jacortijo February 2016

Convert code to .EXE using -noexit parameter

I want to convert my PowerShell to .EXE in order to obfuscate the code a bit, but I couldn't achieve my goal so far. I tried with different tools such as PS2exe, powergui, steroids, … and none of them let me add the parameters to the PowerShell command.

powershell.exe -noexit -windowstyle hidden -file c:\temp\myscript.ps1

Anybody who could give me a tip of how to achieve this? or maybe any other way to obfuscate the code?

Answers


jacortijo February 2016

here is how I finally did the trick. Embed code! :) the ScriptBlock is the key.

$sb = {

        $query = 'SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA ''Win32_LogicalDisk'' AND TargetInstance.DriveType=2'

        Register-WmiEvent -Query $query -SourceIdentifier RemovableDiskDetection -Action {
            $class = $eventArgs.NewEvent.__CLASS
            $device = $eventArgs.NewEvent.TargetInstance.DeviceID

            $wshell = New-Object -ComObject Wscript.Shell
            switch ($class)
            {
                __InstanceCreationEvent {
                    $path = $device + '\STAMP.kiosk\'
                    Write-Host '*** Checking the existence of the file $path'
                    if (Test-Path -Path $path)
                    {
                        $wshell.Popup('Inserted, device id: $device WITH STAMP.kiosk', 0, 'Done', 0x1)

                    }
                    else
                    {
                        $wshell.Popup('Inserted, device id: $device WITHOUT STAMP.kiosk', 0, 'Done', 0x1)
                    }
                }
                __InstanceDeletionEvent {
                    $wshell.Popup('Removed, device id: $device ', 0, 'Done', 0x1)
                }
           }
        }
}

start-process powershell.exe -argument "-noexit -nologo -noprofile -windowstyle hidden -command $sb"

Once I jsut manage to embed the parameters and get a normal ps1 file as result, I used the PS2EXE tool to compile it.

.\ps2exe.ps1  -noConsole -inputFile .\magic.ps1 -outPutFile magic.exe

Post Status

Asked in February 2016
Viewed 2,709 times
Voted 12
Answered 1 times

Search




Leave an answer