From 9fac4c5b739f7dabc1bb471294ccfccc5d9c957f Mon Sep 17 00:00:00 2001 From: Wietze Date: Fri, 6 Feb 2026 15:16:11 +0000 Subject: [PATCH] Improving *nix path recognition --- models/security.json | 2 +- src/Types/Modifier.ts | 4 ++-- src/code.ts | 16 ++++++++++++---- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/models/security.json b/models/security.json index 9e366bd..05148c0 100644 --- a/models/security.json +++ b/models/security.json @@ -1 +1 @@ -{"versions":{"argfuscator":"2.0","format":"2.0"},"profiles":[{"executableVersion":null,"platform":"mac","operatingSystem":"macOS","operatingSystemVersion":"Tahoe 26.2","parameters":{"command":[{"command":"security"},{"value":"dump-keychain"},{"argument":"-a"}],"modifiers":{"FilePathTransformer":{"AppliesTo":["path"],"Probability":"0.5","PathTraversal":true,"SubstituteSlashes":false,"ExtraSlashes":true,"ValidFilePaths":true},"Shorthands":{"AppliesTo":["value"],"Probability":"0.5","CaseSensitive":true},"RandomCase":{"AppliesTo":["command", "path"],"Probability":"0.5"}},"arguments":[{"Arguments":["help"],"ValueCount":0},{"Arguments":["list-keychains"],"ValueCount":0},{"Arguments":["default-keychain"],"ValueCount":0},{"Arguments":["login-keychain"],"ValueCount":0},{"Arguments":["create-keychain"],"ValueCount":0},{"Arguments":["delete-keychain"],"ValueCount":0},{"Arguments":["lock-keychain"],"ValueCount":0},{"Arguments":["unlock-keychain"],"ValueCount":0},{"Arguments":["set-keychain-settings"],"ValueCount":0},{"Arguments":["set-keychain-password"],"ValueCount":0},{"Arguments":["show-keychain-info"],"ValueCount":0},{"Arguments":["dump-keychain"],"ValueCount":0},{"Arguments":["create-keypair"],"ValueCount":0},{"Arguments":["add-generic-password"],"ValueCount":0},{"Arguments":["add-internet-password"],"ValueCount":0},{"Arguments":["add-certificates"],"ValueCount":0},{"Arguments":["find-generic-password"],"ValueCount":0},{"Arguments":["delete-generic-password"],"ValueCount":0},{"Arguments":["set-generic-password-partition-list"],"ValueCount":0},{"Arguments":["find-internet-password"],"ValueCount":0},{"Arguments":["delete-internet-password"],"ValueCount":0},{"Arguments":["set-internet-password-partition-list"],"ValueCount":0},{"Arguments":["find-key"],"ValueCount":0},{"Arguments":["set-key-partition-list"],"ValueCount":0},{"Arguments":["find-certificate"],"ValueCount":0},{"Arguments":["find-identity"],"ValueCount":0},{"Arguments":["delete-certificate"],"ValueCount":0},{"Arguments":["delete-identity"],"ValueCount":0},{"Arguments":["set-identity-preference"],"ValueCount":0},{"Arguments":["get-identity-preference"],"ValueCount":0},{"Arguments":["create-db"],"ValueCount":0},{"Arguments":["export"],"ValueCount":0},{"Arguments":["import"],"ValueCount":0},{"Arguments":["cms"],"ValueCount":0},{"Arguments":["install-mds"],"ValueCount":0},{"Arguments":["add-trusted-cert"],"ValueCount":0},{"Arguments":["remove-trusted-cert"],"ValueCount":0},{"Arguments":["dump-trust-settings"],"ValueCount":0},{"Arguments":["user-trust-settings-enable"],"ValueCount":0},{"Arguments":["trust-settings-export"],"ValueCount":0},{"Arguments":["trust-settings-import"],"ValueCount":0},{"Arguments":["verify-cert"],"ValueCount":0},{"Arguments":["authorize"],"ValueCount":0},{"Arguments":["authorizationdb"],"ValueCount":0},{"Arguments":["execute-with-privileges"],"ValueCount":0},{"Arguments":["leaks"],"ValueCount":0},{"Arguments":["smartcards"],"ValueCount":0},{"Arguments":["list-smartcards"],"ValueCount":0},{"Arguments":["export-smartcard"],"ValueCount":0},{"Arguments":["error"],"ValueCount":0}]}}]} +{"versions":{"argfuscator":"2.0","format":"2.0"},"profiles":[{"executableVersion":null,"platform":"mac","operatingSystem":"macOS","operatingSystemVersion":"Tahoe 26.2","parameters":{"command":[{"command":"security"},{"value":"dump-keychain"},{"argument":"-a"}],"modifiers":{"FilePathTransformer":{"AppliesTo":["path"],"Probability":"0.5","PathTraversal":true,"SubstituteSlashes":false,"ExtraSlashes":true,"ValidFilePaths":true},"Shorthands":{"AppliesTo":["value"],"Probability":"0.5","CaseSensitive":true},"RandomCase":{"AppliesTo":["command", "path"],"Probability":"0.5"},"ReorderArgs":{"AppliesTo":["argument"],"Probability":"0.5","CombineShortForm":false,"RandomiseOrder":false,"SwapLongShortForm":true,"InsertRedundantShortforms":false}},"arguments":[{"Arguments":["help"],"ValueCount":0},{"Arguments":["list-keychains"],"ValueCount":0},{"Arguments":["default-keychain","d"],"ValueCount":0},{"Arguments":["login-keychain"],"ValueCount":0},{"Arguments":["create-keychain"],"ValueCount":0},{"Arguments":["delete-keychain"],"ValueCount":0},{"Arguments":["lock-keychain"],"ValueCount":0},{"Arguments":["unlock-keychain"],"ValueCount":0},{"Arguments":["set-keychain-settings"],"ValueCount":0},{"Arguments":["set-keychain-password"],"ValueCount":0},{"Arguments":["show-keychain-info"],"ValueCount":0},{"Arguments":["dump-keychain","du","dum","dump"],"ValueCount":0},{"Arguments":["create-keypair"],"ValueCount":0},{"Arguments":["add-generic-password"],"ValueCount":0},{"Arguments":["add-internet-password"],"ValueCount":0},{"Arguments":["add-certificates"],"ValueCount":0},{"Arguments":["find-generic-password"],"ValueCount":0},{"Arguments":["delete-generic-password"],"ValueCount":0},{"Arguments":["set-generic-password-partition-list"],"ValueCount":0},{"Arguments":["find-internet-password"],"ValueCount":0},{"Arguments":["delete-internet-password"],"ValueCount":0},{"Arguments":["set-internet-password-partition-list"],"ValueCount":0},{"Arguments":["find-key"],"ValueCount":0},{"Arguments":["set-key-partition-list"],"ValueCount":0},{"Arguments":["find-certificate"],"ValueCount":0},{"Arguments":["find-identity"],"ValueCount":0},{"Arguments":["delete-certificate"],"ValueCount":0},{"Arguments":["delete-identity"],"ValueCount":0},{"Arguments":["set-identity-preference"],"ValueCount":0},{"Arguments":["get-identity-preference"],"ValueCount":0},{"Arguments":["create-db"],"ValueCount":0},{"Arguments":["export"],"ValueCount":0},{"Arguments":["import"],"ValueCount":0},{"Arguments":["cms"],"ValueCount":0},{"Arguments":["install-mds"],"ValueCount":0},{"Arguments":["add-trusted-cert"],"ValueCount":0},{"Arguments":["remove-trusted-cert"],"ValueCount":0},{"Arguments":["dump-trust-settings"],"ValueCount":0},{"Arguments":["user-trust-settings-enable"],"ValueCount":0},{"Arguments":["trust-settings-export"],"ValueCount":0},{"Arguments":["trust-settings-import"],"ValueCount":0},{"Arguments":["verify-cert"],"ValueCount":0},{"Arguments":["authorize"],"ValueCount":0},{"Arguments":["authorizationdb"],"ValueCount":0},{"Arguments":["execute-with-privileges"],"ValueCount":0},{"Arguments":["leaks"],"ValueCount":0},{"Arguments":["smartcards"],"ValueCount":0},{"Arguments":["list-smartcards"],"ValueCount":0},{"Arguments":["export-smartcard"],"ValueCount":0},{"Arguments":["error"],"ValueCount":0}]}}]} diff --git a/src/Types/Modifier.ts b/src/Types/Modifier.ts index 5d04d67..59b5251 100755 --- a/src/Types/Modifier.ts +++ b/src/Types/Modifier.ts @@ -105,7 +105,7 @@ abstract class Modifier { // Check for known argument match let a = Modifier.GetArgDetails(Arguments, TokenContent) - if (TokenContent.length == 2 && a !== null) { + if (TokenContent.length == 2 && TokenContent[0] == '-' && a !== null) { // Create existing find as new token let t = new Token(TokenContent, a.ValueCount > 0); Tokens.push(t); @@ -212,7 +212,7 @@ abstract class Modifier { } if (_TokenText.match(/^(?:\\\\[^\\]+|[a-zA-Z]:|\.[\\/])((?:\\[^\\]+)+\\)?([^<>:]*)$/) || _TokenText.match(/^[^<>:]+\.[a-zA-Z0-9]{2,4}$/)) x.SetType('path'); // Windows file path format - if (_TokenText.match(/^\/[a-zA-Z0-9\-_ .]+\/[a-zA-Z0-9\-_\/ .]+$/)||_TokenText=="/tmp") x.SetType('path'); // Linux file path format + if (_TokenText.match(/^\/[a-zA-Z0-9\-_ .]+\/[a-zA-Z0-9\-_\/ .]+$/)||_TokenText.match(/^~\//)||_TokenText=="/tmp") x.SetType('path'); // Linux file path format if (_TokenText == '-') x.SetType('path') // stdin if (_TokenText.match(/^(HKLM|HKCC|HKCR|HKCU|HKU|HKEY_(LOCAL_MACHINE|CURRENT_CONFIG|CLASSES_ROOT|CURRENT_USER|USERS))\\?/i)) x.SetType('disabled'); // Windows Registry if (_TokenText.startsWith('http:') || _TokenText.startsWith('https:') || _TokenText.match(/[12]?\d?\d\.[12]?\d?\d\.[12]?\d?\d\.[12]?\d?\d/)) x.SetType('url'); //URLs (including IP addresses) diff --git a/src/code.ts b/src/code.ts index ddce2c4..86c6737 100755 --- a/src/code.ts +++ b/src/code.ts @@ -92,7 +92,8 @@ function ApplyObfuscation(): void { } } - for(var attempts=0; attempts<3; attempts++){ + const maxAttempts = 10 + for (var attempts = 0; attempts < maxAttempts; attempts++) { const preObfuscation = LastTokenised.map(x => x.GetStringContent()).join(" ") LastTokenised?.forEach(Token => Token.Reset()); @@ -116,12 +117,19 @@ function ApplyObfuscation(): void { }); const postObfuscation = LastTokenised.map(x => x.GetStringContent()).join(" ") - if(preObfuscation!=postObfuscation){ - if(preObfuscation.toLowerCase() == postObfuscation.toLowerCase()) - logUserError("pattern-no-options", "Other than upper/lower casing, it looks like nothing else was obfuscated compared to your original. Consider adding more command-line options to ensure there is enough to obfuscate.", false); + if (preObfuscation != postObfuscation) { + if (preObfuscation.toLowerCase() == postObfuscation.toLowerCase()) { + if (attempts == maxAttempts - 1) { + logUserError("pattern-no-options", "Other than upper/lower casing, it looks like nothing else was obfuscated compared to your original. Consider adding more command-line options to ensure there is enough to obfuscate.", false); + } + else { + continue + } + } return } } + logUserError("pattern-no-options", "It looks like nothing was obfuscated compared to your original. Consider adding more command-line options to ensure there is enough to obfuscate.", true); }