search

DissectMalware / batch_deobfuscator

Deobfuscate batch scripts obfuscated using string substitution and escape character techniques.
MIT License
142 stars 26 forks source link

Deobfuscated Script Expands Environment Variables #6

Open ralfszeltins22 opened 4 months ago

ralfszeltins22 commented 4 months ago

This issue reports a behavior with the deobfuscator where environment variables like %username% are expanded during the deobfuscation process.

While expanding variables can be useful in some cases, it can be problematic for scripts that rely on the literal presence of the variable name (e.g., %username%) for further processing or functionality.

Expected Behavior:

The deobfuscator should preserve environment variables within the deobfuscated script. When encountering %username% in the obfuscated code, the deobfuscated output should display %username% (including the percent signs) instead of the actual username on the system.

ralfszeltins22 commented 4 months ago

Google Gemini wrote this because i didn't know how to explain it myself btw