the console window
+        ShowWindow(console, SW_HIDE);
+    }
+
     return commonLib->LaunchCoreCLR(hostWrapper, hostEnvironment, friendlyName);
 }
 

From 8fb8207295b7666747ee09cec18d3902b0eec420 Mon Sep 17 00:00:00 2001
From: Jose Sua <josesua@microsoft.com>
Date: Wed, 4 Jan 2023 14:31:59 -0800
Subject: [PATCH 2/2] Moving amsistate event changed to this repo (#87)

---
 .../PowerShell.Core.Instrumentation.man       | 50 ++++++++++++++++++-
 1 file changed, 48 insertions(+), 2 deletions(-)

diff --git a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
index b1c239b..d879924 100644
--- a/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
+++ b/src/PowerShell.Core.Instrumentation/PowerShell.Core.Instrumentation.man
@@ -2184,6 +2184,18 @@
               value="0x6017"
               version="1"
               />
+            <event
+                channel="C_ANALYTIC"
+                keywords="AmsiState"
+                level="win:Verbose"
+                message="$(string.PS_PROVIDER.event.E_A_AmsiState.message)"
+                opcode="Method"
+                symbol="AmsiState"
+                task="Amsi"
+                template="T_AmsiState"
+                value="0x4001"
+                version="1"
+              />
         </events>
         <channels>
           <!--There are two channels defined for Windows PowerShell instrumentation
@@ -2407,6 +2419,12 @@
               symbol="T_ISEOperation"
               value="120"
               />
+            <task
+                message="$(string.PS_PROVIDER.task.T_AmsiState.message)"
+                name="Amsi"
+                symbol="T_Amsi"
+                value="130"
+              />
         </tasks>
         <opcodes>
           <opcode
@@ -2567,6 +2585,12 @@
               name="PSWorkflow"
               symbol="K_PSWORKFLOW"
               />
+            <keyword
+                mask="0x400"
+                message="$(string.PS_PROVIDER.keyword.K_AmsiState.message)"
+                name="AmsiState"
+                symbol="K_AmsiState"
+              />
         </keywords>
         <maps>
           <!-- please keep in sync with SerializationMethod from
@@ -4024,6 +4048,16 @@
                 name="FileName"
                 />
           </template>
+            <template tid="T_AmsiState">
+                <data
+                    inType="win:UnicodeString"
+                    name="Action"
+                />
+                <data
+                    inType="win:UnicodeString"
+                    name="AmsiContext"
+                />
+            </template>
         </templates>
       </provider>
     </events>
@@ -4917,6 +4951,10 @@
             id="PS_PROVIDER.event.E_O_M3PWorkflowExecutionStarted.message"
             value="Workflow execution started. %n %t WorkflowId: %1 %n %t ManagedNodes: %2"
             />
+          <string
+              id="PS_PROVIDER.event.E_A_AmsiState.message"
+              value="AmsiUtil state. %n %t state: %1 %n %t Context: %2"
+            />
         <string
             id="PS_PROVIDER.event.E_O_M3PEndpointRegistered.message"
             value="A new PowerShell endpoint was registered. %n %t EndpointName: %1 %n %t EndpointType: %2 %n %t RegisteredBy: %3"
@@ -5385,7 +5423,11 @@
             id="PS_PROVIDER.keyword.K_PSWORKFLOW.message"
             value="PSWorkflow Hosting And Execution Layer"
             />
-        <string
+          <string
+              id="PS_PROVIDER.keyword.K_AmsiState.message"
+              value="Amsi state"
+            />
+          <string
             id="PS_PROVIDER.keyword.K_SESSION.message"
             value="All session layer"
             />
@@ -5545,7 +5587,11 @@
             id="PS_PROVIDER.task.T_ISEOperation.message"
             value="PowerShell ISE Operation"
             />
-        <string
+          <string
+              id="PS_PROVIDER.task.T_AmsiState.message"
+              value="Amsi State"
+            />
+          <string
             id="PS_PROVIDER.event.E_O_ISEExecuteScript.message"
             value="Windows PowerShell ISE has started to run script file %1."
             />