77 lines
2.3 KiB
Plaintext
77 lines
2.3 KiB
Plaintext
binary opeations:
|
|
$a -band $b and
|
|
$a -bnot $b not
|
|
$a -bor $b or
|
|
$a -bxor $b xor
|
|
$a -shr $b right shift
|
|
$a -shl $b left shift
|
|
|
|
xor on a byte array:
|
|
for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor 0x6A}
|
|
|
|
convert string to byte array:
|
|
$bytes=[System.Text.Encoding]::UTF8.GetBytes($secret)
|
|
convert byte array to string:
|
|
$string=[System.Text.Encoding]::UTF8.GetString($bytes)
|
|
|
|
a xor b can be reversed by the same exact operation
|
|
|
|
$shellStr = "echo henloamf";
|
|
|
|
|
|
$sillystring='henloloamf';$sillyxorkey=0x3b;$bytes=[System.Text.Encoding]::Unicode.GetBytes($sillystring);for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor $sillyxorkey};$string=[System.Text.Encoding]::UTF8.GetString($bytes);$string
|
|
|
|
$sillyxorkey=0x3b;$bytes=[System.Text.Encoding]::Unicode.GetBytes($string);for($i=0;$i -lt $bytes.count;$i++){$bytes[$i]=$bytes[$i] -bxor $sillyxorkey};$string2=[System.Text.Encoding]::UTF8.GetString($bytes);$string2
|
|
|
|
[char]0x0048 manually encoded unicode
|
|
|
|
$encoding = [System.Text.Encoding]::UTF8
|
|
$input = 'input string thingy'
|
|
$output = $encoding.GetBytes($input)
|
|
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes($input)
|
|
$string = [System.Text.Encoding]::UTF8.GetString($bytes)
|
|
|
|
|
|
# encode to bytes
|
|
$in = "input string thingy";
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes($in);
|
|
|
|
# decode from bytes
|
|
$str = [System.Text.Encoding]::UTF8.GetString($bytes);
|
|
$str;
|
|
|
|
# encode to bytes and xor
|
|
$key = 0xA3;
|
|
$str = "echo hemanloanf";
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes($str);
|
|
$bytes;
|
|
for($i = 0; $i -lt $bytes.length; $i++) {
|
|
$bytes[$i]=$bytes[$i] -bxor $key;
|
|
}
|
|
$bytes;
|
|
|
|
# decode back to string
|
|
for($i = 0; $i -lt $bytes.length; $i++) {
|
|
$bytes[$i]=$bytes[$i] -bxor $key;
|
|
}
|
|
|
|
$str = [System.Text.Encoding]::UTF8.GetString($bytes);
|
|
$str
|
|
|
|
# xor obsfuscation and exe oneliner
|
|
# encode
|
|
$key = 0xA3;
|
|
$str = "echo hemanloanf";
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes($str);
|
|
for($i = 0; $i -lt $bytes.length; $i++) { $bytes[$i]=$bytes[$i] -bxor $key; }
|
|
|
|
# xor encode oneliner
|
|
$key=0xA3;$str="echo hanloand";$bytes=[System.Text.Encoding]::UTF8.GetBytes($str);for($i=0;$i -lt $bytes.length;$i++){$bytes[$i]=$bytes[$i] -bxor $key;};
|
|
# $bytes
|
|
|
|
# decode and execute oneliner
|
|
$key=0xA3;for($i=0;$i -lt $bytes.length;$i++){$bytes[$i]=$bytes[$i] -bxor $key};$str=[System.Text.Encoding]::UTF8.GetString($bytes);
|
|
# $str
|
|
|