From caee3acaad00c03de1871ecd2e908df65d2a215e Mon Sep 17 00:00:00 2001 From: KingKDot Date: Mon, 10 Feb 2025 18:17:56 -0600 Subject: [PATCH] Add project files. --- .gitattributes | 63 + .gitignore | 363 +++ LICENSE.txt | 201 ++ PowerCrypt.sln | 22 + .../Obfuscator/AntiMethods/AntiAnalysis.cs | 12 + .../Helpers/Compression/CompressString.cs | 65 + .../Obfuscator/Helpers/Encode/EncodeString.cs | 16 + .../Obfuscator/Helpers/Globals/Globals.cs | 27 + .../BareWordOBF.cs | 10 + .../BuiltInQuery.cs | 2456 +++++++++++++++++ .../CommandOBF.cs | 58 + .../Obfuscator/Methods/Counters/Counter.cs | 17 + .../FunctionObfuscation/FunctionOBF.cs | 38 + .../GeneralControlFlowPostOBF/WrapOBF.cs | 38 + PowerCrypt/Obfuscator/Methods/Maps.cs | 12 + .../Methods/MixedBooleanArithmetic/MBAOBF.cs | 110 + .../Obfuscator/Methods/RandomHelper/Helper.cs | 21 + PowerCrypt/Obfuscator/Methods/Replacer.cs | 20 + .../StaticNumberObfuscation/NumberOBF.cs | 72 + .../Methods/StringObfuscation/StringOBF.cs | 140 + ...FStringConstantExpressionAstUnderMember.cs | 31 + .../VariableObfuscation/VariableOBF.cs | 170 ++ PowerCrypt/Obfuscator/Obfuscator.cs | 218 ++ PowerCrypt/Obfuscator/Passes/FirstPass.cs | 232 ++ PowerCrypt/Obfuscator/Passes/FourthPass.cs | 87 + PowerCrypt/Obfuscator/Passes/LastPass.cs | 12 + PowerCrypt/Obfuscator/Passes/PrePass.cs | 100 + PowerCrypt/Obfuscator/Passes/SecondPass.cs | 127 + PowerCrypt/Obfuscator/Passes/ThirdPass.cs | 79 + PowerCrypt/PowerCrypt.csproj | 19 + PowerCrypt/Program.cs | 80 + PowerCrypt/Properties/launchSettings.json | 11 + PowerCrypt/Settings/Settings.cs | 7 + PowerCrypt/new_things.txt | 10 + README.md | 1 + 35 files changed, 4945 insertions(+) create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 LICENSE.txt create mode 100644 PowerCrypt.sln create mode 100644 PowerCrypt/Obfuscator/AntiMethods/AntiAnalysis.cs create mode 100644 PowerCrypt/Obfuscator/Helpers/Compression/CompressString.cs create mode 100644 PowerCrypt/Obfuscator/Helpers/Encode/EncodeString.cs create mode 100644 PowerCrypt/Obfuscator/Helpers/Globals/Globals.cs create mode 100644 PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BareWordOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BuiltInQuery.cs create mode 100644 PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/CommandOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/Counters/Counter.cs create mode 100644 PowerCrypt/Obfuscator/Methods/FunctionObfuscation/FunctionOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/GeneralControlFlowPostOBF/WrapOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/Maps.cs create mode 100644 PowerCrypt/Obfuscator/Methods/MixedBooleanArithmetic/MBAOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/RandomHelper/Helper.cs create mode 100644 PowerCrypt/Obfuscator/Methods/Replacer.cs create mode 100644 PowerCrypt/Obfuscator/Methods/StaticNumberObfuscation/NumberOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBF.cs create mode 100644 PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBFStringConstantExpressionAstUnderMember.cs create mode 100644 PowerCrypt/Obfuscator/Methods/VariableObfuscation/VariableOBF.cs create mode 100644 PowerCrypt/Obfuscator/Obfuscator.cs create mode 100644 PowerCrypt/Obfuscator/Passes/FirstPass.cs create mode 100644 PowerCrypt/Obfuscator/Passes/FourthPass.cs create mode 100644 PowerCrypt/Obfuscator/Passes/LastPass.cs create mode 100644 PowerCrypt/Obfuscator/Passes/PrePass.cs create mode 100644 PowerCrypt/Obfuscator/Passes/SecondPass.cs create mode 100644 PowerCrypt/Obfuscator/Passes/ThirdPass.cs create mode 100644 PowerCrypt/PowerCrypt.csproj create mode 100644 PowerCrypt/Program.cs create mode 100644 PowerCrypt/Properties/launchSettings.json create mode 100644 PowerCrypt/Settings/Settings.cs create mode 100644 PowerCrypt/new_things.txt create mode 100644 README.md diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..1ff0c42 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,63 @@ +############################################################################### +# Set default behavior to automatically normalize line endings. +############################################################################### +* text=auto + +############################################################################### +# Set default behavior for command prompt diff. +# +# This is need for earlier builds of msysgit that does not have it on by +# default for csharp files. +# Note: This is only used by command line +############################################################################### +#*.cs diff=csharp + +############################################################################### +# Set the merge driver for project and solution files +# +# Merging from the command prompt will add diff markers to the files if there +# are conflicts (Merging from VS is not affected by the settings below, in VS +# the diff markers are never inserted). Diff markers may cause the following +# file extensions to fail to load in VS. An alternative would be to treat +# these files as binary and thus will always conflict and require user +# intervention with every merge. To do so, just uncomment the entries below +############################################################################### +#*.sln merge=binary +#*.csproj merge=binary +#*.vbproj merge=binary +#*.vcxproj merge=binary +#*.vcproj merge=binary +#*.dbproj merge=binary +#*.fsproj merge=binary +#*.lsproj merge=binary +#*.wixproj merge=binary +#*.modelproj merge=binary +#*.sqlproj merge=binary +#*.wwaproj merge=binary + +############################################################################### +# behavior for image files +# +# image files are treated as binary by default. +############################################################################### +#*.jpg binary +#*.png binary +#*.gif binary + +############################################################################### +# diff behavior for common document formats +# +# Convert binary document formats to text before diffing them. This feature +# is only available from the command line. Turn it on by uncommenting the +# entries below. +############################################################################### +#*.doc diff=astextplain +#*.DOC diff=astextplain +#*.docx diff=astextplain +#*.DOCX diff=astextplain +#*.dot diff=astextplain +#*.DOT diff=astextplain +#*.pdf diff=astextplain +#*.PDF diff=astextplain +#*.rtf diff=astextplain +#*.RTF diff=astextplain diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9491a2f --- /dev/null +++ b/.gitignore @@ -0,0 +1,363 @@ +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +bld/ +[Bb]in/ +[Oo]bj/ +[Oo]ut/ +[Ll]og/ +[Ll]ogs/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd \ No newline at end of file diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..261eeb9 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/PowerCrypt.sln b/PowerCrypt.sln new file mode 100644 index 0000000..9cb865d --- /dev/null +++ b/PowerCrypt.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.12.35527.113 d17.12 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "PowerCrypt", "PowerCrypt\PowerCrypt.csproj", "{16EE4D35-7769-403C-9A76-EC7AD55DE37B}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {16EE4D35-7769-403C-9A76-EC7AD55DE37B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {16EE4D35-7769-403C-9A76-EC7AD55DE37B}.Debug|Any CPU.Build.0 = Debug|Any CPU + {16EE4D35-7769-403C-9A76-EC7AD55DE37B}.Release|Any CPU.ActiveCfg = Release|Any CPU + {16EE4D35-7769-403C-9A76-EC7AD55DE37B}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/PowerCrypt/Obfuscator/AntiMethods/AntiAnalysis.cs b/PowerCrypt/Obfuscator/AntiMethods/AntiAnalysis.cs new file mode 100644 index 0000000..a989638 --- /dev/null +++ b/PowerCrypt/Obfuscator/AntiMethods/AntiAnalysis.cs @@ -0,0 +1,12 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Threading.Tasks; + +namespace PowerCrypt.Obfuscator.AntiMethods +{ + public class AntiAnalysis + { + } +} diff --git a/PowerCrypt/Obfuscator/Helpers/Compression/CompressString.cs b/PowerCrypt/Obfuscator/Helpers/Compression/CompressString.cs new file mode 100644 index 0000000..16d9660 --- /dev/null +++ b/PowerCrypt/Obfuscator/Helpers/Compression/CompressString.cs @@ -0,0 +1,65 @@ +using System.IO.Compression; +using System.Text; + +namespace PowerCrypt.Obfuscator.Helpers.Compression +{ + public class CompressString + { + public static string CompressPowershellCode(string input) + { + string compressed = Compress(input); + + return $"iex([System.Text.Encoding]::UTF8.GetString([System.IO.Compression.GZipStream]::new([System.IO.MemoryStream]::new([Convert]::FromBase64String(\"{compressed}\")), [System.IO.Compression.CompressionMode]::Decompress).ToArray()))"; + } + + private static string Decompress(string input) + { + byte[] compressed = Convert.FromBase64String(input); + byte[] decompressed = Decompress(compressed); + return Encoding.UTF8.GetString(decompressed); + } + + private static string Compress(string input) + { + byte[] encoded = Encoding.UTF8.GetBytes(input); + byte[] compressed = Compress(encoded); + return Convert.ToBase64String(compressed); + } + + private static byte[] Decompress(byte[] input) + { + using (var source = new MemoryStream(input)) + { + byte[] lengthBytes = new byte[4]; + source.Read(lengthBytes, 0, 4); + + var length = BitConverter.ToInt32(lengthBytes, 0); + using (var decompressionStream = new GZipStream(source, + CompressionMode.Decompress)) + { + var result = new byte[length]; + decompressionStream.ReadExactly(result, 0, length); + return result; + } + } + } + + private static byte[] Compress(byte[] input) + { + using (var result = new MemoryStream()) + { + var lengthBytes = BitConverter.GetBytes(input.Length); + result.Write(lengthBytes, 0, 4); + + using (var compressionStream = new GZipStream(result, + CompressionMode.Compress)) + { + compressionStream.Write(input, 0, input.Length); + compressionStream.Flush(); + + } + return result.ToArray(); + } + } + } +} diff --git a/PowerCrypt/Obfuscator/Helpers/Encode/EncodeString.cs b/PowerCrypt/Obfuscator/Helpers/Encode/EncodeString.cs new file mode 100644 index 0000000..ead4815 --- /dev/null +++ b/PowerCrypt/Obfuscator/Helpers/Encode/EncodeString.cs @@ -0,0 +1,16 @@ +using PowerCrypt.Obfuscator.Methods.CommandTypeAndBareWordObfuscation; +using System.Text; + +namespace PowerCrypt.Obfuscator.Helpers.Encode +{ + public class EncodeString + { + public static string Encode(string str) + { + string base64Encoded = Convert.ToBase64String(Encoding.UTF8.GetBytes(str)); + string iexCommandObfuscated = CommandOBF.ObfuscateCommand("Invoke-Expression"); + + return $"{iexCommandObfuscated}([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('{base64Encoded}')))"; + } + } +} diff --git a/PowerCrypt/Obfuscator/Helpers/Globals/Globals.cs b/PowerCrypt/Obfuscator/Helpers/Globals/Globals.cs new file mode 100644 index 0000000..f7055a3 --- /dev/null +++ b/PowerCrypt/Obfuscator/Helpers/Globals/Globals.cs @@ -0,0 +1,27 @@ +using System.Net.NetworkInformation; + +namespace PowerCrypt.Obfuscator.Helpers.globals +{ + public static class Globals + { + public static string CompressFunctionName { get; set; } = string.Empty; + public static List UsedVariables { get; set; } = new List(); + public static List UsedFunctions { get; set; } = new List(); + + public static void AddUsedVariable(string variableName) + { + if (!UsedVariables.Contains(variableName)) + { + UsedVariables.Add(variableName); + } + } + + public static void AddUsedFunction(string functionName) + { + if (!UsedFunctions.Contains(functionName)) + { + UsedFunctions.Add(functionName); + } + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BareWordOBF.cs b/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BareWordOBF.cs new file mode 100644 index 0000000..21367c6 --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BareWordOBF.cs @@ -0,0 +1,10 @@ +namespace PowerCrypt.Obfuscator.Methods.CommandTypeAndBareWordObfuscation +{ + public class CommandTypeAndBareWordObfuscation + { + public static string Obfuscate(string input) + { + return ""; + } + } +} \ No newline at end of file diff --git a/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BuiltInQuery.cs b/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BuiltInQuery.cs new file mode 100644 index 0000000..6ed3a20 --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/BuiltInQuery.cs @@ -0,0 +1,2456 @@ +namespace PowerCrypt.Obfuscator.Methods.BareWordObfuscation +{ + public class BuiltInQuery + { + public static readonly HashSet BuiltInFunctions = new HashSet + { + "a:", + "add-appprovisionedsharedpackagecontainer", + "add-appsharedpackagecontainer", + "add-appvclientconnectiongroup", + "add-appvclientpackage", + "add-appvpublishingserver", + "add-appxpackage", + "add-appxprovisionedpackage", + "add-appxvolume", + "add-bcdatacacheextension", + "add-bitlockerkeyprotector", + "add-bitsfile", + "add-certificateenrollmentpolicyserver", + "add-computer", + "add-content", + "ac", + "add-apppackage", + "add-apppackagevolume", + "add-appprovisionedpackage", + "add-provisionedapppackage", + "add-provisionedappsharedpackagecontainer", + "add-provisionedappxpackage", + "add-provisioningpackage", + "add-trustedprovisioningcertificate", + "algm", + "apply-windowsunattend", + "add-dnsclientdohserveraddress", + "add-dnsclientnrptrule", + "add-dtcclustertmmapping", + "add-etwtraceprovider", + "add-history", + "add-initiatoridtomaskingset", + "add-jobtrigger", + "add-kdsrootkey", + "add-localgroupmember", + "add-member", + "add-mppreference", + "add-neteventnetworkadapter", + "add-neteventpacketcaptureprovider", + "add-neteventprovider", + "add-neteventvfpprovider", + "add-neteventvmnetworkadapter", + "add-neteventvmswitch", + "add-neteventvmswitchprovider", + "add-neteventwfpcaptureprovider", + "add-netiphttpscertbinding", + "add-netlbfoteammember", + "add-netlbfoteamnic", + "add-netnatexternaladdress", + "add-netnatstaticmapping", + "add-netswitchteammember", + "add-odbcdsn", + "add-partitionaccesspath", + "add-physicaldisk", + "add-printer", + "add-printerdriver", + "add-printerport", + "add-pssnapin", + "asnp", + "blsmba", + "blsmbclas", + "add-rolemember", + "add-signerrule", + "add-sqlavailabilitydatabase", + "add-sqlavailabilitygrouplistenerstaticip", + "add-sqlazureauthenticationcontext", + "add-sqlcolumnencryptionkeyvalue", + "add-sqllogin", + "add-storagefaultdomain", + "add-targetporttomaskingset", + "add-terminaliconscolortheme", + "add-terminaliconsicontheme", + "add-type", + "add-virtualdisktomaskingset", + "add-vmassignabledevice", + "add-vmdirectvirtualdisk", + "add-vmdvddrive", + "add-vmfibrechannelhba", + "add-vmgpupartitionadapter", + "add-vmgroupmember", + "add-vmharddiskdrive", + "add-vmhostassignabledevice", + "add-vmkeystoragedrive", + "add-vmmigrationnetwork", + "add-vmnetworkadapter", + "add-vmnetworkadapteracl", + "add-vmnetworkadapterextendedacl", + "add-vmnetworkadapterroutingdomainmapping", + "add-vmpmemcontroller", + "add-vmremotefx3dvideoadapter", + "add-vmscsicontroller", + "add-vmstoragepath", + "add-vmswitch", + "add-vmswitchextensionportfeature", + "add-vmswitchextensionswitchfeature", + "add-vmswitchteammember", + "add-vpnconnection", + "add-vpnconnectionroute", + "add-vpnconnectiontriggerapplication", + "add-vpnconnectiontriggerdnsconfiguration", + "add-vpnconnectiontriggertrustednetwork", + "add-windowscapability", + "add-windowsdriver", + "add-windowsimage", + "add-windowspackage", + "afterall", + "aftereach", + "assert-mockcalled", + "assert-verifiablemocks", + "b:", + "backup-asdatabase", + "backup-bitlockerkeyprotector", + "backup-sqldatabase", + "backuptoaad-bitlockerkeyprotector", + "beforeall", + "beforeeach", + "block-fileshareaccess", + "block-smbclientaccesstoserver", + "block-smbshareaccess", + "c:", + "checkpoint-computer", + "checkpoint-vm", + "clear-assignedaccess", + "clear-bccache", + "clear-bitlockerautounlock", + "clear-content", + "clc", + "clear-disk", + "clear-dnsclientcache", + "clear-eventlog", + "clear-filestoragetier", + "clear-history", + "clhy", + "clear-host", + "clear", + "cls", + "clear-item", + "cli", + "clear-itemproperty", + "clp", + "clear-kdscache", + "clear-pcsvdevicelog", + "clear-recyclebin", + "clear-storagebusdisk", + "clear-storagediagnosticinfo", + "clear-tpm", + "clear-uevappxpackage", + "clear-uevconfiguration", + "clear-variable", + "clv", + "cmpcfg", + "clear-windowscorruptmountpoint", + "close-smbopenfile", + "close-smbsession", + "compare-object", + "compare", + "diff", + "compare-vm", + "complete-bitstransfer", + "complete-dtcdiagnostictransaction", + "complete-sqlcolumnmasterkeyrotation", + "complete-transaction", + "complete-vmfailover", + "compress-archive", + "configuration", + "confirm-securebootuefi", + "connect-iscsitarget", + "connect-pssession", + "cnsn", + "connect-virtualdisk", + "connect-vmnetworkadapter", + "connect-vmsan", + "connect-wsman", + "context", + "convertfrom-cipolicy", + "convertfrom-csv", + "convertfrom-encodedsqlname", + "convertfrom-json", + "convertfrom-sddlstring", + "convertfrom-securestring", + "convertfrom-string", + "cfs", + "convertfrom-stringdata", + "convert-path", + "cvpa", + "convert-string", + "convertto-csv", + "convertto-encodedsqlname", + "convertto-hgskeyprotector", + "convertto-html", + "convertto-json", + "convertto-processmitigationpolicy", + "convertto-securestring", + "convertto-tpmownerauth", + "convertto-xml", + "convert-urntopath", + "convert-vhd", + "copy-bcdentry", + "copy-item", + "copy", + "cp", + "cpi", + "copy-itemproperty", + "cpp", + "cssmbo", + "cssmbse", + "copy-netfirewallrule", + "copy-netipsecmainmodecryptoset", + "copy-netipsecmainmoderule", + "copy-netipsecphase1authset", + "copy-netipsecphase2authset", + "copy-netipsecquickmodecryptoset", + "copy-netipsecrule", + "copy-userinternationalsettingstosystem", + "copy-vmfile", + "d:", + "debug-fileshare", + "debug-job", + "debug-mmappprelaunch", + "debug-process", + "debug-runspace", + "debug-storagesubsystem", + "debug-vm", + "debug-volume", + "delete-deliveryoptimizationcache", + "describe", + "disable-appbackgroundtaskdiagnosticlog", + "disable-appv", + "disable-appvclientconnectiongroup", + "disable-bc", + "disable-bcdelementbootdebug", + "disable-bcdelementbootems", + "disable-bcdelementdebug", + "disable-bcdelementems", + "disable-bcdelementeventlogging", + "disable-bcdelementhypervisordebug", + "disable-bcdowngrading", + "disable-bcserveonbattery", + "disable-bitlocker", + "disable-bitlockerautounlock", + "disable-computerrestore", + "disable-damanualentrypointselection", + "disable-deliveryoptimizationverboselogs", + "disable-dscdebug", + "disable-jobtrigger", + "disable-localuser", + "disable-mmagent", + "disable-netadapter", + "disable-netadapterbinding", + "disable-netadapterchecksumoffload", + "disable-netadapterencapsulatedpackettaskoffload", + "disable-netadapteripsecoffload", + "disable-netadapterlso", + "disable-netadapterpacketdirect", + "disable-netadapterpowermanagement", + "disable-netadapterqos", + "disable-netadapterrdma", + "disable-netadapterrsc", + "disable-netadapterrss", + "disable-netadaptersriov", + "disable-netadapteruso", + "disable-netadaptervmq", + "disable-netdnstransitionconfiguration", + "disable-netfirewallhypervrule", + "disable-netfirewallrule", + "disable-netiphttpsprofile", + "disable-netipsecmainmoderule", + "disable-netipsecrule", + "disable-netnattransitionconfiguration", + "disable-networkswitchethernetport", + "disable-networkswitchfeature", + "disable-networkswitchvlan", + "disable-odbcperfcounter", + "disable-physicaldiskidentification", + "disable-pnpdevice", + "disable-psbreakpoint", + "dbp", + "decode-sqlname", + "disable-psremoting", + "disable-pssessionconfiguration", + "disable-pstrace", + "disable-pswsmancombinedtrace", + "disable-runspacedebug", + "disable-scheduledjob", + "disable-scheduledtask", + "disable-smbdelegation", + "disable-sqlalwayson", + "disable-storagebuscache", + "disable-storagebusdisk", + "disable-storagedatacollection", + "disable-storageenclosureidentification", + "disable-storageenclosurepower", + "disable-storagehighavailability", + "disable-storagemaintenancemode", + "disable-tlsciphersuite", + "disable-tlsecccurve", + "disable-tlssessionticketkey", + "disable-tpmautoprovisioning", + "disable-uev", + "disable-uevappxpackage", + "disable-uevtemplate", + "disable-vmconsolesupport", + "disable-vmeventing", + "disable-vmintegrationservice", + "disable-vmmigration", + "disable-vmremotefxphysicalvideoadapter", + "disable-vmresourcemetering", + "disable-vmswitchextension", + "disable-vmtpm", + "disable-wdacbidtrace", + "disable-windowserrorreporting", + "disable-windowsoptionalfeature", + "disable-wsmancredssp", + "disable-wsmantrace", + "disconnect-iscsitarget", + "disconnect-pssession", + "dnsn", + "dsmbd", + "disconnect-virtualdisk", + "disconnect-vmnetworkadapter", + "disconnect-vmsan", + "disconnect-wsman", + "dismount-appxvolume", + "dismount-diskimage", + "dismount-vhd", + "dismount-vmhostassignabledevice", + "dismount-windowsimage", + "e:", + "edit-cipolicyrule", + "enable-appbackgroundtaskdiagnosticlog", + "enable-appv", + "enable-appvclientconnectiongroup", + "enable-bcdelementbootdebug", + "enable-bcdelementbootems", + "enable-bcdelementdebug", + "enable-bcdelementems", + "enable-bcdelementeventlogging", + "enable-bcdelementhypervisordebug", + "enable-bcdistributed", + "enable-bcdowngrading", + "enable-bchostedclient", + "enable-bchostedserver", + "enable-bclocal", + "enable-bcserveonbattery", + "enable-bitlocker", + "enable-bitlockerautounlock", + "enable-computerrestore", + "enable-damanualentrypointselection", + "enable-deliveryoptimizationverboselogs", + "enable-dscdebug", + "enable-jobtrigger", + "enable-localuser", + "enable-mmagent", + "enable-netadapter", + "enable-netadapterbinding", + "enable-netadapterchecksumoffload", + "enable-netadapterencapsulatedpackettaskoffload", + "enable-netadapteripsecoffload", + "enable-netadapterlso", + "enable-netadapterpacketdirect", + "enable-netadapterpowermanagement", + "enable-netadapterqos", + "enable-netadapterrdma", + "enable-netadapterrsc", + "enable-netadapterrss", + "enable-netadaptersriov", + "enable-netadapteruso", + "enable-netadaptervmq", + "enable-netdnstransitionconfiguration", + "enable-netfirewallhypervrule", + "enable-netfirewallrule", + "enable-netiphttpsprofile", + "enable-netipsecmainmoderule", + "enable-netipsecrule", + "enable-netnattransitionconfiguration", + "enable-networkswitchethernetport", + "enable-networkswitchfeature", + "enable-networkswitchvlan", + "enable-odbcperfcounter", + "enable-physicaldiskidentification", + "enable-pnpdevice", + "enable-poshlineerror", + "enable-poshtooltips", + "enable-poshtransientprompt", + "enable-psbreakpoint", + "ebp", + "enable-psremoting", + "enable-pssessionconfiguration", + "enable-pstrace", + "enable-pswsmancombinedtrace", + "enable-runspacedebug", + "enable-scheduledjob", + "enable-scheduledtask", + "enable-smbdelegation", + "enable-sqlalwayson", + "enable-storagebuscache", + "enable-storagebusdisk", + "enable-storagedatacollection", + "enable-storageenclosureidentification", + "enable-storageenclosurepower", + "enable-storagehighavailability", + "enable-storagemaintenancemode", + "enable-tlsciphersuite", + "enable-tlsecccurve", + "enable-tlssessionticketkey", + "enable-tpmautoprovisioning", + "enable-uev", + "enable-uevappxpackage", + "enable-uevtemplate", + "enable-vmconsolesupport", + "enable-vmeventing", + "enable-vmintegrationservice", + "enable-vmmigration", + "enable-vmremotefxphysicalvideoadapter", + "enable-vmreplication", + "enable-vmresourcemetering", + "enable-vmswitchextension", + "enable-vmtpm", + "enable-wdacbidtrace", + "enable-windowserrorreporting", + "enable-windowsoptionalfeature", + "enable-wsmancredssp", + "enable-wsmantrace", + "enter-pshostprocess", + "enter-pssession", + "etsn", + "export-vmcheckpoint", + "export-vmcheckpoint", + "exit-pshostprocess", + "exit-pssession", + "exsn", + "expand-archive", + "expand-windowscustomdataimage", + "expand-windowsimage", + "export-alias", + "epal", + "export-bccachepackage", + "export-bcdstore", + "export-bcsecretkey", + "export-binarymilog", + "export-certificate", + "export-clixml", + "export-commandlist", + "export-console", + "export-counter", + "export-csv", + "epcsv", + "export-formatdata", + "export-hgsguardian", + "export-modulemember", + "export-odataendpointproxy", + "export-pfxcertificate", + "export-poshtheme", + "export-provisioningpackage", + "export-pssession", + "epsn", + "export-scheduledtask", + "export-sqlvulnerabilityassessmentbaselineset", + "export-sqlvulnerabilityassessmentscan", + "export-startlayout", + "export-startlayoutedgeassets", + "export-tlssessionticketkey", + "export-trace", + "export-uevconfiguration", + "export-uevpackage", + "export-vm", + "export-vmsnapshot", + "export-windowscapabilitysource", + "export-windowsdriver", + "export-windowsimage", + "export-winhttpproxy", + "f:", + "find-command", + "find-dscresource", + "find-lapsadextendedrights", + "find-module", + "find-netipsecrule", + "find-netroute", + "find-package", + "find-packageprovider", + "find-rolecapability", + "find-script", + "flush-etwtracesession", + "foreach-object", + "%", + "foreach", + "format-custom", + "fc", + "format-hex", + "fhx", + "fimo", + "fimo", + "format-list", + "fl", + "flush-volume", + "flush-volume", + "format-securebootuefi", + "format-table", + "ft", + "format-terminalicons", + "format-volume", + "format-wide", + "fw", + "g:", + "get-acl", + "get-alias", + "gal", + "get-appbackgroundtask", + "get-applockerfileinformation", + "get-applockerpolicy", + "get-appprovisionedsharedpackagecontainer", + "get-appsharedpackagecontainer", + "get-appvclientapplication", + "get-appvclientconfiguration", + "get-appvclientconnectiongroup", + "get-appvclientmode", + "get-appvclientpackage", + "get-appvpublishingserver", + "get-appvstatus", + "get-appvvirtualprocess", + "get-appxdefaultvolume", + "get-appxlasterror", + "get-appxlog", + "get-appxpackage", + "get-appxpackageautoupdatesettings", + "get-appxpackagemanifest", + "get-appxprovisionedpackage", + "get-appxvolume", + "get-assignedaccess", + "get-authenticodesignature", + "get-autologgerconfig", + "get-bcclientconfiguration", + "get-bccontentserverconfiguration", + "get-bcdatacache", + "get-bcdatacacheextension", + "get-bcdentry", + "get-bcdentrydebugsettings", + "get-bcdentryhypervisorsettings", + "get-bcdstore", + "get-bchashcache", + "get-bchostedcacheserverconfiguration", + "get-bcnetworkconfiguration", + "get-bcstatus", + "get-bitlockervolume", + "get-bitstransfer", + "get-certificate", + "get-certificateautoenrollmentpolicy", + "get-certificateenrollmentpolicyserver", + "get-certificatenotificationtask", + "get-childitem", + "dir", + "disable-physicaldiskindication", + "disable-physicaldiskindication", + "disable-storagediagnosticlog", + "disable-storagediagnosticlog", + "dismount-apppackagevolume", + "dlu", + "gci", + "gcim", + "gcls", + "ls", + "get-cimassociatedinstance", + "get-cimclass", + "get-ciminstance", + "get-cimsession", + "get-cipolicy", + "get-cipolicyidinfo", + "get-cipolicyinfo", + "get-clipboard", + "gcb", + "gcfg", + "gcfgs", + "get-clusteredscheduledtask", + "get-cmsmessage", + "get-command", + "gcm", + "gcms", + "get-computerinfo", + "gin", + "gip", + "get-computerrestorepoint", + "get-content", + "cat", + "gc", + "gcai", + "type", + "udsmbmc", + "ulsmba", + "ulsmbclas", + "upcfg", + "upmo", + "upmo", + "get-controlpanelitem", + "get-counter", + "get-credential", + "get-credsfromcredentialprovider", + "get-culture", + "get-daclientexperienceconfiguration", + "get-daconnectionstatus", + "get-daentrypointtableitem", + "get-dapolicychange", + "get-date", + "get-dedupproperties", + "get-deliveryoptimizationlog", + "get-deliveryoptimizationloganalysis", + "get-deliveryoptimizationperfsnap", + "get-deliveryoptimizationperfsnapthismonth", + "get-deliveryoptimizationstatus", + "get-disk", + "get-diskimage", + "get-diskstoragenodeview", + "get-dnsclient", + "get-dnsclientcache", + "get-dnsclientdohserveraddress", + "get-dnsclientglobalsetting", + "get-dnsclientnrptglobal", + "get-dnsclientnrptpolicy", + "get-dnsclientnrptrule", + "get-dnsclientserveraddress", + "get-doconfig", + "get-dodownloadmode", + "get-dopercentagemaxbackgroundbandwidth", + "get-dopercentagemaxforegroundbandwidth", + "get-dscconfiguration", + "get-dscconfigurationstatus", + "get-dsclocalconfigurationmanager", + "get-dscresource", + "get-dtc", + "get-dtcadvancedhostsetting", + "get-dtcadvancedsetting", + "get-dtcclusterdefault", + "get-dtcclustertmmapping", + "get-dtcdefault", + "get-dtclog", + "get-dtcnetworksetting", + "get-dtctransaction", + "get-dtctransactionsstatistics", + "get-dtctransactionstracesession", + "get-dtctransactionstracesetting", + "get-etwtraceprovider", + "get-etwtracesession", + "get-event", + "get-eventlog", + "get-eventsubscriber", + "get-executionpolicy", + "get-filehash", + "get-fileintegrity", + "get-fileshare", + "get-fileshareaccesscontrolentry", + "get-filestoragetier", + "get-formatdata", + "get-help", + "get-hgsattestationbaselinepolicy", + "get-hgsclientconfiguration", + "get-hgsclienthostkey", + "get-hgsguardian", + "get-hgstrace", + "get-hgstracefiledata", + "get-history", + "ghy", + "h", + "history", + "icim", + "get-hnsendpoint", + "get-hnsendpointaddresses", + "get-hnsendpointstats", + "get-hnsnamespace", + "get-hnsnetwork", + "get-hnspolicylist", + "get-host", + "get-hotfix", + "get-initiatorid", + "get-initiatorport", + "get-installedlanguage", + "get-installedmodule", + "get-installedscript", + "get-iscsiconnection", + "get-iscsisession", + "get-iscsitarget", + "get-iscsitargetportal", + "get-isesnippet", + "get-item", + "gi", + "get-itemproperty", + "gp", + "get-itempropertyvalue", + "gpv", + "get-job", + "gjb", + "get-jobtrigger", + "get-kdsconfiguration", + "get-kdsrootkey", + "get-lapsaadpassword", + "get-lapsadpassword", + "get-lapsdiagnostics", + "get-localgroup", + "get-localgroupmember", + "get-localuser", + "get-location", + "gl", + "glcm", + "glg", + "glgm", + "glu", + "pwd", + "get-logproperties", + "get-maskingset", + "get-member", + "gm", + "get-mmagent", + "get-mockdynamicparameters", + "get-module", + "gmo", + "get-mpbehavioralnetworkblockingrules", + "get-mpcomputerstatus", + "get-mpperformancereport", + "get-mppreference", + "get-mpthreat", + "get-mpthreatcatalog", + "get-mpthreatdetection", + "get-ncsipolicyconfiguration", + "get-net6to4configuration", + "get-netadapter", + "get-netadapteradvancedproperty", + "get-netadapterbinding", + "get-netadapterchecksumoffload", + "get-netadapterdatapathconfiguration", + "get-netadapterencapsulatedpackettaskoffload", + "get-netadapterhardwareinfo", + "get-netadapteripsecoffload", + "get-netadapterlso", + "get-netadapterpacketdirect", + "get-netadapterpowermanagement", + "get-netadapterqos", + "get-netadapterrdma", + "get-netadapterrsc", + "get-netadapterrss", + "get-netadaptersriov", + "get-netadaptersriovvf", + "get-netadapterstatistics", + "get-netadapteruso", + "get-netadaptervmq", + "get-netadaptervmqqueue", + "get-netadaptervport", + "get-netcompartment", + "get-netconnectionprofile", + "get-netdnstransitionconfiguration", + "get-netdnstransitionmonitoring", + "get-neteventnetworkadapter", + "get-neteventpacketcaptureprovider", + "get-neteventprovider", + "get-neteventsession", + "get-neteventvfpprovider", + "get-neteventvmnetworkadapter", + "get-neteventvmswitch", + "get-neteventvmswitchprovider", + "get-neteventwfpcaptureprovider", + "get-netfirewalladdressfilter", + "get-netfirewallapplicationfilter", + "get-netfirewalldynamickeywordaddress", + "get-netfirewallhypervport", + "get-netfirewallhypervprofile", + "get-netfirewallhypervrule", + "get-netfirewallhypervvmcreator", + "get-netfirewallhypervvmsetting", + "get-netfirewallinterfacefilter", + "get-netfirewallinterfacetypefilter", + "get-netfirewallportfilter", + "get-netfirewallprofile", + "get-netfirewallrule", + "get-netfirewallsecurityfilter", + "get-netfirewallservicefilter", + "get-netfirewallsetting", + "get-netipaddress", + "get-netipconfiguration", + "get-netiphttpsconfiguration", + "get-netiphttpsstate", + "get-netipinterface", + "get-netipsecdospsetting", + "get-netipsecmainmodecryptoset", + "get-netipsecmainmoderule", + "get-netipsecmainmodesa", + "get-netipsecphase1authset", + "get-netipsecphase2authset", + "get-netipsecquickmodecryptoset", + "get-netipsecquickmodesa", + "get-netipsecrule", + "get-netipv4protocol", + "get-netipv6protocol", + "get-netisatapconfiguration", + "get-netlbfoteam", + "get-netlbfoteammember", + "get-netlbfoteamnic", + "get-netnat", + "get-netnatexternaladdress", + "get-netnatglobal", + "get-netnatsession", + "get-netnatstaticmapping", + "get-netnattransitionconfiguration", + "get-netnattransitionmonitoring", + "get-netneighbor", + "get-netoffloadglobalsetting", + "get-netprefixpolicy", + "get-netqospolicy", + "get-netroute", + "get-netswitchteam", + "get-netswitchteammember", + "get-nettcpconnection", + "get-nettcpsetting", + "get-netteredoconfiguration", + "get-netteredostate", + "get-nettransportfilter", + "get-netudpendpoint", + "get-netudpsetting", + "get-netview", + "get-networkswitchethernetport", + "get-networkswitchfeature", + "get-networkswitchglobaldata", + "get-networkswitchvlan", + "get-nonremovableappspolicy", + "get-odbcdriver", + "get-odbcdsn", + "get-odbcperfcounter", + "get-offloaddatatransfersetting", + "get-operationvalidation", + "get-package", + "get-packageprovider", + "get-packagesource", + "get-partition", + "get-partitionsupportedsize", + "get-pcsvdevice", + "get-pcsvdevicelog", + "get-pfxcertificate", + "get-pfxdata", + "get-physicaldisk", + "get-physicaldiskstoragenodeview", + "get-physicalextent", + "get-physicalextentassociation", + "get-pmemdedicatedmemory", + "get-pmemdisk", + "get-pmemphysicaldevice", + "get-pmemunusedregion", + "get-pnpdevice", + "get-pnpdeviceproperty", + "get-poshstackcount", + "get-poshthemes", + "get-printconfiguration", + "get-printer", + "get-printerdriver", + "get-printerport", + "get-printerproperty", + "get-printjob", + "get-process", + "gps", + "ps", + "pumo", + "pumo", + "get-processmitigation", + "get-provisioningpackage", + "get-psbreakpoint", + "gbp", + "get-pscallstack", + "gcs", + "get-psdrive", + "gdr", + "get-apppackage", + "get-apppackageautoupdatesettings", + "get-apppackagedefaultvolume", + "get-apppackagelasterror", + "get-apppackagelog", + "get-apppackagemanifest", + "get-apppackagevolume", + "get-appprovisionedpackage", + "get-disksnv", + "get-disksnv", + "get-language", + "get-physicaldisksnv", + "get-physicaldisksnv", + "get-preferredlanguage", + "get-provisionedapppackage", + "get-provisionedappsharedpackagecontainer", + "get-provisionedappxpackage", + "get-storageenclosuresnv", + "get-storageenclosuresnv", + "get-systemlanguage", + "get-vmcheckpoint", + "get-vmcheckpoint", + "get-pshostprocessinfo", + "get-psprovider", + "get-psreadlinekeyhandler", + "get-psreadlineoption", + "get-psrepository", + "get-pssession", + "gsn", + "get-pssessioncapability", + "get-pssessionconfiguration", + "get-pssnapin", + "gsnp", + "get-random", + "get-resiliencysetting", + "get-runspace", + "get-runspacedebug", + "get-scheduledjob", + "get-scheduledjoboption", + "get-scheduledtask", + "get-scheduledtaskinfo", + "get-securebootpolicy", + "get-securebootuefi", + "get-service", + "gsv", + "get-smbbandwidthlimit", + "get-smbclientaccesstoserver", + "get-smbclientcertificatemapping", + "get-smbclientconfiguration", + "get-smbclientnetworkinterface", + "get-smbconnection", + "get-smbdelegation", + "get-smbglobalmapping", + "get-smbmapping", + "get-smbmultichannelconnection", + "get-smbmultichannelconstraint", + "get-smbopenfile", + "get-smbservercertificatemapping", + "get-smbservercertprops", + "get-smbserverconfiguration", + "get-smbservernetworkinterface", + "get-smbsession", + "get-smbshare", + "get-smbshareaccess", + "get-smbwitnessclient", + "get-sqlagent", + "get-sqlagentjob", + "get-sqlagentjobhistory", + "get-sqlagentjobschedule", + "get-sqlagentjobstep", + "get-sqlagentschedule", + "get-sqlassessmentitem", + "get-sqlbackuphistory", + "get-sqlcolumnencryptionkey", + "get-sqlcolumnmasterkey", + "get-sqlcredential", + "get-sqldatabase", + "get-sqlerrorlog", + "get-sqlinstance", + "get-sqllogin", + "get-sqlsensitivityclassification", + "get-sqlsensitivityrecommendations", + "get-sqlsmartadmin", + "get-startapps", + "get-storageadvancedproperty", + "get-storagebusbinding", + "get-storagebuscache", + "get-storagebusclientdevice", + "get-storagebusdisk", + "get-storagebustargetcachestore", + "get-storagebustargetcachestoresinstance", + "get-storagebustargetdevice", + "get-storagebustargetdeviceinstance", + "get-storagechassis", + "get-storagedatacollection", + "get-storagediagnosticinfo", + "get-storageenclosure", + "get-storageenclosurestoragenodeview", + "get-storageenclosurevendordata", + "get-storageextendedstatus", + "get-storagefaultdomain", + "get-storagefileserver", + "get-storagefirmwareinformation", + "get-storagehealthaction", + "get-storagehealthreport", + "get-storagehealthsetting", + "get-storagehistory", + "get-storagejob", + "get-storagenode", + "get-storagepool", + "get-storageprovider", + "get-storagerack", + "get-storagereliabilitycounter", + "get-storagescaleunit", + "get-storagesetting", + "get-storagesite", + "get-storagesubsystem", + "get-storagetier", + "get-storagetiersupportedsize", + "get-supportedclustersizes", + "get-supportedfilesystems", + "get-systemdriver", + "get-systempreferreduilanguage", + "get-targetport", + "get-targetportal", + "get-terminaliconscolortheme", + "get-terminaliconsglyphs", + "get-terminaliconsicontheme", + "get-terminaliconstheme", + "get-testdriveitem", + "get-timezone", + "gtz", + "get-tlsciphersuite", + "get-tlsecccurve", + "get-tpm", + "get-tpmendorsementkeyinfo", + "get-tpmsupportedfeature", + "get-tracesource", + "get-transaction", + "get-troubleshootingpack", + "get-trustedprovisioningcertificate", + "get-typedata", + "get-uevappxpackage", + "get-uevconfiguration", + "get-uevstatus", + "get-uevtemplate", + "get-uevtemplateprogram", + "get-uiculture", + "get-unique", + "gu", + "get-variable", + "gv", + "gvm", + "gvm", + "gvm", + "gvmr", + "gvmr", + "gvmr", + "gvmrs", + "gvmrs", + "gvmrs", + "get-verb", + "get-vhd", + "get-vhdset", + "get-vhdsnapshot", + "get-virtualdisk", + "get-virtualdisksupportedsize", + "get-vm", + "get-vmassignabledevice", + "get-vmbios", + "get-vmcomport", + "get-vmconnectaccess", + "get-vmdirectvirtualdisk", + "get-vmdvddrive", + "get-vmfibrechannelhba", + "get-vmfirmware", + "get-vmfloppydiskdrive", + "get-vmgpupartitionadapter", + "get-vmgroup", + "get-vmharddiskdrive", + "get-vmhost", + "get-vmhostassignabledevice", + "get-vmhostcluster", + "get-vmhostnumanode", + "get-vmhostnumanodestatus", + "get-vmhostpartitionablegpu", + "get-vmhostsupportedversion", + "get-vmidecontroller", + "get-vmintegrationservice", + "get-vmkeyprotector", + "get-vmkeystoragedrive", + "get-vmmemory", + "get-vmmigrationnetwork", + "get-vmnetworkadapter", + "get-vmnetworkadapteracl", + "get-vmnetworkadapterextendedacl", + "get-vmnetworkadapterfailoverconfiguration", + "get-vmnetworkadapterisolation", + "get-vmnetworkadapterrdma", + "get-vmnetworkadapterroutingdomainmapping", + "get-vmnetworkadapterteammapping", + "get-vmnetworkadaptervlan", + "get-vmpartitionablegpu", + "get-vmpmemcontroller", + "get-vmprocessor", + "get-vmremotefx3dvideoadapter", + "get-vmremotefxphysicalvideoadapter", + "get-vmreplication", + "get-vmreplicationauthorizationentry", + "get-vmreplicationserver", + "get-vmresourcepool", + "get-vmsan", + "get-vmscsicontroller", + "get-vmsecurity", + "get-vmsnapshot", + "get-vmstoragepath", + "get-vmstoragesettings", + "get-vmswitch", + "get-vmswitchextension", + "get-vmswitchextensionportdata", + "get-vmswitchextensionportfeature", + "get-vmswitchextensionswitchdata", + "get-vmswitchextensionswitchfeature", + "get-vmswitchteam", + "get-vmsystemswitchextension", + "get-vmsystemswitchextensionportfeature", + "get-vmsystemswitchextensionswitchfeature", + "get-vmvideo", + "get-volume", + "get-volumecorruptioncount", + "get-volumescrubpolicy", + "get-vpnconnection", + "get-vpnconnectiontrigger", + "get-wdacbidtrace", + "get-wheamemorypolicy", + "get-wimbootentry", + "get-winacceptlanguagefromlanguagelistoptout", + "get-winculturefromlanguagelistoptout", + "get-windefaultinputmethodoverride", + "get-windowscapability", + "get-windowsdeveloperlicense", + "get-windowsdriver", + "get-windowsedition", + "get-windowserrorreporting", + "get-windowsimage", + "get-windowsimagecontent", + "get-windowsoptionalfeature", + "get-windowspackage", + "get-windowsreservedstoragestate", + "get-windowssearchsetting", + "get-windowsupdatelog", + "get-winevent", + "get-winhomelocation", + "get-winhttpproxy", + "get-winlanguagebaroption", + "get-winsystemlocale", + "get-winuilanguageoverride", + "get-winuserlanguagelist", + "get-wmiobject", + "gwmi", + "get-wsmancredssp", + "get-wsmaninstance", + "grant-fileshareaccess", + "grant-hgskeyprotectoraccess", + "grant-smbclientaccesstoserver", + "grant-smbshareaccess", + "grant-sqlavailabilitygroupcreateanydatabase", + "grant-vmconnectaccess", + "group-object", + "group", + "grsmba", + "grsmbclas", + "gsmba", + "gsmbb", + "gsmbc", + "gsmbcc", + "gsmbccm", + "gsmbclas", + "gsmbcn", + "gsmbd", + "gsmbgm", + "gsmbm", + "gsmbmc", + "gsmbo", + "gsmbs", + "gsmbsc", + "gsmbscm", + "gsmbscp", + "gsmbse", + "gsmbsn", + "gsmbt", + "gsmbw", + "gsudo", + "gsudoprompt", + "h:", + "help", + "man", + "hide-virtualdisk", + "i:", + "import-alias", + "ipal", + "import-bccachepackage", + "import-bcdstore", + "import-bcsecretkey", + "import-binarymilog", + "import-certificate", + "import-clixml", + "import-counter", + "import-csv", + "ipcsv", + "import-hgsguardian", + "import-isesnippet", + "import-localizeddata", + "import-module", + "ipmo", + "import-packageprovider", + "import-pfxcertificate", + "import-powershelldatafile", + "import-pssession", + "ipsn", + "import-sqlvulnerabilityassessmentbaselineset", + "import-startlayout", + "importsystemmodules", + "import-tpmownerauth", + "import-uevconfiguration", + "import-vm", + "import-vminitialreplication", + "import-winhttpproxy", + "in", + "initialize-disk", + "initialize-pmemphysicaldevice", + "initialize-tpm", + "inmodulescope", + "install-dtc", + "install-language", + "install-module", + "install-package", + "install-packageprovider", + "install-provisioningpackage", + "install-script", + "install-trustedprovisioningcertificate", + "invoke-ascmd", + "invoke-asworkflow", + "invoke-cimmethod", + "invoke-command", + "icm", + "invoke-commandindesktoppackage", + "invoke-dscresource", + "invoke-expression", + "iex", + "invoke-gsudo", + "invoke-history", + "ihy", + "r", + "invoke-item", + "ii", + "initialize-volume", + "initialize-volume", + "inmo", + "inmo", + "invoke-lapspolicyprocessing", + "invoke-mock", + "invoke-operationvalidation", + "invoke-pester", + "invoke-policyevaluation", + "invoke-processasdatabase", + "invoke-processcube", + "invoke-processdimension", + "invoke-processpartition", + "invoke-processtable", + "invoke-restmethod", + "irm", + "iru", + "invoke-sqlassessment", + "invoke-sqlcmd", + "invoke-sqlcolumnmasterkeyrotation", + "invoke-sqlnotebook", + "invoke-sqlvulnerabilityassessmentscan", + "invoke-terminaliconsthememigration", + "invoke-troubleshootingpack", + "invoke-webrequest", + "curl", + "iwr", + "wget", + "invoke-wmimethod", + "iwmi", + "invoke-wsmanaction", + "it", + "j:", + "join-dtcdiagnosticresourcemanager", + "join-path", + "join-sqlavailabilitygroup", + "k:", + "l:", + "limit-eventlog", + "lock-bitlocker", + "m:", + "measure-command", + "measure-object", + "measure", + "measure-vm", + "measure-vmreplication", + "measure-vmresourcepool", + "merge-cipolicy", + "merge-partition", + "merge-vhd", + "mkdir", + "md", + "mock", + "more", + "mount-appvclientconnectiongroup", + "mount-appvclientpackage", + "mount-appxvolume", + "mount-diskimage", + "mount-vhd", + "mount-vmhostassignabledevice", + "mount-windowsimage", + "move-appxpackage", + "move-item", + "mi", + "move", + "move-apppackage", + "move-smbclient", + "mv", + "mvmr", + "mvmr", + "mvmr", + "move-itemproperty", + "mp", + "msmbw", + "move-smbwitnessclient", + "move-vm", + "move-vmstorage", + "n:", + "new-alias", + "nal", + "ncim", + "ncms", + "ncso", + "new-applockerpolicy", + "new-autologgerconfig", + "new-bcdentry", + "new-bcdstore", + "new-certificatenotificationtask", + "new-ciminstance", + "new-cimsession", + "new-cimsessionoption", + "new-cipolicy", + "new-cipolicyrule", + "new-daentrypointtableitem", + "new-dscchecksum", + "new-dtcdiagnostictransaction", + "new-eapconfiguration", + "new-etwtracesession", + "new-event", + "new-eventlog", + "new-filecatalog", + "new-fileshare", + "new-fixture", + "new-guid", + "new-hgsguardian", + "new-hgskeyprotector", + "new-hgstracetarget", + "new-iscsitargetportal", + "new-isesnippet", + "new-item", + "ni", + "nlg", + "nlu", + "new-itemproperty", + "new-jobtrigger", + "new-localgroup", + "new-localuser", + "new-maskingset", + "new-module", + "nmo", + "new-modulemanifest", + "new-mpperformancerecording", + "new-netadapteradvancedproperty", + "new-neteventsession", + "new-netfirewalldynamickeywordaddress", + "new-netfirewallhypervprofile", + "new-netfirewallhypervrule", + "new-netfirewallhypervvmsetting", + "new-netfirewallrule", + "new-netipaddress", + "new-netiphttpsconfiguration", + "new-netipsecauthproposal", + "new-netipsecdospsetting", + "new-netipsecmainmodecryptoproposal", + "new-netipsecmainmodecryptoset", + "new-netipsecmainmoderule", + "new-netipsecphase1authset", + "new-netipsecphase2authset", + "new-netipsecquickmodecryptoproposal", + "new-netipsecquickmodecryptoset", + "new-netipsecrule", + "new-netlbfoteam", + "new-netnat", + "new-netnattransitionconfiguration", + "new-netneighbor", + "new-netqospolicy", + "new-netroute", + "new-netswitchteam", + "new-nettransportfilter", + "new-networkswitchvlan", + "new-object", + "new-partition", + "new-pesteroption", + "new-pmemdedicatedmemory", + "new-pmemdisk", + "new-provisioningrepro", + "new-psdrive", + "mount", + "mount-apppackagevolume", + "ndr", + "new-psrolecapabilityfile", + "new-pssession", + "nsn", + "new-pssessionconfigurationfile", + "npssc", + "nsmbccm", + "nsmbgm", + "nsmbm", + "nsmbs", + "nsmbscm", + "nsmbt", + "new-pssessionoption", + "new-pstransportoption", + "new-psworkflowexecutionoption", + "new-psworkflowsession", + "new-restorefolder", + "new-restorelocation", + "new-scheduledjoboption", + "new-scheduledtask", + "new-scheduledtaskaction", + "new-scheduledtaskprincipal", + "new-scheduledtasksettingsset", + "new-scheduledtasktrigger", + "new-scriptfileinfo", + "new-selfsignedcertificate", + "new-service", + "new-smbclientcertificatemapping", + "new-smbglobalmapping", + "new-smbmapping", + "new-smbmultichannelconstraint", + "new-smbservercertificatemapping", + "new-smbshare", + "new-sqlavailabilitygroup", + "new-sqlavailabilitygrouplistener", + "new-sqlavailabilityreplica", + "new-sqlazurekeyvaultcolumnmasterkeysettings", + "new-sqlbackupencryptionoption", + "new-sqlcertificatestorecolumnmasterkeysettings", + "new-sqlcngcolumnmasterkeysettings", + "new-sqlcolumnencryptionkey", + "new-sqlcolumnencryptionkeyencryptedvalue", + "new-sqlcolumnencryptionsettings", + "new-sqlcolumnmasterkey", + "new-sqlcolumnmasterkeysettings", + "new-sqlcredential", + "new-sqlcspcolumnmasterkeysettings", + "new-sqlhadrendpoint", + "new-sqlvulnerabilityassessmentbaseline", + "new-sqlvulnerabilityassessmentbaselineset", + "new-storagebusbinding", + "new-storagebuscachestore", + "new-storagefileserver", + "new-storagepool", + "new-storagesubsystemvirtualdisk", + "new-storagetier", + "new-temporaryfile", + "new-timespan", + "new-tlssessionticketkey", + "new-variable", + "nv", + "nwsn", + "new-vfd", + "new-vhd", + "new-virtualdisk", + "new-virtualdiskclone", + "new-virtualdisksnapshot", + "new-vm", + "new-vmgroup", + "new-vmreplicationauthorizationentry", + "new-vmresourcepool", + "new-vmsan", + "new-vmswitch", + "new-volume", + "new-vpnserveraddress", + "new-webserviceproxy", + "new-windowscustomimage", + "new-windowsimage", + "new-winevent", + "new-winuserlanguagelist", + "new-wsmaninstance", + "new-wsmansessionoption", + "o:", + "open-netgpo", + "optimize-appxprovisionedpackages", + "optimize-storagepool", + "optimize-vhd", + "optimize-vhdset", + "optimize-volume", + "optimize-windowsimage", + "oss", + "out-default", + "out-file", + "out-gridview", + "ogv", + "out-host", + "oh", + "optimize-appprovisionedpackages", + "optimize-provisionedapppackages", + "optimize-provisionedappxpackages", + "pbcfg", + "pfn", + "out-null", + "out-printer", + "lp", + "out-string", + "p:", + "pause", + "pop-location", + "popd", + "powershell_ise.exe", + "ise", + "prompt", + "protect-cmsmessage", + "psconsolehostreadline", + "publish-appvclientpackage", + "publish-bcfilecontent", + "publish-bcwebcontent", + "publish-dscconfiguration", + "publish-module", + "publish-script", + "push-location", + "pushd", + "q:", + "r:", + "read-host", + "read-printernfctag", + "read-sqltabledata", + "read-sqlviewdata", + "read-sqlxevent", + "receive-dtcdiagnostictransaction", + "receive-job", + "rcjb", + "rcms", + "receive-pssession", + "rcsn", + "register-argumentcompleter", + "register-cimindicationevent", + "register-clusteredscheduledtask", + "register-dnsclient", + "register-engineevent", + "register-iscsisession", + "register-objectevent", + "register-packagesource", + "register-psrepository", + "register-pssessionconfiguration", + "register-scheduledjob", + "register-scheduledtask", + "register-storagesubsystem", + "register-uevtemplate", + "register-wmievent", + "remove-appprovisionedsharedpackagecontainer", + "remove-appsharedpackagecontainer", + "remove-appvclientconnectiongroup", + "remove-appvclientpackage", + "remove-appvpublishingserver", + "remove-appxpackage", + "remove-appxpackageautoupdatesettings", + "remove-appxprovisionedpackage", + "remove-appxvolume", + "remove-autologgerconfig", + "remove-bcdatacacheextension", + "remove-bcdelement", + "remove-bcdentry", + "remove-bitlockerkeyprotector", + "remove-bitstransfer", + "remove-certificateenrollmentpolicyserver", + "remove-certificatenotificationtask", + "remove-ciminstance", + "remove-cimsession", + "remove-cipolicyrule", + "remove-computer", + "remove-daentrypointtableitem", + "remove-dnsclientdohserveraddress", + "remove-dnsclientnrptrule", + "remove-dscconfigurationdocument", + "remove-dtcclustertmmapping", + "remove-etwtraceprovider", + "remove-event", + "remove-eventlog", + "remove-fileshare", + "remove-hgsclienthostkey", + "remove-hgsguardian", + "remove-hnsendpoint", + "remove-hnsnamespace", + "remove-hnsnetwork", + "remove-hnspolicylist", + "remove-initiatorid", + "remove-initiatoridfrommaskingset", + "remove-iscsitargetportal", + "remove-item", + "del", + "erase", + "esmbd", + "rd", + "ri", + "rm", + "rmdir", + "remove-itemproperty", + "rp", + "rsmbb", + "rsmbc", + "rsmbcc", + "rsmbccm", + "rsmbgm", + "rsmbm", + "rsmbs", + "rsmbsc", + "rsmbscm", + "rsmbt", + "remove-job", + "rjb", + "rksmba", + "rksmbclas", + "rlg", + "rlgm", + "rlu", + "remove-jobtrigger", + "remove-localgroup", + "remove-localgroupmember", + "remove-localuser", + "remove-maskingset", + "remove-module", + "rmo", + "remove-mpbehavioralnetworkblockingrules", + "remove-mppreference", + "remove-mpthreat", + "remove-netadapteradvancedproperty", + "remove-neteventnetworkadapter", + "remove-neteventpacketcaptureprovider", + "remove-neteventprovider", + "remove-neteventsession", + "remove-neteventvfpprovider", + "remove-neteventvmnetworkadapter", + "remove-neteventvmswitch", + "remove-neteventvmswitchprovider", + "remove-neteventwfpcaptureprovider", + "remove-netfirewalldynamickeywordaddress", + "remove-netfirewallhypervprofile", + "remove-netfirewallhypervrule", + "remove-netfirewallhypervvmsetting", + "remove-netfirewallrule", + "remove-netipaddress", + "remove-netiphttpscertbinding", + "remove-netiphttpsconfiguration", + "remove-netipsecdospsetting", + "remove-netipsecmainmodecryptoset", + "remove-netipsecmainmoderule", + "remove-netipsecmainmodesa", + "remove-netipsecphase1authset", + "remove-netipsecphase2authset", + "remove-netipsecquickmodecryptoset", + "remove-netipsecquickmodesa", + "remove-netipsecrule", + "remove-netlbfoteam", + "remove-netlbfoteammember", + "remove-netlbfoteamnic", + "remove-netnat", + "remove-netnatexternaladdress", + "remove-netnatstaticmapping", + "remove-netnattransitionconfiguration", + "remove-netneighbor", + "remove-netqospolicy", + "remove-netroute", + "remove-netswitchteam", + "remove-netswitchteammember", + "remove-nettransportfilter", + "remove-networkswitchethernetportipaddress", + "remove-networkswitchvlan", + "remove-odbcdsn", + "remove-partition", + "remove-partitionaccesspath", + "remove-physicaldisk", + "remove-pmemdedicatedmemory", + "remove-pmemdisk", + "remove-printer", + "remove-printerdriver", + "remove-printerport", + "remove-printjob", + "remove-psbreakpoint", + "rbp", + "rcie", + "rcim", + "remove-psdrive", + "rdr", + "remove-psreadlinekeyhandler", + "remove-pssession", + "rsn", + "remove-pssnapin", + "rsnp", + "rtcfg", + "remove-rolemember", + "remove-smbbandwidthlimit", + "remove-smbclientcertificatemapping", + "remove-smbcomponent", + "remove-smbglobalmapping", + "remove-smbmapping", + "remove-smbmultichannelconstraint", + "remove-smbservercertificatemapping", + "remove-smbshare", + "remove-sqlavailabilitydatabase", + "remove-sqlavailabilitygroup", + "remove-sqlavailabilityreplica", + "remove-sqlcolumnencryptionkey", + "remove-sqlcolumnencryptionkeyvalue", + "remove-sqlcolumnmasterkey", + "remove-sqlcredential", + "remove-sqllogin", + "remove-sqlsensitivityclassification", + "remove-storagebusbinding", + "remove-storagefaultdomain", + "remove-storagefileserver", + "remove-storagehealthintent", + "remove-storagehealthsetting", + "remove-storagepool", + "remove-storagetier", + "remove-targetportfrommaskingset", + "remove-terminaliconstheme", + "remove-typedata", + "remove-variable", + "rv", + "remove-vhdsnapshot", + "remove-virtualdisk", + "remove-virtualdiskfrommaskingset", + "remove-vm", + "remove-vmassignabledevice", + "remove-vmdirectvirtualdisk", + "remove-vmdvddrive", + "remove-vmfibrechannelhba", + "remove-vmgpupartitionadapter", + "remove-vmgroup", + "remove-vmgroupmember", + "remove-vmharddiskdrive", + "remove-vmhostassignabledevice", + "remove-vmkeystoragedrive", + "remove-vmmigrationnetwork", + "remove-vmnetworkadapter", + "remove-vmnetworkadapteracl", + "remove-vmnetworkadapterextendedacl", + "remove-vmnetworkadapterroutingdomainmapping", + "remove-vmnetworkadapterteammapping", + "remove-vmpmemcontroller", + "remove-vmremotefx3dvideoadapter", + "remove-vmreplication", + "remove-vmreplicationauthorizationentry", + "remove-vmresourcepool", + "remove-vmsan", + "remove-vmsavedstate", + "remove-vmscsicontroller", + "remove-vmsnapshot", + "remove-vmstoragepath", + "remove-vmswitch", + "remove-vmswitchextensionportfeature", + "remove-vmswitchextensionswitchfeature", + "remove-vmswitchteammember", + "remove-vpnconnection", + "remove-vpnconnectionroute", + "remove-vpnconnectiontriggerapplication", + "remove-vpnconnectiontriggerdnsconfiguration", + "remove-vpnconnectiontriggertrustednetwork", + "remove-windowscapability", + "remove-windowsdriver", + "remove-windowsimage", + "remove-windowspackage", + "remove-wmiobject", + "rwmi", + "sacfg", + "remove-wsmaninstance", + "rename-computer", + "rename-daentrypointtableitem", + "rename-item", + "ren", + "rename-vmcheckpoint", + "rename-vmcheckpoint", + "reset-apppackage", + "restore-vmcheckpoint", + "restore-vmcheckpoint", + "rni", + "rnlg", + "rnlu", + "rename-itemproperty", + "rnp", + "rename-localgroup", + "rename-localuser", + "rename-maskingset", + "rename-netadapter", + "rename-netfirewallhypervrule", + "rename-netfirewallrule", + "rename-netiphttpsconfiguration", + "rename-netipsecmainmodecryptoset", + "rename-netipsecmainmoderule", + "rename-netipsecphase1authset", + "rename-netipsecphase2authset", + "rename-netipsecquickmodecryptoset", + "rename-netipsecrule", + "rename-netlbfoteam", + "rename-netswitchteam", + "rename-printer", + "rename-vm", + "rename-vmgroup", + "rename-vmnetworkadapter", + "rename-vmresourcepool", + "rename-vmsan", + "rename-vmsnapshot", + "rename-vmswitch", + "repair-appvclientconnectiongroup", + "repair-appvclientpackage", + "repair-fileintegrity", + "repair-uevtemplateindex", + "repair-virtualdisk", + "repair-vm", + "repair-volume", + "repair-windowsimage", + "reset-appsharedpackagecontainer", + "reset-appxpackage", + "reset-bc", + "reset-computermachinepassword", + "reset-daclientexperienceconfiguration", + "reset-daentrypointtableitem", + "reset-dtclog", + "reset-lapspassword", + "reset-ncsipolicyconfiguration", + "reset-net6to4configuration", + "reset-netadapteradvancedproperty", + "reset-netdnstransitionconfiguration", + "reset-netiphttpsconfiguration", + "reset-netisatapconfiguration", + "reset-netteredoconfiguration", + "reset-physicaldisk", + "reset-smbclientconfiguration", + "reset-smbserverconfiguration", + "reset-storagereliabilitycounter", + "reset-vmreplicationstatistics", + "reset-vmresourcemetering", + "reset-winhttpproxy", + "resize-partition", + "resize-storagetier", + "resize-vhd", + "resize-virtualdisk", + "resolve-dnsname", + "resolve-path", + "rvpa", + "restart-computer", + "restart-netadapter", + "restart-pcsvdevice", + "restart-printjob", + "restart-service", + "restart-vm", + "restore-asdatabase", + "restore-computer", + "restore-dscconfiguration", + "restore-networkswitchconfiguration", + "restore-sqldatabase", + "restore-uevbackup", + "restore-uevusersetting", + "restore-vmsnapshot", + "resume-bitlocker", + "resume-bitstransfer", + "resume-job", + "rujb", + "resume-printjob", + "resume-provisioningsession", + "resume-service", + "resume-sqlavailabilitydatabase", + "resume-storagebusdisk", + "resume-vm", + "resume-vmreplication", + "revoke-fileshareaccess", + "revoke-hgskeyprotectoraccess", + "revoke-smbclientaccesstoserver", + "revoke-smbshareaccess", + "revoke-sqlavailabilitygroupcreateanydatabase", + "revoke-vmconnectaccess", + "s:", + "safegetcommand", + "save-etwtracesession", + "save-help", + "save-module", + "save-netgpo", + "save-networkswitchconfiguration", + "save-package", + "save-script", + "save-softwareinventory", + "save-storagedatacollection", + "save-vm", + "save-windowsimage", + "select-object", + "select", + "select-string", + "sls", + "slu", + "select-xml", + "send-appvclientreport", + "send-dtcdiagnostictransaction", + "send-etwtracesession", + "send-mailmessage", + "set-acl", + "set-alias", + "sal", + "set-appbackgroundtaskresourcepolicy", + "set-applockerpolicy", + "set-appvclientconfiguration", + "set-appvclientmode", + "set-appvclientpackage", + "set-appvpublishingserver", + "set-appxdefaultvolume", + "set-appxpackageautoupdatesettings", + "set-appxprovisioneddatafile", + "set-assignedaccess", + "set-authenticodesignature", + "set-bcauthentication", + "set-bccache", + "set-bcdatacacheentrymaxage", + "set-bcdbootdefault", + "set-bcdbootdisplayorder", + "set-bcdbootsequence", + "set-bcdboottimeout", + "set-bcdboottoolsdisplayorder", + "set-bcddebugsettings", + "set-bcdelement", + "set-bcdhypervisorsettings", + "set-bcminsmblatency", + "set-bcsecretkey", + "set-bitstransfer", + "set-certificateautoenrollmentpolicy", + "set-ciminstance", + "set-cipolicyidinfo", + "set-cipolicysetting", + "set-cipolicyversion", + "set-clipboard", + "scb", + "scim", + "set-clusteredscheduledtask", + "set-content", + "sc", + "set-culture", + "set-daclientexperienceconfiguration", + "set-daentrypointtableitem", + "set-date", + "set-deliveryoptimizationstatus", + "set-disk", + "set-dnsclient", + "set-dnsclientdohserveraddress", + "set-dnsclientglobalsetting", + "set-dnsclientnrptglobal", + "set-dnsclientnrptrule", + "set-dnsclientserveraddress", + "set-dodownloadmode", + "set-domaxbackgroundbandwidth", + "set-domaxforegroundbandwidth", + "set-dopercentagemaxbackgroundbandwidth", + "set-dopercentagemaxforegroundbandwidth", + "set-dsclocalconfigurationmanager", + "set-dtcadvancedhostsetting", + "set-dtcadvancedsetting", + "set-dtcclusterdefault", + "set-dtcclustertmmapping", + "set-dtcdefault", + "set-dtclog", + "set-dtcnetworksetting", + "set-dtctransaction", + "set-dtctransactionstracesession", + "set-dtctransactionstracesetting", + "set-dynamicparametervariables", + "set-etwtraceprovider", + "set-executionpolicy", + "set-fileintegrity", + "set-fileshare", + "set-filestoragetier", + "set-hgsclientconfiguration", + "set-hgsclienthostkey", + "set-hvcioptions", + "set-initiatorport", + "set-iscsichapsecret", + "set-item", + "si", + "set-itemproperty", + "sp", + "set-jobtrigger", + "set-kdsconfiguration", + "set-lapsadauditing", + "set-lapsadcomputerselfpermission", + "set-lapsadpasswordexpirationtime", + "set-lapsadreadpasswordpermission", + "set-lapsadresetpasswordpermission", + "set-localgroup", + "set-localuser", + "set-location", + "cd", + "chdir", + "sl", + "slcm", + "set-logproperties", + "set-mmagent", + "set-mppreference", + "set-ncsipolicyconfiguration", + "set-net6to4configuration", + "set-netadapter", + "set-netadapteradvancedproperty", + "set-netadapterbinding", + "set-netadapterchecksumoffload", + "set-netadapterdatapathconfiguration", + "set-netadapterencapsulatedpackettaskoffload", + "set-netadapteripsecoffload", + "set-netadapterlso", + "set-netadapterpacketdirect", + "set-netadapterpowermanagement", + "set-netadapterqos", + "set-netadapterrdma", + "set-netadapterrsc", + "set-netadapterrss", + "set-netadaptersriov", + "set-netadapteruso", + "set-netadaptervmq", + "set-netconnectionprofile", + "set-netdnstransitionconfiguration", + "set-neteventpacketcaptureprovider", + "set-neteventprovider", + "set-neteventsession", + "set-neteventvfpprovider", + "set-neteventvmswitchprovider", + "set-neteventwfpcaptureprovider", + "set-netfirewalladdressfilter", + "set-netfirewallapplicationfilter", + "set-netfirewallhypervprofile", + "set-netfirewallhypervrule", + "set-netfirewallhypervvmsetting", + "set-netfirewallinterfacefilter", + "set-netfirewallinterfacetypefilter", + "set-netfirewallportfilter", + "set-netfirewallprofile", + "set-netfirewallrule", + "set-netfirewallsecurityfilter", + "set-netfirewallservicefilter", + "set-netfirewallsetting", + "set-netipaddress", + "set-netiphttpsconfiguration", + "set-netipinterface", + "set-netipsecdospsetting", + "set-netipsecmainmodecryptoset", + "set-netipsecmainmoderule", + "set-netipsecphase1authset", + "set-netipsecphase2authset", + "set-netipsecquickmodecryptoset", + "set-netipsecrule", + "set-netipv4protocol", + "set-netipv6protocol", + "set-netisatapconfiguration", + "set-netlbfoteam", + "set-netlbfoteammember", + "set-netlbfoteamnic", + "set-netnat", + "set-netnatglobal", + "set-netnattransitionconfiguration", + "set-netneighbor", + "set-netoffloadglobalsetting", + "set-netqospolicy", + "set-netroute", + "set-nettcpsetting", + "set-netteredoconfiguration", + "set-netudpsetting", + "set-networkswitchethernetportipaddress", + "set-networkswitchportmode", + "set-networkswitchportproperty", + "set-networkswitchvlanproperty", + "set-nonremovableappspolicy", + "set-odbcdriver", + "set-odbcdsn", + "set-packagesource", + "set-partition", + "set-pcsvdevicebootconfiguration", + "set-pcsvdevicenetworkconfiguration", + "set-pcsvdeviceuserpassword", + "set-physicaldisk", + "set-poshcontext", + "set-printconfiguration", + "set-printer", + "set-printerproperty", + "set-processmitigation", + "set-psbreakpoint", + "sbp", + "set-psdebug", + "set-psreadlinekeyhandler", + "set-psreadlineoption", + "set-psrepository", + "set-pssessionconfiguration", + "set-resiliencysetting", + "set-ruleoption", + "set-scheduledjob", + "set-scheduledjoboption", + "set-scheduledtask", + "set-securebootuefi", + "set-service", + "set-smbbandwidthlimit", + "set-smbclientcertificatemapping", + "set-smbclientconfiguration", + "set-smbpathacl", + "set-smbservercertificatemapping", + "set-smbserverconfiguration", + "set-smbshare", + "set-sqlavailabilitygroup", + "set-sqlavailabilitygrouplistener", + "set-sqlavailabilityreplica", + "set-sqlavailabilityreplicaroletosecondary", + "set-sqlcolumnencryption", + "set-sqlcredential", + "set-sqlerrorlog", + "set-sqlhadrendpoint", + "set-sqlsensitivityclassification", + "set-sqlsmartadmin", + "set-storagebuscache", + "set-storagebusprofile", + "set-storagefileserver", + "set-storagehealthsetting", + "set-storagepool", + "set-storageprovider", + "set-storagesetting", + "set-storagesubsystem", + "set-storagetier", + "set-strictmode", + "set-systempreferreduilanguage", + "set-terminaliconsicon", + "set-terminaliconstheme", + "set-testinconclusive", + "set-timezone", + "stz", + "set-tpmownerauth", + "set-tracesource", + "set-uevconfiguration", + "set-uevtemplateprofile", + "setup", + "set-variable", + "set", + "set-apppackageautoupdatesettings", + "set-apppackagedefaultvolume", + "set-apppackageprovisioneddatafile", + "set-autologgerconfig", + "set-etwtracesession", + "set-preferredlanguage", + "set-provisionedapppackagedatafile", + "set-provisionedappxdatafile", + "set-systemlanguage", + "sv", + "set-vhd", + "set-virtualdisk", + "set-vm", + "set-vmbios", + "set-vmcomport", + "set-vmdvddrive", + "set-vmfibrechannelhba", + "set-vmfirmware", + "set-vmfloppydiskdrive", + "set-vmgpupartitionadapter", + "set-vmharddiskdrive", + "set-vmhost", + "set-vmhostcluster", + "set-vmhostpartitionablegpu", + "set-vmkeyprotector", + "set-vmkeystoragedrive", + "set-vmmemory", + "set-vmmigrationnetwork", + "set-vmnetworkadapter", + "set-vmnetworkadapterfailoverconfiguration", + "set-vmnetworkadapterisolation", + "set-vmnetworkadapterrdma", + "set-vmnetworkadapterroutingdomainmapping", + "set-vmnetworkadapterteammapping", + "set-vmnetworkadaptervlan", + "set-vmpartitionablegpu", + "set-vmprocessor", + "set-vmremotefx3dvideoadapter", + "set-vmreplication", + "set-vmreplicationauthorizationentry", + "set-vmreplicationserver", + "set-vmresourcepool", + "set-vmsan", + "set-vmsecurity", + "set-vmsecuritypolicy", + "set-vmstoragesettings", + "set-vmswitch", + "set-vmswitchextensionportfeature", + "set-vmswitchextensionswitchfeature", + "set-vmswitchteam", + "set-vmvideo", + "set-volume", + "set-volumescrubpolicy", + "set-vpnconnection", + "set-vpnconnectionipsecconfiguration", + "set-vpnconnectionproxy", + "set-vpnconnectiontriggerdnsconfiguration", + "set-vpnconnectiontriggertrustednetwork", + "set-wheamemorypolicy", + "set-winacceptlanguagefromlanguagelistoptout", + "set-winculturefromlanguagelistoptout", + "set-windefaultinputmethodoverride", + "set-windowsedition", + "set-windowsproductkey", + "set-windowsreservedstoragestate", + "set-windowssearchsetting", + "set-winhomelocation", + "set-winhttpproxy", + "set-winlanguagebaroption", + "set-winsystemlocale", + "set-winuilanguageoverride", + "set-winuserlanguagelist", + "set-wmiinstance", + "swmi", + "tcfg", + "set-wsmaninstance", + "set-wsmanquickconfig", + "should", + "show-ast", + "show-command", + "shcm", + "show-controlpanelitem", + "show-eventlog", + "show-netfirewallrule", + "show-netipsecrule", + "show-storagehistory", + "show-terminaliconstheme", + "show-virtualdisk", + "show-windowsdeveloperlicenseregistration", + "sort-object", + "sort", + "split-path", + "split-windowsimage", + "sqlserver:", + "start-appbackgroundtask", + "start-appvvirtualprocess", + "start-autologgerconfig", + "start-bitstransfer", + "start-dscconfiguration", + "start-dtc", + "start-dtcdiagnosticresourcemanager", + "start-dtctransactionstracesession", + "start-etwtracesession", + "start-job", + "sajb", + "start-mprollback", + "start-mpscan", + "start-mpwdoscan", + "start-neteventsession", + "start-osuninstall", + "start-pcsvdevice", + "start-process", + "saps", + "start", + "start-scheduledtask", + "start-service", + "sasv", + "savm", + "savm", + "savm", + "start-sleep", + "sleep", + "slg", + "start-storagediagnosticlog", + "start-trace", + "start-transaction", + "start-transcript", + "start-vm", + "start-vmfailover", + "start-vminitialreplication", + "start-vmtrace", + "stop-appvclientconnectiongroup", + "stop-appvclientpackage", + "stop-computer", + "stop-dscconfiguration", + "stop-dtc", + "stop-dtcdiagnosticresourcemanager", + "stop-dtctransactionstracesession", + "stop-etwtracesession", + "stop-job", + "spjb", + "stop-neteventsession", + "stop-pcsvdevice", + "stop-process", + "kill", + "spps", + "stop-scheduledtask", + "stop-service", + "spsv", + "spvm", + "spvm", + "spvm", + "ssmbb", + "ssmbcc", + "ssmbccm", + "ssmbp", + "ssmbs", + "ssmbsc", + "ssmbscm", + "stop-storagediagnosticlog", + "stop-storagejob", + "stop-trace", + "stop-transcript", + "stop-vm", + "stop-vmfailover", + "stop-vminitialreplication", + "stop-vmreplication", + "stop-vmtrace", + "suspend-bitlocker", + "suspend-bitstransfer", + "suspend-job", + "sujb", + "suspend-printjob", + "suspend-service", + "suspend-sqlavailabilitydatabase", + "suspend-storagebusdisk", + "suspend-vm", + "suspend-vmreplication", + "switch-certificate", + "switch-sqlavailabilitygroup", + "sync-appvpublishingserver", + "sync-netipsecrule", + "t:", + "tabexpansion", + "tabexpansion2", + "tee-object", + "tee", + "tid", + "tnc", + "test-applockerpolicy", + "test-certificate", + "test-computersecurechannel", + "test-connection", + "test-dscconfiguration", + "test-dtc", + "test-filecatalog", + "test-hgsclientconfiguration", + "test-hgstracetarget", + "test-isadminmember", + "test-isgsudocacheavailable", + "test-isprocesselevated", + "test-kdsrootkey", + "test-modulemanifest", + "test-netconnection", + "test-path", + "test-pssessionconfigurationfile", + "test-scriptfileinfo", + "test-sqlavailabilitygroup", + "test-sqlavailabilityreplica", + "test-sqldatabasereplicastate", + "test-sqlsmartadmin", + "test-uevtemplate", + "test-vhd", + "test-vmnetworkadapter", + "test-vmreplicationconnection", + "test-wsman", + "trace-command", + "trcm", + "u:", + "unblock-file", + "unblock-fileshareaccess", + "unblock-smbclientaccesstoserver", + "unblock-smbshareaccess", + "unblock-tpm", + "undo-dtcdiagnostictransaction", + "undo-transaction", + "uninstall-dtc", + "uninstall-language", + "uninstall-module", + "uninstall-package", + "uninstall-provisioningpackage", + "uninstall-script", + "uninstall-trustedprovisioningcertificate", + "unlock-bitlocker", + "unprotect-cmsmessage", + "unpublish-appvclientpackage", + "unregister-appbackgroundtask", + "unregister-clusteredscheduledtask", + "unregister-event", + "unregister-iscsisession", + "unregister-packagesource", + "unregister-psrepository", + "unregister-pssessionconfiguration", + "unregister-scheduledjob", + "unregister-scheduledtask", + "unregister-storagesubsystem", + "unregister-uevtemplate", + "unregister-windowsdeveloperlicense", + "update-autologgerconfig", + "update-disk", + "update-dscconfiguration", + "update-etwtracesession", + "update-formatdata", + "update-help", + "update-hoststoragecache", + "update-iscsitarget", + "update-iscsitargetportal", + "update-lapsadschema", + "update-list", + "update-module", + "update-modulemanifest", + "update-mpsignature", + "update-netfirewalldynamickeywordaddress", + "update-netipsecrule", + "update-script", + "update-scriptfileinfo", + "update-sessionenvironment", + "refreshenv", + "remove-apppackage", + "remove-apppackageautoupdatesettings", + "remove-apppackagevolume", + "remove-appprovisionedpackage", + "remove-etwtracesession", + "remove-provisionedapppackage", + "remove-provisionedappsharedpackagecontainer", + "remove-provisionedappxpackage", + "remove-provisioningpackage", + "remove-trustedprovisioningcertificate", + "remove-vmcheckpoint", + "remove-vmcheckpoint", + "update-smbmultichannelconnection", + "update-storagebuscache", + "update-storagefirmware", + "update-storagepool", + "update-storageprovidercache", + "update-typedata", + "update-uevtemplate", + "update-vmversion", + "update-wimbootentry", + "use-transaction", + "use-windowsunattend", + "v:", + "w:", + "wait-debugger", + "wait-event", + "wait-job", + "wjb", + "wait-process", + "wait-vm", + "where-object", + "?", + "where", + "write-debug", + "write-dtctransactionstracesession", + "write-error", + "write-eventlog", + "write-host", + "write-information", + "write-output", + "echo", + "elu", + "enable-physicaldiskindication", + "enable-physicaldiskindication", + "enable-storagediagnosticlog", + "enable-storagediagnosticlog", + "encode-sqlname", + "write", + "write-filesystemcache", + "write-filesystemcache", + "write-printernfctag", + "write-progress", + "write-sqltabledata", + "write-verbose", + "write-volumecache", + "write-warning", + "x:", + "y:", + "z:" + }; + + public static bool IsBuiltinFunctionOrBareword(string input) + { + string inputLower = input.ToLower(); + return BuiltInFunctions.Contains(inputLower); + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/CommandOBF.cs b/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/CommandOBF.cs new file mode 100644 index 0000000..02bfe75 --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/CommandTypeAndBareWordObfuscation/CommandOBF.cs @@ -0,0 +1,58 @@ +using PowerCrypt.Obfuscator.Methods.StaticNumberObfuscation; +using System.Text; + +namespace PowerCrypt.Obfuscator.Methods.CommandTypeAndBareWordObfuscation +{ + public class CommandOBF + { + public static string ObfuscateCommand(string input) + { + return ObfuscateBuiltInCommand(input); + } + + public static string ObfuscateBuiltInCommand(string input) + { + var stringBuilder = new StringBuilder(); + //remove backsticks from input + input = input.Replace("`", ""); + stringBuilder.Append(".(-join[char[]]("); + + var characters = input.ToCharArray(); + var lastIndex = characters.Length - 1; + + for (var i = 0; i < lastIndex; i++) + { + int charValue = Convert.ToInt32(characters[i]); + string numberExpression = NumberOBF.ObfuscateNumber(charValue.ToString()); + stringBuilder.Append($"{numberExpression},"); + } + + if (characters.Length > 0) + { + int charValue = Convert.ToInt32(characters[lastIndex]); + stringBuilder.Append($"{NumberOBF.ObfuscateNumber(charValue.ToString())})"); + } + + stringBuilder.Append(')'); + return stringBuilder.ToString(); + } + + public static string ObfuscateCommonBareWord(string input) + { + var outString = new StringBuilder(); + var rand = new Random(); + foreach (var c in input) + { + if (rand.Next(0, 2) == 0) + { + outString.Append(char.ToUpper(c)); + } + else + { + outString.Append(char.ToLower(c)); + } + } + return outString.ToString(); + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/Counters/Counter.cs b/PowerCrypt/Obfuscator/Methods/Counters/Counter.cs new file mode 100644 index 0000000..3cddc0f --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/Counters/Counter.cs @@ -0,0 +1,17 @@ +namespace PowerCrypt.Obfuscator.Methods.Counters +{ + public static class Counter + { + private static int _transformations = 0; + + public static void Increment() + { + _transformations++; + } + + public static int GetTransformations() + { + return _transformations; + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/FunctionObfuscation/FunctionOBF.cs b/PowerCrypt/Obfuscator/Methods/FunctionObfuscation/FunctionOBF.cs new file mode 100644 index 0000000..0cf886a --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/FunctionObfuscation/FunctionOBF.cs @@ -0,0 +1,38 @@ +using PowerCrypt.Obfuscator.Helpers.globals; +using PowerCrypt.Obfuscator.Methods.RandomHelper; + +namespace PowerCrypt.Obfuscator.Methods.FunctionObfuscation +{ + public class FunctionOBF + { + public static string ObfuscateFunctionSimple(string ObfuscateFunction) + { + string randomString = Helper.GetRandomString(10); + string randomLetter = Helper.GetRandomString(1, true); + + randomString = randomLetter + randomString; + + if (ObfuscateFunction == Globals.CompressFunctionName) + { + Console.WriteLine("Function name is the same as the compress function name, changing it to a random string"); + Globals.CompressFunctionName = randomString; + } + + //add backticks to captial letters + var modifiedString = new System.Text.StringBuilder(); + foreach (char c in randomString) + { + if (char.IsUpper(c)) + { + modifiedString.Append('`').Append(c); + } + else + { + modifiedString.Append(c); + } + } + + return modifiedString.ToString(); + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/GeneralControlFlowPostOBF/WrapOBF.cs b/PowerCrypt/Obfuscator/Methods/GeneralControlFlowPostOBF/WrapOBF.cs new file mode 100644 index 0000000..0c1798f --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/GeneralControlFlowPostOBF/WrapOBF.cs @@ -0,0 +1,38 @@ +using PowerCrypt.Obfuscator.Helpers.globals; +using PowerCrypt.Obfuscator.Methods.CommandTypeAndBareWordObfuscation; +using System.IO.Compression; +using System.Text; + +namespace PowerCrypt.Obfuscator.Methods.GeneralControlFlowPostOBF +{ + public class WrapOBF + { + public static string ObfuscateWithWrap(string input) + { + //return CompressString.CompressPowershellCode(input); + //return EncodeString.Encode(input); + return $"({Globals.CompressFunctionName} {CompressAndEncodeString(input)}) | {CommandOBF.ObfuscateCommand("Invoke-Expression")}"; + } + + public static string CompressAndEncodeString(string inputString) + { + if (string.IsNullOrEmpty(inputString)) + { + throw new ArgumentException("Input string cannot be null or empty.", nameof(inputString)); + } + + using (var memoryStream = new MemoryStream()) + { + using (var gzipStream = new GZipStream(memoryStream, CompressionMode.Compress)) + { + byte[] inputBytes = Encoding.UTF8.GetBytes(inputString); + gzipStream.Write(inputBytes, 0, inputBytes.Length); + } + + byte[] compressedBytes = memoryStream.ToArray(); + + return Convert.ToBase64String(compressedBytes); + } + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/Maps.cs b/PowerCrypt/Obfuscator/Methods/Maps.cs new file mode 100644 index 0000000..db89d9c --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/Maps.cs @@ -0,0 +1,12 @@ +namespace PowerCrypt.Obfuscator.Methods +{ + public class ReplacementMapUniversal + { + public required int StartOffset { get; set; } + public required int Length { get; set; } + public required string OriginalName { get; set; } + public required string Text { get; set; } + public required string Type { get; set; } + public required bool RequiresKeyword { get; set; } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/MixedBooleanArithmetic/MBAOBF.cs b/PowerCrypt/Obfuscator/Methods/MixedBooleanArithmetic/MBAOBF.cs new file mode 100644 index 0000000..9e18e11 --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/MixedBooleanArithmetic/MBAOBF.cs @@ -0,0 +1,110 @@ +namespace PowerCrypt.Obfuscator.Methods.MixedBooleanArithmetic +{ + public class MBAOBF + { + public static readonly Dictionary OperationRules = new() + { + { "Bxor", "(LEFT-BorRIGHT)-(LEFT-BandRIGHT)" }, + { "Plus", "(LEFT-BandRIGHT)+(LEFT-BorRIGHT)" }, + { "Subtract", "(LEFT-Bxor-RIGHT)+2*(LEFT-Band-RIGHT)" }, + { "Band", "(LEFT+RIGHT)-(LEFT-BorRIGHT)" }, + { "Bor", "LEFT+RIGHT+1+(-bnotLEFT-Bor-bnotRIGHT)" }, + { "ShiftLeft", "(LEFT*2)+((RIGHT)*2)" }, + { "ShiftRight", "(LEFT/2)+((RIGHT)/2)" }, + { "Multiply", "(LEFT-BorLEFT-BandRIGHT)-(LEFT-BxorRIGHT)" }, + { "Divide", "(LEFT/RIGHT)+((LEFT-Band1)*RIGHT)" }, + { "Modulo", "(LEFT-(LEFT/RIGHT)*RIGHT)" }, + { "Complex1", "((LEFT-BorRIGHT)*2)-((LEFT-BandRIGHT)/2)" }, + { "Complex2", "(-bnot(LEFT-BandRIGHT))+(LEFT-Bxor-RIGHT)" }, + { "BitwiseMask", "(LEFT-Band0xFFFFFFFF)" }, + { "NegateAndShift", "((-bnotLEFT)-Bor((RIGHT)*2))" }, + // not sure what causes minus to also be picked up along with subtract but we ballin ig + { "Minus", "(LEFT-Bxor-RIGHT)+2*(LEFT-Band-RIGHT)" } + }; + + public static string? ApplyMBAObfuscation(string left, string right, string operatorKey, int depth = 1) + { + if (!OperationRules.TryGetValue(operatorKey, out string? operation)) + { + Console.WriteLine("Invalid Operation"); + Console.WriteLine(left); + Console.WriteLine(right); + Console.WriteLine(operatorKey); + Console.ReadKey(); + return null; + } + + //replace placeholders + operation = operation.Replace("LEFT", left).Replace("RIGHT", right); + + if (depth > 1) + { + var expressions = ParseBinaryExpressions(operation); + foreach (var expr in expressions) + { + string? newOp = expr.Operator switch + { + "&" => ApplyMBAObfuscation(expr.Left, expr.Right, "Band", depth - 1), + "|" => ApplyMBAObfuscation(expr.Left, expr.Right, "Bor", depth - 1), + "^" => ApplyMBAObfuscation(expr.Left, expr.Right, "Bxor", depth - 1), + "+" => ApplyMBAObfuscation(expr.Left, expr.Right, "Plus", depth - 1), + "-" => ApplyMBAObfuscation(expr.Left, expr.Right, "Subtract", depth - 1), + _ => null + }; + + if (newOp != null) + { + //random non-linear transformations + var randomTransformations = new List + { + $"((({newOp})-shl1)-shr1)", //shift operations + $"(-bnot(-bnot({newOp})))", //double negation + $"((({newOp})+0)-0)", //dummy additions/subtractions + $"(({newOp})-Band0xFFFFFFFF)" //masking + }; + var randomTransformation = randomTransformations[new Random().Next(randomTransformations.Count)]; + operation = operation.Replace(expr.FullExpression, $"({randomTransformation})"); + } + } + } + + return operation; + } + + public static List ParseBinaryExpressions(string input) + { + //simple expression parser + var operators = new[] { "&", "|", "^", "+", "-" }; + var expressions = new List(); + + foreach (var op in operators) + { + int index = input.IndexOf(op); + if (index > 0) + { + string left = input[..index].Trim(); + string right = input[(index + 1)..].Trim(); + expressions.Add(new BinaryExpression(left, right, op, input)); + } + } + + return expressions; + } + } + + public class BinaryExpression + { + public string Left { get; } + public string Right { get; } + public string Operator { get; } + public string FullExpression { get; } + + public BinaryExpression(string left, string right, string @operator, string fullExpression) + { + Left = left; + Right = right; + Operator = @operator; + FullExpression = fullExpression; + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/RandomHelper/Helper.cs b/PowerCrypt/Obfuscator/Methods/RandomHelper/Helper.cs new file mode 100644 index 0000000..e8ee37e --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/RandomHelper/Helper.cs @@ -0,0 +1,21 @@ +namespace PowerCrypt.Obfuscator.Methods.RandomHelper +{ + public class Helper + { + public static string GetRandomString(int length) + { + Random random = new Random(); + const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; + return new string(Enumerable.Repeat(chars, length) + .Select(s => s[random.Next(s.Length)]).ToArray()); + } + + public static string GetRandomString(int length, bool onlyLetters) + { + Random random = new Random(); + const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; + return new string(Enumerable.Repeat(chars, length) + .Select(s => s[random.Next(s.Length)]).ToArray()); + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/Replacer.cs b/PowerCrypt/Obfuscator/Methods/Replacer.cs new file mode 100644 index 0000000..a5b1b3a --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/Replacer.cs @@ -0,0 +1,20 @@ +using Spectre.Console; + +namespace PowerCrypt.Obfuscator.Methods +{ + public class Replacer + { + public static string Replace(string sourceText, int start, int length, string replacementText) + { + try + { + return sourceText.Remove(start, length).Insert(start, replacementText); + } + catch + { + AnsiConsole.MarkupInterpolated($"[red]Failed to replace text at position:[/] [yellow]{start}[/] [red]with length[/] [yellow]{length}[/] [red]to[/] [yellow]'{replacementText}'[/]\n"); + return sourceText; + } + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/StaticNumberObfuscation/NumberOBF.cs b/PowerCrypt/Obfuscator/Methods/StaticNumberObfuscation/NumberOBF.cs new file mode 100644 index 0000000..f5feccf --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/StaticNumberObfuscation/NumberOBF.cs @@ -0,0 +1,72 @@ +namespace PowerCrypt.Obfuscator.Methods.StaticNumberObfuscation +{ + public class NumberOBF + { + public static string ObfuscateNumber(string number) + { + if (!IsDecimalNumber(number)) + { + return number; + } + + return AddOrSubtractRandomEQ(number); + } + + private static bool IsDecimalNumber(string number) + { + return int.TryParse(number, out _); + } + + private static string AddOrSubtractRandomEQ(string numberToObf) + { + var random = new Random(); + var number1 = random.Next(1, 10000); + var signs = new[] { "+", "-" }; + var sign1 = signs[random.Next(0, 2)]; + var oppositeSign1 = sign1 == "+" ? "-" : "+"; + + var finalNumber = $"{numberToObf} {sign1} {number1}"; + var outFinal = EvaluateExpression(finalNumber); + + //1/4 chance to include a third number + if (random.Next(0, 4) == 0) + { + var number2 = random.Next(1, 10000); + var sign2 = signs[random.Next(0, 2)]; + var oppositeSign2 = sign2 == "+" ? "-" : "+"; + + finalNumber = $"{outFinal} {sign2} {number2}"; + outFinal = EvaluateExpression(finalNumber); + + var newProblem = $"{outFinal}{oppositeSign2}{number2}{oppositeSign1}{number1}"; + return $"({newProblem})"; + } + else + { + var newProblem = $"{outFinal}{oppositeSign1}{number1}"; + return $"({newProblem})"; + } + } + + private static int EvaluateExpression(string expression) + { + var result = 0; + var data = expression.Split(' '); + result = int.Parse(data[0]); + + var sign = data[1]; + var number = int.Parse(data[2]); + + if (sign == "+") + { + result += number; + } + else if (sign == "-") + { + result -= number; + } + + return result; + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBF.cs b/PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBF.cs new file mode 100644 index 0000000..8c38133 --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBF.cs @@ -0,0 +1,140 @@ +using System.Text; + +namespace PowerCrypt.Obfuscator.Methods.StringObfuscation +{ + public class StringOBF + { + public static string ObfuscateString(string input, string quoteType) + { + + if (input.Length < 3) + { + return input; + } + + string inputTrimQuotes = input.Substring(1, input.Length - 2); + + var methods = new Func[] { + ObfuscateStringBase64, + ObfuscateHexString, + ObfuscateMixedString, + ObfuscateByteArrayString, + }; + + var split = SplitStrings(inputTrimQuotes); + + var resultStringBuilder = new StringBuilder(); + foreach (var res in split) + { + var method = methods[new Random().Next(0, methods.Length)]; + resultStringBuilder.Append(method(res) + "+"); + } + + // we don't like trailing " + " + var result = resultStringBuilder.ToString(); + if (result.EndsWith('+')) + { + result = result.Substring(0, result.Length - 1); + } + + return $"({result})"; + } + + private static string ObfuscateStringBase64(string input) + { + var base64 = Convert.ToBase64String(Encoding.UTF8.GetBytes(input)); + string command = $"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('{base64}'))"; + return $"({command})"; + } + + private static string ObfuscateHexString(string input) + { + byte[] bytes = Encoding.UTF8.GetBytes(input); + string hexString = string.Join(",", bytes.Select(b => $"0x{b:x2}")); + string command = $"[System.Text.Encoding]::UTF8.GetString(([byte[]]({hexString})))"; + return $"({command})"; + } + + private static string ObfuscateByteArrayString(string input) + { + byte[] bytes = Encoding.UTF8.GetBytes(input); + string byteArrayString = "(" + string.Join(",", bytes) + ")"; + string command = $"[System.Text.Encoding]::UTF8.GetString([byte[]]{byteArrayString})"; + return $"({command})"; + } + + private static string ObfuscateMixedString(string input) + { + byte[] bytes = Encoding.UTF8.GetBytes(input); + string[] hexArray = bytes.Select(b => $"0x{b:x2}").ToArray(); + + string byteArrayString; + if (bytes.Length == 1) + { + byteArrayString = bytes[0].ToString(); + } + else + { + var random = new Random(); + var mixedArray = bytes.Select((b, i) => random.Next(0, 2) == 0 ? b.ToString() : hexArray[i]).ToArray(); + byteArrayString = "(" + string.Join(",", mixedArray) + ")"; + } + + string command = $"[System.Text.Encoding]::UTF8.GetString([byte[]]{byteArrayString})"; + return $"({command})"; + } + + public static string[] SplitStrings(string input) + { + int stringLength = input.Length; + if (stringLength < 2) + { + return [input]; + } + + var result = new List(); + int i = 0; + + Random random = new Random(); + + while (i < stringLength) + { + int chunkLength; + if (stringLength < 10) + { + chunkLength = random.Next(2, 5); + } + else if (stringLength < 50) + { + chunkLength = random.Next(15, 25); + } + else if (stringLength < 100) + { + chunkLength = random.Next(24, 50); + } + else if (stringLength < 200) + { + chunkLength = random.Next(50, 100); + } + else if (stringLength < 500) + { + chunkLength = random.Next(75, 200); + } + else if (stringLength < 1000) + { + chunkLength = random.Next(100, 300); + } + else + { + chunkLength = random.Next(200, 500); + } + + int length = Math.Min(chunkLength, stringLength - i); + result.Add(input.Substring(i, length)); + i += length; + } + + return result.ToArray(); + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBFStringConstantExpressionAstUnderMember.cs b/PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBFStringConstantExpressionAstUnderMember.cs new file mode 100644 index 0000000..1b2c58c --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/StringObfuscation/StringOBFStringConstantExpressionAstUnderMember.cs @@ -0,0 +1,31 @@ +using System.Text; + +namespace PowerCrypt.Obfuscator.Methods.StringObfuscation +{ + public class StringOBFStringConstantExpressionAstUnderMember + { + private static readonly string GoodChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + + public static string ObfuscateString(string str) + { + //TODO: FIX + //return str; + + var stringBuilder = new StringBuilder(); + + // for each character in the string, if the character is capital letter or number, then add a ` before it. + foreach (var c in str) + { + if (GoodChars.Contains(c)) + { + stringBuilder.Append('`'); + } + stringBuilder.Append(c); + } + + var outString = '"' + stringBuilder.ToString() + '"'; + + return outString; + } + } +} diff --git a/PowerCrypt/Obfuscator/Methods/VariableObfuscation/VariableOBF.cs b/PowerCrypt/Obfuscator/Methods/VariableObfuscation/VariableOBF.cs new file mode 100644 index 0000000..f0572e6 --- /dev/null +++ b/PowerCrypt/Obfuscator/Methods/VariableObfuscation/VariableOBF.cs @@ -0,0 +1,170 @@ +using System.Text; + +namespace PowerCrypt.Obfuscator.Methods.VariableObfuscation +{ + public class VariableOBF + { + private static readonly HashSet BadVars = new HashSet + { + "$$", "$?", "$^", "$_", "$args", "$ConsoleFileName", "$EnabledExperimentalFeatures", "$Error", + "$Event", "$EventArgs", "$EventSubscriber", "$ExecutionContext", "$foreach", "$HOME", "$Host", + "$input", "$IsCoreCLR", "$IsLinux", "$IsMacOS", "$IsWindows", "$LASTEXITCODE", "$Matches", + "$MyInvocation", "$NestedPromptLevel", "$PID", "$PROFILE", "$PSBoundParameters", "$PSCmdlet", + "$PSCommandPath", "$PSCulture", "$PSDebugContext", "$PSEdition", "$PSHOME", "$PSItem", "$PSScriptRoot", + "$PSSenderInfo", "$PSUICulture", "$PSVersionTable", "$PWD", "$Sender", "$ShellId", "$StackTrace", + "$switch", "$this", "$script", "$kdot_" + }; + + private static readonly HashSet BadStart = new HashSet { "$env:", "$script:", "$kdot_" }; + private static readonly string GoodChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + private static readonly Random Random = new(); + + public static string ObfuscateVariable(string variable, bool parameter) + { + foreach (var badPrefix in BadStart) + { + if (variable.StartsWith(badPrefix, StringComparison.Ordinal)) + { + return variable; + } + } + + if (BadVars.Contains(variable)) + { + return variable; + } + + switch (variable) + { + case "$true": + return ObfuscateTrue(); + case "$false": + return ObfuscateFalse(); + case "$null": + return ObfuscateNull(); + } + + var randomVarName = MakeRandomVariableName(10); + var newVarFinal = $"${RandomChangeVar(randomVarName, parameter)}"; + return newVarFinal; + } + + + public static string MakeRandomVariableName(int length) + { + const string chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; + var sb = new StringBuilder("KDOT"); + for (int i = 0; i < length; i++) + { + sb.Append(chars[Random.Next(chars.Length)]); + } + return sb.ToString(); + } + + public static string RandomCapitalization(string input) + { + var result = new StringBuilder(input.Length); + foreach (var c in input) + { + result.Append(Random.Next(2) == 0 ? char.ToUpper(c) : char.ToLower(c)); + } + return result.ToString(); + } + + public static string RandomChangeVar(string variable, bool parameter) + { + var varArray = variable.ToCharArray(); + var builder = new StringBuilder(); + + for (int i = 0; i < varArray.Length; i++) + { + //skip if the previous character was a tick or the character is not in GoodChars + if (i > 0 && varArray[i - 1] == '`') + { + continue; + } + + if (GoodChars.Contains(varArray[i])) + { + var randomCap = RandomCapitalization(varArray[i].ToString())[0]; + + if (!(parameter)) + { + if (char.IsUpper(randomCap) && Random.Next(2) == 0 && Random.Next(5) < 4) + { + builder.Append('`'); + } + } + + builder.Append(randomCap); + } + else + { + builder.Append(varArray[i]); + } + } + + var result = builder.ToString(); + + if (!(parameter)) + { + result = result.Insert(0, "{") + "}"; + } + + return result; + } + + + public static string ReObfuscateVariable(string variable) + { + if (variable.Contains('`')) + { + variable = variable.Replace("`", ""); + var variableNoBraces = variable.Substring(2, variable.Length - 3); + var varArray = variableNoBraces.ToCharArray(); + + var outString = new StringBuilder(); + + for (int i = 0; i < varArray.Length; i++) + { + var currentChar = RandomCapitalization(varArray[i].ToString()); + + if (GoodChars.Contains(currentChar)) + { + outString.Append('`' + currentChar); + } + else + { + outString.Append(currentChar); + + } + } + + var toReturn = "${" + outString.ToString() + "}"; + return toReturn; + } + + return new string(variable.Select(c => GoodChars.Contains(c) ? RandomCapitalization(c.ToString())[0] : c).ToArray()); + //return variable; + } + + public static string ObfuscateTrue() + { + var choices = new[] + { + "[bool][bool]", "[bool][char]", "[bool][int]", "[bool][string]", "[bool][double]", + "[bool][decimal]", "[bool][byte]", "[bool][timespan]", "[bool][datetime]", + "(9999 -eq 9999)", "([math]::Round([math]::PI) -eq (4583 - 4580))", + "[Math]::E -ne [Math]::PI", "[bool](![bool]$null)", + "!!!![bool][bool][bool][bool][bool][bool]", "![bool]$null", "![bool]$False", + "[bool][System.Collections.ArrayList]", "[bool][System.Collections.CaseInsensitiveComparer]", + "[bool][System.Collections.Hashtable]" + }; + + return $"({choices[Random.Next(choices.Length)]})"; + } + + public static string ObfuscateFalse() => "$false"; + public static string ObfuscateNull() => "$null"; + } +} diff --git a/PowerCrypt/Obfuscator/Obfuscator.cs b/PowerCrypt/Obfuscator/Obfuscator.cs new file mode 100644 index 0000000..911a0a2 --- /dev/null +++ b/PowerCrypt/Obfuscator/Obfuscator.cs @@ -0,0 +1,218 @@ +using PowerCrypt.Obfuscator.Helpers.globals; +using PowerCrypt.Obfuscator.Methods.Counters; +using PowerCrypt.Obfuscator.Methods.FunctionObfuscation; +using PowerCrypt.Obfuscator.Methods.StaticNumberObfuscation; +using PowerCrypt.Obfuscator.Methods.StringObfuscation; +using PowerCrypt.Obfuscator.Methods.VariableObfuscation; +using PowerCrypt.Obfuscator.Passes; +using Spectre.Console; +using System.Management.Automation.Language; +using System.Text; + +namespace PowerCrypt.Obfuscator +{ + public class PowershellObfuscator + { + + public static string ObfuscateScript(string scriptContent) + { + scriptContent = PrePass.DoPrePrePass(scriptContent); + + //return scriptContent; + + scriptContent = RemoveCommentsAndJunk(scriptContent); + //return scriptContent; + + ScriptBlockAst ast = ParseScript(scriptContent); + + var functionReplacementMap = new Dictionary(); + var variableReplacementMap = new Dictionary(); + var parameterReplacementMap = new Dictionary(); + var stringReplacementMap = new Dictionary(); + var numberReplacementMap = new Dictionary(); + var functionNamesIgnore = new HashSet { "CheckValidationResult" }; + + ProcessFunctionDefinitions(ast, functionReplacementMap, parameterReplacementMap, variableReplacementMap); + ProcessVariables(ast, variableReplacementMap, parameterReplacementMap); + ProcessStrings(ast, stringReplacementMap); + ProcessNumbers(ast, numberReplacementMap); + + var allReplacements = FirstPass.CollectFirstPassReplacements(ast, functionReplacementMap, parameterReplacementMap, variableReplacementMap, stringReplacementMap, numberReplacementMap, functionNamesIgnore); + + scriptContent = FirstPass.ApplyReplacements(scriptContent, allReplacements, functionReplacementMap, parameterReplacementMap, variableReplacementMap, stringReplacementMap, numberReplacementMap); + + //return scriptContent; + + ast = ParseScript(scriptContent); + var allReplacements2 = SecondPass.CollectSecondPassReplacements(ast, functionReplacementMap); + scriptContent = SecondPass.ApplyReplacements(scriptContent, allReplacements2); + + //return scriptContent; + + ast = ParseScript(scriptContent); + var allReplacements3 = ThirdPass.CollectThirdPassReplacements(ast); + scriptContent = ThirdPass.ApplyReplacements(scriptContent, allReplacements3); + + //return scriptContent; + + scriptContent = FourthPass.ProcessScript(scriptContent); + + AnsiConsole.MarkupInterpolated($"[green]Obfuscated {Counter.GetTransformations()} objects in the script[/]\n"); + + return scriptContent; + } + + private static ScriptBlockAst ParseScript(string scriptContent) + { + ScriptBlockAst ast = Parser.ParseInput(scriptContent, out _, out ParseError[] errorsOut); + + if (errorsOut.Length != 0) + { + AnsiConsole.MarkupLine("[red]Failed to parse script, but continuing anyway.[/]"); + } + + return ast; + } + + private static void ProcessFunctionDefinitions(ScriptBlockAst ast, Dictionary functionReplacementMap, Dictionary parameterReplacementMap, Dictionary variableReplacementMap) + { + var functionDefinitions = ast.FindAll(a => a is FunctionDefinitionAst, searchNestedScriptBlocks: true) + .Cast(); + + foreach (var func in functionDefinitions) + { + if (!functionReplacementMap.ContainsKey(func.Name)) + { + string obfuscatedFunctionName = FunctionOBF.ObfuscateFunctionSimple(func.Name); + + Globals.AddUsedFunction(obfuscatedFunctionName); + + functionReplacementMap[func.Name] = obfuscatedFunctionName; + } + + //handle parameters in function definition + if (func.Parameters != null) + { + foreach (var param in func.Parameters) + { + var paramName = param.Name.VariablePath.UserPath; + if (!parameterReplacementMap.ContainsKey(paramName)) + { + var newParamName = VariableOBF.ObfuscateVariable(paramName, true); + parameterReplacementMap[paramName] = newParamName.TrimStart('$'); + variableReplacementMap[paramName] = newParamName; + } + } + } + + if (func.Body.ParamBlock != null) + { + foreach (var param in func.Body.ParamBlock.Parameters) + { + var paramName = param.Name.VariablePath.UserPath; + if (!parameterReplacementMap.ContainsKey(paramName)) + { + var newParamName = VariableOBF.ObfuscateVariable(paramName, true); + parameterReplacementMap[paramName] = newParamName.TrimStart('$'); + variableReplacementMap[paramName] = newParamName; + } + } + } + } + } + + private static void ProcessVariables(ScriptBlockAst ast, Dictionary variableReplacementMap, Dictionary parameterReplacementMap) + { + var variableAsts = ast.FindAll(a => a is VariableExpressionAst, searchNestedScriptBlocks: true) + .Cast(); + + foreach (var variable in variableAsts) + { + var varName = variable.VariablePath.UserPath; + if (!variableReplacementMap.ContainsKey(varName) && !parameterReplacementMap.ContainsKey(varName)) + { + string variableObfuscated = VariableOBF.ObfuscateVariable(variable.Extent.Text, false); + + Globals.AddUsedVariable(variableObfuscated); + + variableReplacementMap[varName] = variableObfuscated; + } + } + } + + private static void ProcessNumbers(ScriptBlockAst ast, Dictionary numberReplacementMap) + { + var numberAsts = ast.FindAll(a => a is ConstantExpressionAst constantAst && constantAst.StaticType == typeof(int), searchNestedScriptBlocks: true) + .Cast(); + foreach (var numberAst in numberAsts) + { + var numberText = numberAst.Extent.Text; + if (!numberReplacementMap.ContainsKey(numberText)) + { + numberReplacementMap[numberText] = NumberOBF.ObfuscateNumber(numberText); + } + } + } + + private static void ProcessStrings(ScriptBlockAst ast, Dictionary stringReplacementMap) + { + var stringAsts = ast.FindAll(a => a is StringConstantExpressionAst stringAst && + (stringAst.StringConstantType == StringConstantType.DoubleQuoted || + stringAst.StringConstantType == StringConstantType.SingleQuoted), + searchNestedScriptBlocks: true) + .Cast(); + + foreach (var stringAst in stringAsts) + { + var stringText = stringAst.Extent.Text; + + if (!stringReplacementMap.ContainsKey(stringText)) + { + var quoteType = stringText.StartsWith("'") ? "SingleQuoted" : "DoubleQuoted"; + stringReplacementMap[stringText] = "(" + StringOBF.ObfuscateString(stringText, quoteType) + ")"; + } + } + } + + private static string RemoveCommentsAndJunk(string scriptContent) + { + ScriptBlockAst ast = Parser.ParseInput(scriptContent, out Token[] tokens, out ParseError[] errors); + if (errors.Length > 0) + { + //throw new Exception($"Failed to parse PowerShell script: {string.Join(", ", errors.Select(e => e.Message))}"); + //sometimes the parser gets a little confused but no erros are actually present + AnsiConsole.MarkupLine("[red]Failed to parse script, but continuing anyway.[/]"); + } + + var sb = new StringBuilder(); + int lastIndex = 0; + + //iterate through tokens and skip comments + foreach (var token in tokens) + { + if (token.Kind == TokenKind.Comment) + { + sb.Append(scriptContent, lastIndex, token.Extent.StartOffset - lastIndex); + lastIndex = token.Extent.EndOffset; + } + } + + //append the remaining content after the last comment + sb.Append(scriptContent, lastIndex, scriptContent.Length - lastIndex); + + //now remove all empty lines that aren't inside of a string or anything. Just empty lines within the script. + var lines = sb.ToString().Split('\n'); + sb.Clear(); + foreach (var line in lines) + { + if (line.Trim().Length > 0) + { + sb.Append(line); + } + } + + return sb.ToString(); + } + + } +} diff --git a/PowerCrypt/Obfuscator/Passes/FirstPass.cs b/PowerCrypt/Obfuscator/Passes/FirstPass.cs new file mode 100644 index 0000000..5b083c3 --- /dev/null +++ b/PowerCrypt/Obfuscator/Passes/FirstPass.cs @@ -0,0 +1,232 @@ +using PowerCrypt.Obfuscator.Methods; +using PowerCrypt.Obfuscator.Methods.Counters; +using PowerCrypt.Obfuscator.Methods.StaticNumberObfuscation; +using PowerCrypt.Obfuscator.Methods.StringObfuscation; +using PowerCrypt.Obfuscator.Methods.VariableObfuscation; +using PowerCrypt.Settings; +using Spectre.Console; +using System.Management.Automation.Language; + +namespace PowerCrypt.Obfuscator.Passes +{ + public class FirstPass + { + public static List CollectFirstPassReplacements(ScriptBlockAst ast, Dictionary functionReplacementMap, Dictionary parameterReplacementMap, Dictionary variableReplacementMap, Dictionary stringReplacementMap, Dictionary numberReplacementMap, HashSet functionNamesIgnore) + { + var allReplacements = new List(); + + //function defs + var functionDefinitions = ast.FindAll(a => a is FunctionDefinitionAst, searchNestedScriptBlocks: true) + .Cast(); + + foreach (var func in functionDefinitions) + { + if (functionNamesIgnore.Contains(func.Name)) continue; + + const string functionKeyword = "function "; + var fullStartOffset = func.Extent.StartOffset; + var nameStartOffset = func.Extent.StartOffset; + + //find actual start of function name by checking for the keyword + if (func.Extent.Text.TrimStart().ToLower().StartsWith(functionKeyword)) + { + nameStartOffset = fullStartOffset + func.Extent.Text.ToLower().IndexOf(functionKeyword) + functionKeyword.Length; + } + + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = nameStartOffset, + Length = func.Name.Length, + OriginalName = func.Name, + Text = func.Name, + Type = "Function", + RequiresKeyword = true + }); + } + + //command calls + var commandAsts = ast.FindAll(a => a is CommandAst, searchNestedScriptBlocks: true) + .Cast(); + + foreach (var call in commandAsts) + { + var commandName = call.CommandElements[0].Extent.Text; + + if (functionNamesIgnore.Contains(commandName)) continue; + + if (functionReplacementMap.ContainsKey(commandName)) + { + //verify the replacement exists and is valid + var newName = functionReplacementMap[commandName]; + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = call.CommandElements[0].Extent.StartOffset, + Length = commandName.Length, + OriginalName = commandName, + Text = commandName, + Type = "Function", + RequiresKeyword = false // function calls don't need the keyword + }); + + //process parameters + for (int i = 1; i < call.CommandElements.Count; i++) + { + var element = call.CommandElements[i]; + if (element.Extent.Text.StartsWith('-')) + { + var paramName = element.Extent.Text.TrimStart('-'); + if (parameterReplacementMap.ContainsKey(paramName)) + { + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = element.Extent.StartOffset, + Length = element.Extent.Text.Length, + OriginalName = paramName, + Text = "-" + paramName, + Type = "ParameterName", + RequiresKeyword = false + }); + } + } + } + } + } + + //variable expressions + var variableAsts = ast.FindAll(a => a is VariableExpressionAst, searchNestedScriptBlocks: true) + .Cast(); + + foreach (var variable in variableAsts) + { + var varName = variable.VariablePath.UserPath; + var parent = variable.Parent; + var isParameterName = false; + while (parent != null) + { + if (parent is CommandAst commandAst) + { + isParameterName = commandAst.CommandElements.Any(e => e.Extent.Text == "-" + variable.Extent.Text); + if (isParameterName) break; + } + parent = parent.Parent; + } + + if (!isParameterName) + { + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = variable.Extent.StartOffset, + Length = variable.Extent.Text.Length, + OriginalName = varName, + Text = variable.Extent.Text, + Type = "Variable", + RequiresKeyword = false + }); + } + } + + //string constants + var stringAsts = ast.FindAll(a => a is StringConstantExpressionAst stringAst && + (stringAst.StringConstantType == StringConstantType.DoubleQuoted || + stringAst.StringConstantType == StringConstantType.SingleQuoted), + searchNestedScriptBlocks: true) + .Cast(); + + foreach (var stringAst in stringAsts) + { + var stringText = stringAst.Extent.Text; + + //handle empty strings + if (stringText == "''" || stringText == "\"\"") + { + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = stringAst.Extent.StartOffset, + Length = stringAst.Extent.Text.Length, + OriginalName = stringText, + Text = "([string]::Empty)", + Type = "EmptyString", + RequiresKeyword = false + }); + continue; + } + + if (!stringReplacementMap.ContainsKey(stringText)) + { + var quoteType = stringText.StartsWith("'") ? "SingleQuoted" : "DoubleQuoted"; + stringReplacementMap[stringText] = "(" + StringOBF.ObfuscateString(stringText, quoteType) + ")"; + } + + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = stringAst.Extent.StartOffset, + Length = stringAst.Extent.Text.Length, + OriginalName = stringText, + Text = stringAst.Extent.Text, + Type = "String", + RequiresKeyword = false + }); + } + + var numberAsts = ast.FindAll(a => a is ConstantExpressionAst constantAst && constantAst.StaticType == typeof(int), searchNestedScriptBlocks: true) + .Cast(); + + foreach (var numberAst in numberAsts) + { + var numberText = numberAst.Extent.Text; + if (!numberReplacementMap.ContainsKey(numberText)) + { + numberReplacementMap[numberText] = NumberOBF.ObfuscateNumber(numberText); + } + + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = numberAst.Extent.StartOffset, + Length = numberAst.Extent.Text.Length, + OriginalName = numberText, + Text = numberText, + Type = "Number", + RequiresKeyword = false + }); + } + + return allReplacements; + } + + public static string ApplyReplacements(string scriptContent, List allReplacements, Dictionary functionReplacementMap, Dictionary parameterReplacementMap, Dictionary variableReplacementMap, Dictionary stringReplacementMap, Dictionary numberReplacementMap) + { + allReplacements = allReplacements.OrderByDescending(r => r.StartOffset).ToList(); + + foreach (var replacement in allReplacements) + { + string newName = replacement.Type switch + { + "Function" => functionReplacementMap[replacement.OriginalName], + "ParameterName" => "-" + parameterReplacementMap[replacement.OriginalName], + "Variable" => variableReplacementMap[replacement.OriginalName], + "String" => stringReplacementMap[replacement.OriginalName], + "Command" => replacement.Text, + "Number" => numberReplacementMap[replacement.OriginalName], + "EmptyString" => "([string]::Empty)", + _ => replacement.Text + }; + + if (replacement.Type == "Variable") + { + newName = VariableOBF.ReObfuscateVariable(newName); + } + + if (AppSettings.PrintToScreen) + { + AnsiConsole.MarkupInterpolated($"[yellow]First Pass - Replacing[/] [red]'{replacement.OriginalName}'[/] [yellow]at position[/] [green]{replacement.StartOffset}[/] [yellow]with[/] [blue]'{newName}'[/] [yellow](Type: {replacement.Type})[/]\n"); + } + + Counter.Increment(); + + scriptContent = Replacer.Replace(scriptContent, replacement.StartOffset, replacement.Length, newName); + } + + return scriptContent; + } + } +} diff --git a/PowerCrypt/Obfuscator/Passes/FourthPass.cs b/PowerCrypt/Obfuscator/Passes/FourthPass.cs new file mode 100644 index 0000000..dee20bb --- /dev/null +++ b/PowerCrypt/Obfuscator/Passes/FourthPass.cs @@ -0,0 +1,87 @@ +using PowerCrypt.Obfuscator.Helpers.globals; +using PowerCrypt.Obfuscator.Methods; +using PowerCrypt.Obfuscator.Methods.Counters; +using PowerCrypt.Obfuscator.Methods.GeneralControlFlowPostOBF; +using PowerCrypt.Settings; +using Spectre.Console; +using System.Management.Automation.Language; + +namespace PowerCrypt.Obfuscator.Passes +{ + public class FourthPass + { + private static List CollectReplacements(ScriptBlockAst ast, bool isFunction) + { + var allReplacements = new List(); + var nodes = isFunction + ? ast.FindAll(a => a is FunctionDefinitionAst, searchNestedScriptBlocks: true) + .Where(func => !func.FindAll(inner => inner is FunctionDefinitionAst && inner != func, searchNestedScriptBlocks: true).Any()) + : ast.FindAll(a => a is IfStatementAst || a is ForStatementAst || a is ForEachStatementAst, searchNestedScriptBlocks: true) + .Where(stmt => !stmt.FindAll(inner => (inner is IfStatementAst || inner is ForStatementAst || inner is ForEachStatementAst) && inner != stmt, searchNestedScriptBlocks: true).Any() && + !stmt.FindAll(inner => inner is ReturnStatementAst, searchNestedScriptBlocks: true).Any()); + + foreach (var node in nodes) + { + if (isFunction && ((FunctionDefinitionAst)node).Name.Equals(Globals.CompressFunctionName)) + { + continue; + } + + string obfuscatedText = WrapOBF.ObfuscateWithWrap(node.Extent.Text); + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = node.Extent.StartOffset, + Length = node.Extent.Text.Length, + OriginalName = node.Extent.Text, + Text = obfuscatedText, + Type = node.GetType().Name, + RequiresKeyword = false + }); + } + + return allReplacements; + } + + private static string ApplyReplacements(string scriptContent, List allReplacements) + { + allReplacements = allReplacements.OrderByDescending(r => r.StartOffset).ToList(); + + foreach (var replacement in allReplacements) + { + if (AppSettings.PrintToScreen) + { + AnsiConsole.MarkupInterpolated($"[yellow]First Pass - Replacing[/] [red]'{replacement.OriginalName}'[/] [yellow]at position[/] [green]{replacement.StartOffset}[/] [yellow]with[/] [blue]'{replacement.Text}'[/] [yellow](Type: {replacement.Type})[/]\n"); + } + + Counter.Increment(); + scriptContent = Replacer.Replace(scriptContent, replacement.StartOffset, replacement.Length, replacement.Text); + } + + return scriptContent; + } + + public static string ProcessScript(string scriptContent) + { + ScriptBlockAst ast = (ScriptBlockAst)Parser.ParseInput(scriptContent, out _, out _); + var allReplacements = CollectReplacements(ast, isFunction: false); + + while (allReplacements.Any()) + { + scriptContent = ApplyReplacements(scriptContent, allReplacements); + ast = (ScriptBlockAst)Parser.ParseInput(scriptContent, out _, out _); + allReplacements = CollectReplacements(ast, isFunction: false); + } + + var allFunctionReplacements = CollectReplacements(ast, isFunction: true); + + while (allFunctionReplacements.Any()) + { + scriptContent = ApplyReplacements(scriptContent, allFunctionReplacements); + ast = (ScriptBlockAst)Parser.ParseInput(scriptContent, out _, out _); + allFunctionReplacements = CollectReplacements(ast, isFunction: true); + } + + return scriptContent; + } + } +} diff --git a/PowerCrypt/Obfuscator/Passes/LastPass.cs b/PowerCrypt/Obfuscator/Passes/LastPass.cs new file mode 100644 index 0000000..75adace --- /dev/null +++ b/PowerCrypt/Obfuscator/Passes/LastPass.cs @@ -0,0 +1,12 @@ +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Threading.Tasks; + +namespace PowerCrypt.Obfuscator.Passes +{ + public class LastPass + { + } +} diff --git a/PowerCrypt/Obfuscator/Passes/PrePass.cs b/PowerCrypt/Obfuscator/Passes/PrePass.cs new file mode 100644 index 0000000..7cdd063 --- /dev/null +++ b/PowerCrypt/Obfuscator/Passes/PrePass.cs @@ -0,0 +1,100 @@ +using PowerCrypt.Obfuscator.Helpers.globals; +using Spectre.Console; +using System.Management.Automation.Language; +using System.Text; + +namespace PowerCrypt.Obfuscator.Passes +{ + public class PrePass + { + private static readonly string _decryptCode = """ + function DecodeAndDecompressString {param ([string] $inputString);$compressedBytes = [Convert]::FromBase64String($inputString);$memoryStream = [System.IO.MemoryStream]::new($compressedBytes);$decompressedStream = [System.IO.Compression.GzipStream]::new($memoryStream, [System.IO.Compression.CompressionMode]::Decompress);$decompressedStream = [System.IO.Compression.GzipStream]::new([System.IO.MemoryStream]::new($compressedBytes), [System.IO.Compression.CompressionMode]::Decompress);$decompressedStreamReader = [System.IO.StreamReader]::new($decompressedStream);$decompressedString = $decompressedStreamReader.ReadToEnd();return $decompressedString} + + """; + + public static string DoPrePrePass(string code) + { + Globals.CompressFunctionName = "DecodeAndDecompressString"; + + ScriptBlockAst ast = (ScriptBlockAst)Parser.ParseInput(code, out _, out _); + var firstNamedBlock = ast.FindAll(item => item is NamedBlockAst, false).FirstOrDefault() as NamedBlockAst; + + if (firstNamedBlock != null) + { + var firstChild = firstNamedBlock.FindAll(item => !(item is NamedBlockAst), true) + .FirstOrDefault(); + + if (firstChild != null) + { + int insertPosition = firstChild.Extent.StartOffset; + AnsiConsole.MarkupInterpolated($"[yellow]First child found; inserting decrypt code at position {insertPosition}[/]\n"); + code = code.Insert(insertPosition, _decryptCode); + } + else + { + AnsiConsole.MarkupLine("[red]No first child found; prepending decrypt code.[/]"); + code = _decryptCode + code; + } + } + else + { + AnsiConsole.MarkupLine("[red]No first named block found; prepending decrypt code.[/]"); + code = _decryptCode + code; + } + + //code = ObfuscateControlFlow(code); + code = SplitExpandableStrings(code); + + return code; + } + + + public static string SplitExpandableStrings(string code) + { + ScriptBlockAst ast = (ScriptBlockAst)Parser.ParseInput(code, out _, out _); + var expandableStrings = ast.FindAll(item => item is ExpandableStringExpressionAst, true).ToList(); + + var obfuscatedCode = new StringBuilder(code); + + foreach (ExpandableStringExpressionAst expandableString in expandableStrings) + { + var parts = new List(); + int lastIndex = expandableString.Extent.StartOffset; + + foreach (var nestedAst in expandableString.NestedExpressions) + { + if (nestedAst.Extent.StartOffset > lastIndex) + { + string plainText = code.Substring(lastIndex, nestedAst.Extent.StartOffset - lastIndex); + if (!string.IsNullOrEmpty(plainText)) + { + parts.Add($"\"{plainText}\""); + } + } + + parts.Add(nestedAst.Extent.Text); + lastIndex = nestedAst.Extent.EndOffset; + } + + if (lastIndex < expandableString.Extent.EndOffset) + { + string remainingText = code.Substring(lastIndex, expandableString.Extent.EndOffset - lastIndex); + if (!string.IsNullOrEmpty(remainingText)) + { + parts.Add($"\"{remainingText}\""); + } + } + + string newExpression = $"{string.Join(" + ", parts)}"; + newExpression = newExpression.Substring(1, newExpression.Length - 2); + + newExpression = $"({newExpression})"; + + obfuscatedCode.Replace(expandableString.Extent.Text, newExpression); + } + string output = obfuscatedCode.ToString(); + + return output; + } + } +} diff --git a/PowerCrypt/Obfuscator/Passes/SecondPass.cs b/PowerCrypt/Obfuscator/Passes/SecondPass.cs new file mode 100644 index 0000000..d06b87f --- /dev/null +++ b/PowerCrypt/Obfuscator/Passes/SecondPass.cs @@ -0,0 +1,127 @@ +using PowerCrypt.Obfuscator.Methods; +using PowerCrypt.Obfuscator.Methods.CommandTypeAndBareWordObfuscation; +using PowerCrypt.Obfuscator.Methods.Counters; +using PowerCrypt.Obfuscator.Methods.MixedBooleanArithmetic; +using PowerCrypt.Settings; +using Spectre.Console; +using System.Management.Automation.Language; + +namespace PowerCrypt.Obfuscator.Passes +{ + public class SecondPass + { + public static List CollectSecondPassReplacements(ScriptBlockAst ast, Dictionary functionReplacementMap) + { + var allReplacements = new List(); + + var barewordAsts = ast.FindAll(testAst => + (testAst is StringConstantExpressionAst stringAst && stringAst.StringConstantType == StringConstantType.BareWord) || + testAst is TypeExpressionAst, true); + + foreach (var bareword in barewordAsts) + { + if (functionReplacementMap.ContainsKey(bareword.Extent.Text)) + { + continue; + } + + if (bareword.Extent.Text.Length > 100) + { + continue; + } + + bool isFunctionCall = false; + if (bareword.Parent is CommandAst commandAst) + { + var commandElements = commandAst.CommandElements; + isFunctionCall = commandElements[0].Extent.Text == bareword.Extent.Text; + + if (!isFunctionCall) + { + continue; + } + } + + string newBareWordName; + if (isFunctionCall) + { + newBareWordName = CommandOBF.ObfuscateCommand(bareword.Extent.Text); + } + else + { + newBareWordName = CommandOBF.ObfuscateCommonBareWord(bareword.Extent.Text); + } + + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = bareword.Extent.StartOffset, + Length = bareword.Extent.Text.Length, + OriginalName = bareword.Extent.Text, + Text = newBareWordName, + Type = "Bareword", + RequiresKeyword = false, + }); + } + + var binaryExpressionAsts = ast.FindAll(testAst => + testAst is BinaryExpressionAst binaryAst && + new[] { TokenKind.Plus, TokenKind.Minus, TokenKind.Band, TokenKind.Bxor, TokenKind.Bor }.Contains(binaryAst.Operator), true); + + foreach (var binary in binaryExpressionAsts) + { + if (binary is BinaryExpressionAst binaryAst) + { + var left = binaryAst.Left; + var right = binaryAst.Right; + + if (left is ConstantExpressionAst && right is ConstantExpressionAst) + { + var text = binaryAst.Extent.Text; + var obfuscated = MBAOBF.ApplyMBAObfuscation(left.Extent.Text, right.Extent.Text, binaryAst.Operator.ToString(), 4); + + if (obfuscated == null) + { + continue; + } + + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = binaryAst.Extent.StartOffset, + Length = binaryAst.Extent.Text.Length, + OriginalName = text, + Text = obfuscated, + Type = "Binary", + RequiresKeyword = false, + }); + } + } + } + + return allReplacements; + } + + public static string ApplyReplacements(string scriptContent, List allReplacements) + { + allReplacements = allReplacements.OrderByDescending(r => r.StartOffset).ToList(); + + foreach (var replacement in allReplacements) + { + string newName = replacement.Type switch + { + _ => replacement.Text + }; + + if (AppSettings.PrintToScreen) + { + AnsiConsole.MarkupInterpolated($"[yellow]First Pass - Replacing[/] [red]'{replacement.OriginalName}'[/] [yellow]at position[/] [green]{replacement.StartOffset}[/] [yellow]with[/] [blue]'{newName}'[/] [yellow](Type: {replacement.Type})[/]\n"); + } + + Counter.Increment(); + + scriptContent = Replacer.Replace(scriptContent, replacement.StartOffset, replacement.Length, newName); + } + + return scriptContent; + } + } +} diff --git a/PowerCrypt/Obfuscator/Passes/ThirdPass.cs b/PowerCrypt/Obfuscator/Passes/ThirdPass.cs new file mode 100644 index 0000000..7b7b1e3 --- /dev/null +++ b/PowerCrypt/Obfuscator/Passes/ThirdPass.cs @@ -0,0 +1,79 @@ +using PowerCrypt.Obfuscator.Methods; +using PowerCrypt.Obfuscator.Methods.Counters; +using PowerCrypt.Obfuscator.Methods.StringObfuscation; +using PowerCrypt.Settings; +using Spectre.Console; +using System.Management.Automation.Language; + +namespace PowerCrypt.Obfuscator.Passes +{ + public class ThirdPass + { + public static List CollectThirdPassReplacements(ScriptBlockAst ast) + { + var allReplacements = new List(); + var processedStrings = new HashSet<(int StartOffset, string Value)>(); + + //find all InvokeMemberExpressionAst nodes + var memberInvocations = ast.FindAll(a => a is InvokeMemberExpressionAst, searchNestedScriptBlocks: true) + .Cast(); + + foreach (var invocation in memberInvocations) + { + //find string constants within this invocation that are NOT single or double quoted + var stringConstants = invocation.FindAll(a => a is StringConstantExpressionAst stringAst && + !(stringAst.StringConstantType == StringConstantType.DoubleQuoted || + stringAst.StringConstantType == StringConstantType.SingleQuoted), + searchNestedScriptBlocks: true) + .Cast(); + + foreach (var stringConstant in stringConstants) + { + var key = (stringConstant.Extent.StartOffset, stringConstant.Value); + if (!processedStrings.Contains(key)) + { + var newString = StringOBFStringConstantExpressionAstUnderMember.ObfuscateString(stringConstant.Value); + + allReplacements.Add(new ReplacementMapUniversal + { + StartOffset = stringConstant.Extent.StartOffset, + Length = stringConstant.Extent.Text.Length, + OriginalName = stringConstant.Extent.Text, + Text = newString, + Type = "WeirdMethodString", + RequiresKeyword = false + }); + + processedStrings.Add(key); + } + } + } + + return allReplacements; + } + + public static string ApplyReplacements(string scriptContent, List allReplacements) + { + allReplacements = allReplacements.OrderByDescending(r => r.StartOffset).ToList(); + + foreach (var replacement in allReplacements) + { + string newName = replacement.Type switch + { + _ => replacement.Text + }; + + if (AppSettings.PrintToScreen) + { + AnsiConsole.MarkupInterpolated($"[yellow]First Pass - Replacing[/] [red]'{replacement.OriginalName}'[/] [yellow]at position[/] [green]{replacement.StartOffset}[/] [yellow]with[/] [blue]'{newName}'[/] [yellow](Type: {replacement.Type})[/]\n"); + } + + Counter.Increment(); + + scriptContent = Replacer.Replace(scriptContent, replacement.StartOffset, replacement.Length, newName); + } + + return scriptContent; + } + } +} diff --git a/PowerCrypt/PowerCrypt.csproj b/PowerCrypt/PowerCrypt.csproj new file mode 100644 index 0000000..52725d0 --- /dev/null +++ b/PowerCrypt/PowerCrypt.csproj @@ -0,0 +1,19 @@ + + + + Exe + net9.0 + enable + enable + True + true + true + true + + + + + + + + diff --git a/PowerCrypt/Program.cs b/PowerCrypt/Program.cs new file mode 100644 index 0000000..280ef0d --- /dev/null +++ b/PowerCrypt/Program.cs @@ -0,0 +1,80 @@ +using PowerCrypt.Obfuscator; +using Spectre.Console; + +namespace PowerCrypt +{ + public class Program + { + public static void Main(string[] args) + { + var startTime = DateTime.Now; + var file_location = string.Empty; + string outputLocation = string.Empty; + + if (args.Length == 0) + { + AnsiConsole.MarkupLine("[bold red]No arguments provided. Asking for file path...[/]"); + + //file_location = "C:\\Users\\this1\\Desktop\\Software\\Somalifuscator-Powershell-Edition\\main.ps1"; + + file_location = AnsiConsole.Prompt(new TextPrompt("[bold blue]Enter the location of the powershell code to obfuscate\n->[/]") + .Validate(path => System.IO.File.Exists(path) ? ValidationResult.Success() : ValidationResult.Error("[bold red]File does not exist or path input is incorrect.[/]")) + ); + + } + else + { + if (File.Exists(args[0])) + { + file_location = args[0]; + outputLocation = args.Length > 1 ? args[1] : string.Empty; + } + else + { + AnsiConsole.MarkupLine("[bold red]File does not exist or path input is incorrect.[/]"); + return; + } + } + + var textpath = new TextPath(file_location) + { + RootStyle = new Style(foreground: Color.Red), + SeparatorStyle = new Style(foreground: Color.Green), + StemStyle = new Style(foreground: Color.Blue), + LeafStyle = new Style(foreground: Color.Red) + }; + + AnsiConsole.Write(textpath); + AnsiConsole.Write("\n"); + + var obfuscation = PowershellObfuscator.ObfuscateScript(File.ReadAllText(file_location)); + + AnsiConsole.MarkupLine("[bold green]Obfuscation complete![/]"); + + //write the content out as the file name + _obf.ps1 + var obf_file = file_location.Replace(".ps1", "_obf.ps1"); + + if (!string.IsNullOrEmpty(outputLocation)) + { + obf_file = outputLocation; + } + File.WriteAllText(obf_file, obfuscation); + + var endTime = DateTime.Now; + var timeDiff = endTime - startTime; + + AnsiConsole.MarkupLine($"Obfuscation took [bold green]{timeDiff.Hours}[/] hours, [bold green]{timeDiff.Minutes}[/] minutes, [bold green]{timeDiff.Seconds}[/] seconds, [bold green]{timeDiff.Milliseconds}[/] milliseconds"); + + var obf_textpath = new TextPath(obf_file) + { + RootStyle = new Style(foreground: Color.Red), + SeparatorStyle = new Style(foreground: Color.Green), + StemStyle = new Style(foreground: Color.Blue), + LeafStyle = new Style(foreground: Color.Red) + }; + + AnsiConsole.Write(obf_textpath); + Console.WriteLine("\n"); + } + } +} \ No newline at end of file diff --git a/PowerCrypt/Properties/launchSettings.json b/PowerCrypt/Properties/launchSettings.json new file mode 100644 index 0000000..f37f84e --- /dev/null +++ b/PowerCrypt/Properties/launchSettings.json @@ -0,0 +1,11 @@ +{ + "profiles": { + "PowerCrypt": { + "commandName": "Project" + }, + "WSL": { + "commandName": "WSL2", + "distributionName": "" + } + } +} \ No newline at end of file diff --git a/PowerCrypt/Settings/Settings.cs b/PowerCrypt/Settings/Settings.cs new file mode 100644 index 0000000..dcd363a --- /dev/null +++ b/PowerCrypt/Settings/Settings.cs @@ -0,0 +1,7 @@ +namespace PowerCrypt.Settings +{ + public class AppSettings + { + public static bool PrintToScreen { get; set; } = false; + } +} diff --git a/PowerCrypt/new_things.txt b/PowerCrypt/new_things.txt new file mode 100644 index 0000000..9264375 --- /dev/null +++ b/PowerCrypt/new_things.txt @@ -0,0 +1,10 @@ +NamedAttributeArgumentAst +ParamBlockAst +ScriptBlockAst +AttributeAst +BinaryExpressionAst +HashtableAst +CommandAst +AssignmentStatementAst +TypeExpressionsAst +TypeConstraintAst \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..754ed96 --- /dev/null +++ b/README.md @@ -0,0 +1 @@ +# PowerCrypt \ No newline at end of file