binary opeations: $a -band $b and $a -bnot $b not $a -bor $b or $a -bxor $b xor $a -shr $b right shift $a -shl $b left shift xor on a byte array: for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor 0x6A} convert string to byte array: $bytes=[System.Text.Encoding]::UTF8.GetBytes($secret) convert byte array to string: $string=[System.Text.Encoding]::UTF8.GetString($bytes) a xor b can be reversed by the same exact operation $shellStr = "echo henloamf"; $sillystring='henloloamf';$sillyxorkey=0x3b;$bytes=[System.Text.Encoding]::Unicode.GetBytes($sillystring);for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor $sillyxorkey};$string=[System.Text.Encoding]::UTF8.GetString($bytes);$string $sillyxorkey=0x3b;$bytes=[System.Text.Encoding]::Unicode.GetBytes($string);for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor $sillyxorkey};$string2=[System.Text.Encoding]::UTF8.GetString($bytes);$string2 [char]0x0048 manually encoded unicode $encoding = [System.Text.Encoding]::UTF8 $input = 'input string thingy' $output = $encoding.GetBytes($input) $bytes = [System.Text.Encoding]::UTF8.GetBytes($input) $string = [System.Text.Encoding]::UTF8.GetString($bytes) # encode to bytes $in = "input string thingy"; $bytes = [System.Text.Encoding]::UTF8.GetBytes($in); # decode from bytes $str = [System.Text.Encoding]::UTF8.GetString($bytes); $str; # encode to bytes and xor $key = 0xA3; $str = "echo hemanloanf"; $bytes = [System.Text.Encoding]::UTF8.GetBytes($str); $bytes; for($i = 0; $i -lt $bytes.length; $i++) { $bytes[$i]=$bytes[$i] -bxor $key; } $bytes; # decode back to string for($i = 0; $i -lt $bytes.length; $i++) { $bytes[$i]=$bytes[$i] -bxor $key; } $str = [System.Text.Encoding]::UTF8.GetString($bytes); $str # xor obsfuscation and exe oneliner # encode $key = 0xA3; $str = "echo hemanloanf"; $bytes = [System.Text.Encoding]::UTF8.GetBytes($str); for($i = 0; $i -lt $bytes.length; $i++) { $bytes[$i]=$bytes[$i] -bxor $key; } # xor encode oneliner $key=0xA3;$str="echo hanloand";$bytes=[System.Text.Encoding]::UTF8.GetBytes($str);for($i=0;$i -lt $bytes.length;$i++){$bytes[$i]=$bytes[$i] -bxor $key;}; # $bytes # decode and execute oneliner $key=0xA3;for($i=0;$i -lt $bytes.length;$i++){$bytes[$i]=$bytes[$i] -bxor $key};$str=[System.Text.Encoding]::UTF8.GetString($bytes); # $str