module Rex::Powershell::Obfu

Constants

EMPTY_LINE_REGEX
MULTI_LINE_COMMENTS_REGEX
SINGLE_LINE_COMMENTS_REGEX
UNIX_EOL_REGEX
WHITESPACE_REGEX
WINDOWS_EOL_REGEX

Public Instance Methods

standard_subs(subs = %w(strip_comments strip_whitespace sub_funcs sub_vars)) click to toggle source

Perform standard substitutions

@return [String] code with standard substitution methods applied

# File lib/rex/powershell/obfu.rb, line 82
def standard_subs(subs = %w(strip_comments strip_whitespace sub_funcs sub_vars))
  # Save us the trouble of breaking injected .NET and such
  subs.delete('strip_whitespace') unless get_string_literals.empty?
  # Run selected modifiers
  subs.each do |modifier|
    send(modifier)
  end
  code.gsub!(EMPTY_LINE_REGEX, '')

  code
end
strip_comments() click to toggle source

Remove comments

@return [String] code without comments

# File lib/rex/powershell/obfu.rb, line 18
def strip_comments
  # Multi line
  code.gsub!(MULTI_LINE_COMMENTS_REGEX, '')
  # Single line
  code.gsub!(SINGLE_LINE_COMMENTS_REGEX, '')

  code
end
strip_empty_lines() click to toggle source

Remove empty lines

@return [String] code without empty lines

# File lib/rex/powershell/obfu.rb, line 31
def strip_empty_lines
  # Windows EOL
  code.gsub!(WINDOWS_EOL_REGEX, "\r\n")
  # UNIX EOL
  code.gsub!(UNIX_EOL_REGEX, "\n")

  code
end
strip_whitespace() click to toggle source

Remove whitespace This can break some codes using inline .NET

@return [String] code with whitespace stripped

# File lib/rex/powershell/obfu.rb, line 45
def strip_whitespace
  code.gsub!(WHITESPACE_REGEX, ' ')

  code
end
sub_funcs() click to toggle source

Identify function names and replace them

@return [String] code with function names replaced with unique

values
# File lib/rex/powershell/obfu.rb, line 69
def sub_funcs
  # Find out function names, make map
  get_func_names.each do |var, _sub|
    code.gsub!(var, @rig.init_var(var))
  end

  code
end
sub_vars() click to toggle source

Identify variables and replace them

@return [String] code with variable names replaced with unique values

# File lib/rex/powershell/obfu.rb, line 55
def sub_vars
  # Get list of variables, remove reserved
  get_var_names.each do |var, _sub|
    code.gsub!(var, "$#{@rig.init_var(var)}")
  end

  code
end