{"repo":"thewhiteninja/deobshell","free":true,"listed":false,"github":"https://github.com/thewhiteninja/deobshell","clone":"git clone https://github.com/thewhiteninja/deobshell.git","description":"Powershell script deobfuscation using AST in Python","language":"Python","stars":75,"topics":["python","powershell","static-analysis","ast","abstract-syntax-tree","simplification","deobfuscation","malware-analysis","optimization","security"],"license":"MIT","category":"security-tools","readme_excerpt":"DeobShell DeobShell is PoC to deobfuscate Powershell using Abstract Syntax Tree (AST) manipulation in Python. The AST is extracted using a Powershell script by calling System.Management.Automation.Language.Parser and writing relevant nodes to an XML file. AST manipulation and optimization is based on a set of rules (ex: concat constant string, apply format operator ...). From the deobfuscated AST, a ps1 script is rebuilt using Python. See the diagram below. :information source: Only a subset of Powershell is supported for now but PR are welcomed :) :warning: data/ folder contains real malware samples! How Examples of rules - remove empty nodes - remove unused variables - remove use of uninitialised variables - simplify expression - join, plus, format, replace operator - split, reverse, invoke-expression - type convertion to type, string, char, array - replace constant variable with their value - fix special words case - ... Example: BinaryExpressionAst node for format operator Input Output Example CTF challenge Input Output References - https://github.com/R3MRUM/PSDecode - https://robwillis.info/2020/08/invoke-decoder-a-powershell-script-to-decode-deobfuscate-malware-samples/ - https://www.varonis.com/blog/adventures-malware-free-hacking-part-ii/ - https://gist.github.com/notdodo/3d5ac56cd837c3f79d2c687f3e75cac1","default_branch":null,"files":null,"tree":[],"storefront":"/r/thewhiteninja","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/thewhiteninja/deobshell/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}