migration

powershell-notes.txt

@@ -0,0 +1,76 @@
+binary opeations:
+    $a -band $b and
+    $a -bnot $b not
+    $a -bor $b or
+    $a -bxor $b xor
+    $a -shr $b right shift
+    $a -shl $b left shift
+
+xor on a byte array:
+    for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor 0x6A}
+
+convert string to byte array:
+    $bytes=[System.Text.Encoding]::UTF8.GetBytes($secret)
+convert byte array to string:
+    $string=[System.Text.Encoding]::UTF8.GetString($bytes)
+
+a xor b can be reversed by the same exact operation
+
+$shellStr = "echo henloamf";
+
+
+$sillystring='henloloamf';$sillyxorkey=0x3b;$bytes=[System.Text.Encoding]::Unicode.GetBytes($sillystring);for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor $sillyxorkey};$string=[System.Text.Encoding]::UTF8.GetString($bytes);$string
+
+$sillyxorkey=0x3b;$bytes=[System.Text.Encoding]::Unicode.GetBytes($string);for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor $sillyxorkey};$string2=[System.Text.Encoding]::UTF8.GetString($bytes);$string2
+
+[char]0x0048 manually encoded unicode
+
+$encoding = [System.Text.Encoding]::UTF8
+$input = 'input string thingy'
+$output = $encoding.GetBytes($input)
+
+$bytes = [System.Text.Encoding]::UTF8.GetBytes($input)
+$string = [System.Text.Encoding]::UTF8.GetString($bytes)
+
+
+# encode to bytes
+$in = "input string thingy";
+$bytes = [System.Text.Encoding]::UTF8.GetBytes($in);
+
+# decode from bytes
+$str = [System.Text.Encoding]::UTF8.GetString($bytes);
+$str;
+
+# encode to bytes and xor
+$key = 0xA3;
+$str = "echo hemanloanf";
+$bytes = [System.Text.Encoding]::UTF8.GetBytes($str);
+$bytes;
+for($i = 0; $i -lt $bytes.length; $i++) {
+    $bytes[$i]=$bytes[$i] -bxor $key;
+}
+$bytes;
+
+# decode back to string
+for($i = 0; $i -lt $bytes.length; $i++) {
+    $bytes[$i]=$bytes[$i] -bxor $key;
+}
+
+$str = [System.Text.Encoding]::UTF8.GetString($bytes);
+$str
+
+# xor obsfuscation and exe oneliner
+# encode
+$key = 0xA3;
+$str = "echo hemanloanf";
+$bytes = [System.Text.Encoding]::UTF8.GetBytes($str);
+for($i = 0; $i -lt $bytes.length; $i++) { $bytes[$i]=$bytes[$i] -bxor $key; }
+
+# xor encode oneliner
+$key=0xA3;$str="echo hanloand";$bytes=[System.Text.Encoding]::UTF8.GetBytes($str);for($i=0;$i -lt $bytes.length;$i++){$bytes[$i]=$bytes[$i] -bxor $key;};
+# $bytes
+
+# decode and execute oneliner
+$key=0xA3;for($i=0;$i -lt $bytes.length;$i++){$bytes[$i]=$bytes[$i] -bxor $key};$str=[System.Text.Encoding]::UTF8.GetString($bytes);
+# $str
+