admin/wietze-ArgFuscator
1
0
Fork 0
mirror of https://github.com/wietze/ArgFuscator.net synced 2026-06-08 18:17:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improving *nix path recognition

Browse Source
This commit is contained in:
Wietze
2026-02-06 15:16:11 +00:00
parent d623f56291
commit 9fac4c5b73
3 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/security.json
+1 -1
View File
@@ -1 +1 @@
{"versions":{"argfuscator":"2.0","format":"2.0"},"profiles":[{"executableVersion":null,"platform":"mac","operatingSystem":"macOS","operatingSystemVersion":"Tahoe 26.2","parameters":{"command":[{"command":"security"},{"value":"dump-keychain"},{"argument":"-a"}],"modifiers":{"FilePathTransformer":{"AppliesTo":["path"],"Probability":"0.5","PathTraversal":true,"SubstituteSlashes":false,"ExtraSlashes":true,"ValidFilePaths":true},"Shorthands":{"AppliesTo":["value"],"Probability":"0.5","CaseSensitive":true},"RandomCase":{"AppliesTo":["command", "path"],"Probability":"0.5"}},"arguments":[{"Arguments":["help"],"ValueCount":0},{"Arguments":["list-keychains"],"ValueCount":0},{"Arguments":["default-keychain"],"ValueCount":0},{"Arguments":["login-keychain"],"ValueCount":0},{"Arguments":["create-keychain"],"ValueCount":0},{"Arguments":["delete-keychain"],"ValueCount":0},{"Arguments":["lock-keychain"],"ValueCount":0},{"Arguments":["unlock-keychain"],"ValueCount":0},{"Arguments":["set-keychain-settings"],"ValueCount":0},{"Arguments":["set-keychain-password"],"ValueCount":0},{"Arguments":["show-keychain-info"],"ValueCount":0},{"Arguments":["dump-keychain"],"ValueCount":0},{"Arguments":["create-keypair"],"ValueCount":0},{"Arguments":["add-generic-password"],"ValueCount":0},{"Arguments":["add-internet-password"],"ValueCount":0},{"Arguments":["add-certificates"],"ValueCount":0},{"Arguments":["find-generic-password"],"ValueCount":0},{"Arguments":["delete-generic-password"],"ValueCount":0},{"Arguments":["set-generic-password-partition-list"],"ValueCount":0},{"Arguments":["find-internet-password"],"ValueCount":0},{"Arguments":["delete-internet-password"],"ValueCount":0},{"Arguments":["set-internet-password-partition-list"],"ValueCount":0},{"Arguments":["find-key"],"ValueCount":0},{"Arguments":["set-key-partition-list"],"ValueCount":0},{"Arguments":["find-certificate"],"ValueCount":0},{"Arguments":["find-identity"],"ValueCount":0},{"Arguments":["delete-certificate"],"ValueCount":0},{"Arguments":["delete-identity"],"ValueCount":0},{"Arguments":["set-identity-preference"],"ValueCount":0},{"Arguments":["get-identity-preference"],"ValueCount":0},{"Arguments":["create-db"],"ValueCount":0},{"Arguments":["export"],"ValueCount":0},{"Arguments":["import"],"ValueCount":0},{"Arguments":["cms"],"ValueCount":0},{"Arguments":["install-mds"],"ValueCount":0},{"Arguments":["add-trusted-cert"],"ValueCount":0},{"Arguments":["remove-trusted-cert"],"ValueCount":0},{"Arguments":["dump-trust-settings"],"ValueCount":0},{"Arguments":["user-trust-settings-enable"],"ValueCount":0},{"Arguments":["trust-settings-export"],"ValueCount":0},{"Arguments":["trust-settings-import"],"ValueCount":0},{"Arguments":["verify-cert"],"ValueCount":0},{"Arguments":["authorize"],"ValueCount":0},{"Arguments":["authorizationdb"],"ValueCount":0},{"Arguments":["execute-with-privileges"],"ValueCount":0},{"Arguments":["leaks"],"ValueCount":0},{"Arguments":["smartcards"],"ValueCount":0},{"Arguments":["list-smartcards"],"ValueCount":0},{"Arguments":["export-smartcard"],"ValueCount":0},{"Arguments":["error"],"ValueCount":0}]}}]}
{"versions":{"argfuscator":"2.0","format":"2.0"},"profiles":[{"executableVersion":null,"platform":"mac","operatingSystem":"macOS","operatingSystemVersion":"Tahoe 26.2","parameters":{"command":[{"command":"security"},{"value":"dump-keychain"},{"argument":"-a"}],"modifiers":{"FilePathTransformer":{"AppliesTo":["path"],"Probability":"0.5","PathTraversal":true,"SubstituteSlashes":false,"ExtraSlashes":true,"ValidFilePaths":true},"Shorthands":{"AppliesTo":["value"],"Probability":"0.5","CaseSensitive":true},"RandomCase":{"AppliesTo":["command", "path"],"Probability":"0.5"},"ReorderArgs":{"AppliesTo":["argument"],"Probability":"0.5","CombineShortForm":false,"RandomiseOrder":false,"SwapLongShortForm":true,"InsertRedundantShortforms":false}},"arguments":[{"Arguments":["help"],"ValueCount":0},{"Arguments":["list-keychains"],"ValueCount":0},{"Arguments":["default-keychain","d"],"ValueCount":0},{"Arguments":["login-keychain"],"ValueCount":0},{"Arguments":["create-keychain"],"ValueCount":0},{"Arguments":["delete-keychain"],"ValueCount":0},{"Arguments":["lock-keychain"],"ValueCount":0},{"Arguments":["unlock-keychain"],"ValueCount":0},{"Arguments":["set-keychain-settings"],"ValueCount":0},{"Arguments":["set-keychain-password"],"ValueCount":0},{"Arguments":["show-keychain-info"],"ValueCount":0},{"Arguments":["dump-keychain","du","dum","dump"],"ValueCount":0},{"Arguments":["create-keypair"],"ValueCount":0},{"Arguments":["add-generic-password"],"ValueCount":0},{"Arguments":["add-internet-password"],"ValueCount":0},{"Arguments":["add-certificates"],"ValueCount":0},{"Arguments":["find-generic-password"],"ValueCount":0},{"Arguments":["delete-generic-password"],"ValueCount":0},{"Arguments":["set-generic-password-partition-list"],"ValueCount":0},{"Arguments":["find-internet-password"],"ValueCount":0},{"Arguments":["delete-internet-password"],"ValueCount":0},{"Arguments":["set-internet-password-partition-list"],"ValueCount":0},{"Arguments":["find-key"],"ValueCount":0},{"Arguments":["set-key-partition-list"],"ValueCount":0},{"Arguments":["find-certificate"],"ValueCount":0},{"Arguments":["find-identity"],"ValueCount":0},{"Arguments":["delete-certificate"],"ValueCount":0},{"Arguments":["delete-identity"],"ValueCount":0},{"Arguments":["set-identity-preference"],"ValueCount":0},{"Arguments":["get-identity-preference"],"ValueCount":0},{"Arguments":["create-db"],"ValueCount":0},{"Arguments":["export"],"ValueCount":0},{"Arguments":["import"],"ValueCount":0},{"Arguments":["cms"],"ValueCount":0},{"Arguments":["install-mds"],"ValueCount":0},{"Arguments":["add-trusted-cert"],"ValueCount":0},{"Arguments":["remove-trusted-cert"],"ValueCount":0},{"Arguments":["dump-trust-settings"],"ValueCount":0},{"Arguments":["user-trust-settings-enable"],"ValueCount":0},{"Arguments":["trust-settings-export"],"ValueCount":0},{"Arguments":["trust-settings-import"],"ValueCount":0},{"Arguments":["verify-cert"],"ValueCount":0},{"Arguments":["authorize"],"ValueCount":0},{"Arguments":["authorizationdb"],"ValueCount":0},{"Arguments":["execute-with-privileges"],"ValueCount":0},{"Arguments":["leaks"],"ValueCount":0},{"Arguments":["smartcards"],"ValueCount":0},{"Arguments":["list-smartcards"],"ValueCount":0},{"Arguments":["export-smartcard"],"ValueCount":0},{"Arguments":["error"],"ValueCount":0}]}}]}
src/Types/Modifier.ts
+2 -2
View File
@@ -105,7 +105,7 @@ abstract class Modifier {
// Check for known argument match
let a = Modifier.GetArgDetails(Arguments, TokenContent)
if (TokenContent.length == 2 && a !== null) {
if (TokenContent.length == 2 && TokenContent[0] == '-' && a !== null) {
// Create existing find as new token
let t = new Token(TokenContent, a.ValueCount > 0);
Tokens.push(t);
@@ -212,7 +212,7 @@ abstract class Modifier {
}
if (_TokenText.match(/^(?:\\\\[^\\]+|[a-zA-Z]:|\.[\\/])((?:\\[^\\]+)+\\)?([^<>:]*)$/) || _TokenText.match(/^[^<>:]+\.[a-zA-Z0-9]{2,4}$/)) x.SetType('path'); // Windows file path format
if (_TokenText.match(/^\/[a-zA-Z0-9\-_ .]+\/[a-zA-Z0-9\-_\/ .]+$/)||_TokenText=="/tmp") x.SetType('path'); // Linux file path format
if (_TokenText.match(/^\/[a-zA-Z0-9\-_ .]+\/[a-zA-Z0-9\-_\/ .]+$/)||_TokenText.match(/^~\//)||_TokenText=="/tmp") x.SetType('path'); // Linux file path format
if (_TokenText == '-') x.SetType('path') // stdin
if (_TokenText.match(/^(HKLM|HKCC|HKCR|HKCU|HKU|HKEY_(LOCAL_MACHINE|CURRENT_CONFIG|CLASSES_ROOT|CURRENT_USER|USERS))\\?/i)) x.SetType('disabled'); // Windows Registry
if (_TokenText.startsWith('http:') || _TokenText.startsWith('https:') || _TokenText.match(/[12]?\d?\d\.[12]?\d?\d\.[12]?\d?\d\.[12]?\d?\d/)) x.SetType('url'); //URLs (including IP addresses)
src/code.ts
+12 -4
View File
@@ -92,7 +92,8 @@ function ApplyObfuscation(): void {
}
}
for(var attempts=0; attempts<3; attempts++){
const maxAttempts = 10
for (var attempts = 0; attempts < maxAttempts; attempts++) {
const preObfuscation = LastTokenised.map(x => x.GetStringContent()).join(" ")
LastTokenised?.forEach(Token => Token.Reset());
@@ -116,12 +117,19 @@ function ApplyObfuscation(): void {
});
const postObfuscation = LastTokenised.map(x => x.GetStringContent()).join(" ")
if(preObfuscation!=postObfuscation){
if(preObfuscation.toLowerCase() == postObfuscation.toLowerCase())
logUserError("pattern-no-options", "Other than upper/lower casing, it looks like nothing else was obfuscated compared to your original. Consider adding more command-line options to ensure there is enough to obfuscate.", false);
if (preObfuscation != postObfuscation) {
if (preObfuscation.toLowerCase() == postObfuscation.toLowerCase()) {
if (attempts == maxAttempts - 1) {
logUserError("pattern-no-options", "Other than upper/lower casing, it looks like nothing else was obfuscated compared to your original. Consider adding more command-line options to ensure there is enough to obfuscate.", false);
}
else {
continue
}
}
return
}
}
logUserError("pattern-no-options", "It looks like nothing was obfuscated compared to your original. Consider adding more command-line options to ensure there is enough to obfuscate.", true);
}