module Rex::Powershell::Obfu
Constants
- EMPTY_LINE_REGEX
- MULTI_LINE_COMMENTS_REGEX
- SINGLE_LINE_COMMENTS_REGEX
- UNIX_EOL_REGEX
- WHITESPACE_REGEX
- WINDOWS_EOL_REGEX
Public Instance Methods
standard_subs(subs = %w(strip_comments strip_whitespace sub_funcs sub_vars))
click to toggle source
Perform standard substitutions
@return [String] code with standard substitution methods applied
# File lib/rex/powershell/obfu.rb, line 82 def standard_subs(subs = %w(strip_comments strip_whitespace sub_funcs sub_vars)) # Save us the trouble of breaking injected .NET and such subs.delete('strip_whitespace') unless get_string_literals.empty? # Run selected modifiers subs.each do |modifier| send(modifier) end code.gsub!(EMPTY_LINE_REGEX, '') code end
strip_comments()
click to toggle source
Remove comments
@return [String] code without comments
# File lib/rex/powershell/obfu.rb, line 18 def strip_comments # Multi line code.gsub!(MULTI_LINE_COMMENTS_REGEX, '') # Single line code.gsub!(SINGLE_LINE_COMMENTS_REGEX, '') code end
strip_empty_lines()
click to toggle source
Remove empty lines
@return [String] code without empty lines
# File lib/rex/powershell/obfu.rb, line 31 def strip_empty_lines # Windows EOL code.gsub!(WINDOWS_EOL_REGEX, "\r\n") # UNIX EOL code.gsub!(UNIX_EOL_REGEX, "\n") code end
strip_whitespace()
click to toggle source
Remove whitespace This can break some codes using inline .NET
@return [String] code with whitespace stripped
# File lib/rex/powershell/obfu.rb, line 45 def strip_whitespace code.gsub!(WHITESPACE_REGEX, ' ') code end
sub_funcs()
click to toggle source
Identify function names and replace them
@return [String] code with function names replaced with unique
values
# File lib/rex/powershell/obfu.rb, line 69 def sub_funcs # Find out function names, make map get_func_names.each do |var, _sub| code.gsub!(var, @rig.init_var(var)) end code end
sub_vars()
click to toggle source
Identify variables and replace them
@return [String] code with variable names replaced with unique values
# File lib/rex/powershell/obfu.rb, line 55 def sub_vars # Get list of variables, remove reserved get_var_names.each do |var, _sub| code.gsub!(var, "$#{@rig.init_var(var)}") end code end