使用-noexit参数将代码转换为.EXE

时间:2016-02-08 11:20:53

标签: powershell obfuscation

我想将PowerShell转换为.EXE以便对代码进行模糊处理,但到目前为止我无法实现目标。 我尝试使用不同的工具,如PS2exe,powergui,类固醇......而且没有一个让我将参数添加到PowerShell命令。

TMPDLL_API /* export */
int WINAPIV change_mountain_heights(char* mountains[], float heights[], int8_t num_elements)
{
    if (num_elements <= 0)
        return 0;

    if (!(mountains && heights))
        return 0;

    for (int8_t index = 0; index < num_elements; ++index) {
        char* mountain = mountains[index];
        printf("mountain: %s ; height: %f\n", mountain, heights[index]);

        // add 100.0
        heights[index] += 100.0f;
    }

    return 1;
}

有谁可以给​​我一个如何实现这一目标的提示?或者可能以其他方式混淆代码?

1 个答案:

答案 0 :(得分:0)

这是我最终如何做到这一点。嵌入代码! :) ScriptBlock是关键。

$sb = {

        $query = 'SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA ''Win32_LogicalDisk'' AND TargetInstance.DriveType=2'

        Register-WmiEvent -Query $query -SourceIdentifier RemovableDiskDetection -Action {
            $class = $eventArgs.NewEvent.__CLASS
            $device = $eventArgs.NewEvent.TargetInstance.DeviceID

            $wshell = New-Object -ComObject Wscript.Shell
            switch ($class)
            {
                __InstanceCreationEvent {
                    $path = $device + '\flag\'
                    Write-Host '*** Checking the existence of the file $path'
                    if (Test-Path -Path $path)
                    {
                        $wshell.Popup('Inserted, device id: $device WITH flag', 0, 'Done', 0x1)

                    }
                    else
                    {
                        $wshell.Popup('Inserted, device id: $device WITHOUT flag', 0, 'Done', 0x1)
                    }
                }
                __InstanceDeletionEvent {
                    $wshell.Popup('Removed, device id: $device ', 0, 'Done', 0x1)
                }
           }
        }
}

start-process powershell.exe -argument "-noexit -nologo -noprofile -windowstyle hidden -command $sb"

一旦我设法嵌入参数并获得正常的ps1文件,我就用PS2EXE工具编译它。

.\ps2exe.ps1  -noConsole -inputFile .\magic.ps1 -outPutFile magic.exe