none
Post your sig thread

    General discussion

  • I was inspired by mjolinor tonight.  I saw his sig on a couple of posts, and thought one of these days I'll get to my own obfuscated sig code.  Well tonight wound up being that night.  It may be a tad large for a sig :)

    Can anyone guess what this is going to say?

    write-host -object (("1*0x26*1x3*2x4*3x1*4x1*2x2*1x1*2x1*4x4*3x3*2x21*1x1*0x20*1x1*2x2*4x3*5x5*6x2*7x6*1x2*8x5*6x3*5x2*4x1*2x15*1x1*0x17*1x1*2x1*4x1*5x10*6x2*7x1*1x1*9x4*1x1*10x1*1x2*8x10*6x1*5x1*4x1*2x13*1x1*0x16*1x1*4x12*6x2*7x2*1x1*11x1*8x2*5x1*7x1*11x2*1x2*8x12*6x1*4x11*1x1*0x14*1x1*2x1*7x12*6x2*7x3*1x1*9x1*12x2*13x1*14x1*10x3*1x2*8x12*6x1*8x1*2x9*1x1*0x14*1x1*7x13*6x2*9x4*1x2*8x2*7x5*1x2*10x13*6x1*8x9*1x1*0x12*1x1*4x15*6x2*8x4*1x1*9x2*15x1*10x4*1x2*7x15*6x1*4x7*1x1*0x11*1x1*4x17*6x2*8x2*1x1*7x1*1x2*16x1*1x1*8x2*1x2*7x17*6x1*4x7*1x1*0x10*1x1*4x19*6x2*8x1*7x6*1x1*8x2*7x19*6x1*4x5*1x1*0x9*1x1*2x1*6x1*7x1*11x10*6x1*7x1*8x6*6x1*9x3*1x1*7x1*8x3*1x1*10x6*6x1*7x1*8x10*6x1*11x1*8x1*6x1*2x5*1x1*0x9*1x1*11x1*7x1*1x1*11x1*6x1*7x1*8x1*6x1*7x1*8x1*6x1*7x1*8x1*7x2*1x1*8x1*6x1*7x1*8x2*6x1*8x2*1x1*11x2*1x1*11x2*1x1*7x2*6x1*7x1*8x1*6x1*7x2*1x1*8x1*7x1*8x1*6x1*7x1*8x1*6x1*7x1*8x1*6x1*11x1*1x1*8x1*11x5*1x1*0x9*1x1*17x2*1x1*11x1*7x2*1x1*16x2*1x1*16x2*1x1*17x3*1x1*16x2*1x1*8x1*6x1*8x1*11x1*1x1*11x2*1x1*11x1*1x1*11x1*7x1*6x1*7x2*1x1*16x3*1x1*17x2*1x1*16x2*1x1*16x2*1x1*8x1*11x2*1x1*18x5*1x1*0x13*1x1*17x3*1x1*17x2*1x1*17x6*1x1*17x2*1x1*7x1*1x1*11x1*1x1*11x2*1x1*11x1*1x1*11x1*1x1*8x3*1x1*17x6*1x1*17x2*1x1*17x3*1x1*17x7*1x1*0x29*1x1*9x2*1x1*11x1*1x1*11x2*1x1*11x1*1x1*11x2*1x1*10x25*1x1*0x4*1x1*19x1*20x1*15x1*17x1*21x1*1x1*22x1*20x1*23x1*1x1*24x1*25x1*21x1*22x1*23x1*26x1*27x1*28x1*27x1*28x1*27x3*1x2*2x1*8x1*1x1*11x1*1x1*11x2*1x1*11x1*1x1*11x1*1x1*7x2*2x1*1x1*29x1*15x1*30x1*31x1*32x2*33x1*28x1*1x1*22x1*15x1*23x1*34x1*32x2*35x1*36x1*37x1*38x1*25x1*39x1*40x1*41x1*42x1*15x1*38x1*0x27*1x1*9x3*43x1*9x3*16x1*10x1*9x3*16x1*10x3*43x1*10x6*1x1*0x22*1x1*20x2*22x1*44x1*13x2*7x1*44x1*15x1*45x1*23x1*26x1*22x1*15x1*23x1*41x1*45x1*15x1*26x1*46x1*44x1*26x1*23x2*21x1*41x1*42x1*15x1*38x1*0" -split "x") -split "x"|%{ if ($_ -match "(\d+)\*(\d+)") { "$([char][int]("10T32T95T61T45T94T35T47T92T40T41T124T62T58T60T111T86T39T44T87T104T115T116T101T77T97T114T63T33T84T69T78T117T70T110T102T64T103T109T105T108T46T99T118T112T119T100" -split "T")[$matches[2]])" * $matches[1] } }) -separator ""
    

    Feel free to post your favorite obfuscated one-liner here.  I'm curious to see what other ideas people have.

    Here's an smaller version to decipher that uses the same method as above:

    write-host -object (("1*0x1*1x1*2x1*3x1*4x1*2x1*3x1*0x1*5x1*1x1*6x1*1x1*6x1*1x1*7x1*0x1*8x1*3x1*4x1*9x1*4x1*2x1*8x1*1x1*10x1*11x1*12x1*13x1*1x1*14x1*15x1*9x1*16x1*1x1*17x1*15x1*18x1*16x1*19x1*13x1*20x1*16x2*14x1*0" -split "x") -split "x"|%{ if ($_ -match "(\d+)\*(\d+)") { "$([char][int]("10T32T47T92T95T40T46T41T61T118T67T97T116T115T108T111T101T80T119T114T104" -split "T")[$matches[2]])" * $matches[1] } }) -separator ""
    
    
    Thursday, May 20, 2010 5:05 AM

All replies

  • The first one is super cool. I wanted to do something like this for a long time. Got some inspiration to complete it now. :)
    Ravikanth
    http://www.ravichaganti.com/blog
    Twitter: @ravikanth
    PowerShell 2.0 remoting - eBook
    Thursday, May 20, 2010 5:13 AM
  • Ravi,

    What would be really cool is if you can figure out how to compress a string down... then have your one-liner decompress the string....  I was looking at System.IO.compression.... I may have to revisit it at some point.

    btw, probably a good time to mention this post by Lee Holmes if you want to get some inspiration: http://www.leeholmes.com/blog/AnExerciseInDeObfuscation.aspx

    Thursday, May 20, 2010 5:19 AM

  • Amazing! Thank you for sharing.

    Regards


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Friday, May 21, 2010 5:52 AM
    Moderator
  • Pretty slick!!
    Friday, May 21, 2010 8:30 AM
  • Wow.  I'm honored :)

    I thought about trying to shorten mine by using undelimited hex for the data, but then the code to de-obfucate more than made up the difference.

    I did come up with this:

    $m=[Char[]]"ten.ygolonhcetlartnec@llebpmac_bor";$ofs="";[array]::reverse($m);[string]$m
    $m = "114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116";$ofs="";[string]($m.Split() |% {[char][int]$_})
    Friday, May 21, 2010 12:43 PM
  • Yeah... They key to making it cool is to make it smaller!  We need a better way to do that.  Doing it your way my data set was twice as long.  I created a way of compressing that a bit by making my own char map and using multipliers, but it really only works when you have a lot of one character repeated over and over.  It wound up saving a ton on the spaces, but didn't do much for anything else.  At some point I'll blog about the technique, but I still want to try and get the string smaller first.

    btw, I'm not sure if you noticed... if you get past the multiplication and the charmap it's really your technique with two modifications:

    1) the -split on the string that Lee Holmes talks about

    2) I passed the entire thing into write-host object with a separator of ""

    The combination of the two allowed me to not have to use semicolons.  I think a true one-liner can't have semicolons :)  Check out your sig w/ that technique:

    Write-Host ("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split " "|% {[char][int]$_}) -separator ""

    I actually used -object in mine, but you can save chars without using it since it's a positional parameter.  Your method is still 3 chars less, but no semicolon!

     

    Friday, May 21, 2010 6:28 PM
  • Okay, slightly different, and I got rid of the semi-colons.

     

    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" ")) -replace " "


    $m = "114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116";$ofs="";[string]($m.Split() |% {[char][int]$_})
    Friday, May 21, 2010 7:40 PM
  • lol... I came back here to tell you that I figured out you could convert directly into [char[]] to find you did it already.... on top of that you also used the [string] which I didn't even think of... very cool...

    btw, I got the gzipstream stuff to work...  I was able to compress the 1084 bytes into 476.... That's better than what my method did, but not by much....  I have to work on the decompress part now.... I'm going to try and one line it....  may not be possible... but at least I'll be able to put together a nice blog post about compressing strings.... Not sure where you would ever need that unless your sending between two servers.... doesn't really have an effective use in the scripting world short of obfuscation.

    Friday, May 21, 2010 9:02 PM
  • btw, you don't need the -replace.... This works fine:

    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" "))

    Friday, May 21, 2010 9:04 PM
  • Cool!  I wouldn't sell the exercise short though.  I've learned things just poking around it "what if" exercises like this thinking "that's neat, but I'd never use it for anything", and been proven wrong on more than one occasion.
    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" ")) -replace " "
    Friday, May 21, 2010 9:26 PM
  • Yeah... and it looks cool converted to a string.... so the compression algorithm spits out a different set of bytes.... all of the bytes are high numbers so you hit some cool chars you wouldn't normally get.... This is what it looks like when you convert those bytes to a string:

    ÉÿÁù <  ½`I–%&/mÊ{JõJ×àt¡€`$ؐ@ìÁˆÍæ’ìiG#)«*ÊeVe]f@Ì흼÷Þ{ï½÷Þ{ï½÷º;N'÷ßÿ?\fdlöÎJÚÉž!€ªÈ?~|?"’tðùýÿßÿ3z¶úu¿ÑцQ¿ÿööï÷ûý~?Žçî]ùè÷ý}ùOúx{» ©ã÷ß–·ˆ-|xÇ H0= Û®­ ñ3¿ïï÷ûÝý‹Š>ÛÃ0~ÿ»]éÖÑ£Gï¤] ¿¯Ã¥# ñã[[øì÷ý}•*wîßþ¾q Á@ÐŒÛmUðHï†=¸ù0º ÈÝô'2ý}# ¢@ú0 ÅLo†â`üþ?~÷gÜ·w•„[ôÍ]ŒI©a>Çó3¿ï iŸ¹›þ Úðÿ¨{þ´ûþß]€ÏM›ÿ™ô÷ý™Nú“ü?ú?~ߧf ägîþ¸|‰¯¤ Œ:@þÿ±ýë.Þg  ­÷…¶ŒÀè>[©ƒ‘ò$GòÝyõq“¶ó<ý"kÚ¼þ=~Wú/… ÿ¾È]Þ7Õé‹õ³g¿kÚVùr}~þ{^,²¢O«Å&d¶.//·~ò'òÿC(:

    It will look so cool if I can pass that into a script, convert it back to bytes, decompress, convert it back to a string in order to have it spit out my dragon even if I can't one-line it :)

    alas, decompression is not working as it should just yet... I goofed something somewhere... sigh... to be continued....

    Friday, May 21, 2010 9:51 PM
  • Now THAT'S obfuscation!


    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" "))
    Friday, May 21, 2010 10:11 PM
  • I had to put the -replace back.  I tested after you posted that it worked without it, and it did.  I got to thinking about why that sould be.  Every other time I've tried casting from [char[]] to [string] it uses the $ofs separator.  Then I tested again, and it came out with the separator. 

    I think it worked originally by virtue of being ran in a PS session where I'd run on of the sig scripts that set $ofs to null, and it was still set that way.


    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" "))
    Saturday, May 22, 2010 1:57 PM
  • Der... yeah... that's probably what I did... had $ofs set...

    Btw, if anyone wants a good source of ASCII art to steal/borrow from check out the rec.arts.ascii group.  A quick search will turn up pretty much anything in ascii art form:

    http://groups.google.com/group/rec.arts.ascii/topics?lnk=srg

    I'll eventually get around to posting the algorithm/techniques I used to generate my code... I'm still sucked into compression for now....  I got it all working with the exception of decompressing newline bytes in the obfuscated/compressed string....  Should have that done this week with a full write-up.  Then I can get back to the reason to learn all of this stuff:  Cool sig code :)

    Tuesday, May 25, 2010 2:38 AM
  • I was inspired by mjoliner's also, and created mine.

    Karl


    http://unlockpowershell.wordpress.com
    Email me@ [regex]::Matches("107097114108109105116115099104107101064109116046110101116",'(.{3})')|%{$m+=[char][int]$_.value};$m
    Tuesday, May 25, 2010 6:03 PM
  • Very nice.  I like the regex :)


    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" ")) -replace " "
    Tuesday, May 25, 2010 6:16 PM
  • Thanks :)

    As you know, I shortened it from:

    $t ="10797114108109105116115991041071016410911646110101116";$m=""

    $match = "(.{3})(.{2})(.{3})(.{3})(.{3})(.{3})(.{3})(.{3})(.{2})(.{3})(.{3})(.{3})(.{2})(.{3})(.{3})(.{2})(.{3})(.{3})(.{3})"

    [regex]::Match($t, $match).groups[1..[regex]::Match($t, $match).groups.count]|%{$m +=[char][int]$_.ToString()};$m

     


    http://unlockpowershell.wordpress.com
    Email me@ [regex]::Matches("107097114108109105116115099104107101064109116046110101116",'(.{3})')|%{$m+=[char][int]$_.value};$m
    Tuesday, May 25, 2010 6:51 PM
  • I remember looking at that and think there had to be a better way.  Then my mower deck threw a bearing and I got side tracked.....
    [string][char[]][int[]]("114 111 98 95 99 97 109 112 98 101 108 108 64 99 101 110 116 114 97 108 116 101 99 104 110 111 108 111 103 121 46 110 101 116" -split(" ")) -replace " "
    Tuesday, May 25, 2010 6:59 PM
  • Putting your lawn before PowerShell?


    Shame on you! ;)


    http://unlockpowershell.wordpress.com
    Email me@ [regex]::Matches("107097114108109105116115099104107101064109116046110101116",'(.{3})')|%{$m+=[char][int]$_.value};$m
    Tuesday, May 25, 2010 7:08 PM
  • This is mutiny!  semicolons are not in one-liners :)

    write-host ([regex]::Matches("107097114108109105116115099104107101064109116046110101116",'(.{3})')|%{[char][int]$_.value}) -separator ""

    Okay, so you both inspired me... I've taken both of your work, and claim that I have officially kicked it up even higher.... This will definitely be my sig!  I believe this is a work of art!

    write-host ((0..56)|%{if (($_+1)%3 -eq 0){[char][int]("116111101110117102102064103109097105108046099111109"[($_-2)..$_] -join "")}}) -separator ""
    I stole Karl's 3 char byte technique with mjolinor's classic move... I wanted to find a way around regexes b/c the word regex gives it readability ;).... Now, the only thing left would be to find a way to get rid of the [char][int] to make it truly unreadable....
    Tuesday, May 25, 2010 7:32 PM
  • testing sig

     


    write-host ((0..90)|%{if (($_+1)%3 -eq 0){[char][int]("104116116112058047047112111119101114116111101046119111114100112114101115115046099111109"[($_-2)..$_] -join "")}}) -separator ""
    Tuesday, May 25, 2010 7:44 PM
  • I'm not so original, but this point looks interesting for me:

    $email = new-object -com certificateauthority.encodealtname
    $email.decode([char]5680+[char]5249+[char]28790+[char]25711+[char]28257+[char]16499+[char]31091+[char]24947+[char]28004+[char]28265+[char]11891+[char]30316)
    $email.getname(0)


    http://www.sysadmins.lv
    Tuesday, May 25, 2010 8:04 PM
  • Okay, now I'm inspired.


    [string](0..33|%{[char][int](46+("68655249535163665255626218535564706851627055535864656265577500645570").substring(($_*2),2))})-replace " "
    Tuesday, May 25, 2010 8:48 PM
  • Hmm.

    Wonder why that one wraps ugly?


    [string](0..33|%{[char][int](46+("68655249535163665255626218535564706851627055535864656265577500645570").substring(($_*2),2))})-replace " "
    Tuesday, May 25, 2010 8:53 PM
  • test
    [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
    Tuesday, May 25, 2010 9:22 PM
  • Elegant.  I like it.  Took me a bit to figure it out, but it's a solid approach :)
    write-host ((0..90)|%{if (($_+1)%3 -eq 0){[char][int]("104116116112058047047112111119101114116111101046119111114100112114101115115046099111109"[($_-2)..$_] -join "")}}) -separator ""
    Wednesday, May 26, 2010 4:50 PM
  • I'd thought about converting the literal character values to hex to cut down on the size of the literal string, but the decimal to hex conversion added more than I saved.  Then I realized I could just offset all the values by the lowest valued character in the string, and accomplish the same thing (getting down to only needing 2 digits to represent each character).  You just have to add the offset value back in during the foreach processing
    [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
    Wednesday, May 26, 2010 5:24 PM
  • This one is more my style:

     

    $m = "32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 95 95 95 32 32 32 32 32 32 124 92 95 95 95 95 95 95 95 95 47 41 13 10 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 91 95 44 95 93 41 32 32 32 32 92 32 47 32 32 32 32 32 32 32 92 124 13 10 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 124 61 84 61 124 93 32 32 32 32 32 47 32 32 32 95 95 32 32 95 95 92 13 10 32 32 32 32 32 32 32 32 32 32 32 32 32 32 124 92 32 34 32 47 47 32 32 32 32 32 124 95 32 32 57 32 32 32 112 32 93 92 13 10 32 32 32 32 32 32 32 32 32 32 32 32 32 32 124 124 39 45 39 47 45 45 46 32 32 47 32 47 92 32 61 124 32 32 92 124 92 32 92 13 10 32 32 32 32 32 32 32 32 32 32 32 32 32 47 124 124 32 60 92 47 62 32 124 92 32 124 32 39 46 95 44 32 64 32 64 41 60 95 41 13 10 32 32 32 32 32 32 32 32 32 32 32 32 124 32 124 92 32 32 32 124 32 32 124 32 32 32 92 46 95 95 47 40 95 59 95 41 13 10 32 32 32 32 32 32 32 32 32 32 32 32 124 32 32 46 32 32 32 72 32 32 124 32 32 32 124 32 32 58 32 32 39 61 39 124 13 10 32 32 32 32 32 32 32 32 32 32 32 32 124 32 32 124 32 32 95 72 95 95 47 32 32 95 124 32 58 32 32 32 32 32 32 124 13 10 32 32 32 32 32 32 32 32 32 32 32 32 32 92 32 32 39 46 95 95 32 32 92 32 47 32 32 59 32 32 32 32 32 32 39 59 13 10 32 32 32 32 32 32 32 32 32 32 32 32 95 95 39 45 46 95 40 95 125 61 61 46 39 32 32 58 32 32 32 32 32 32 32 59 13 10 32 32 32 32 32 32 32 32 32 32 32 40 95 95 95 124 32 32 32 32 47 45 39 32 124 32 32 32 58 46 32 32 32 32 32 58 13 10 32 32 32 32 32 32 32 32 32 32 91 46 45 39 32 32 92 32 32 32 124 32 32 32 92 32 32 32 92 32 59 32 32 32 58 13 10 32 32 32 32 32 32 32 32 32 46 45 39 32 32 32 32 32 124 32 32 124 32 32 32 32 124 32 32 124 32 32 32 34 58 13 10 32 32 32 32 32 32 32 32 47 32 32 32 32 32 32 32 32 124 61 61 124 32 32 32 32 32 92 32 32 92 32 32 47 32 32 92 95 13 10 32 32 32 32 32 32 32 47 32 32 32 32 32 32 32 32 32 91 32 32 124 32 32 32 32 32 32 39 46 95 92 95 32 45 46 95 32 92 13 10 32 32 32 32 32 32 47 32 32 32 32 32 32 32 32 32 32 32 92 95 95 41 32 32 32 95 95 46 45 32 92 32 92 32 32 32 41 92 92 13 10 32 32 32 32 32 47 32 32 32 32 32 32 32 124 32 32 32 32 32 32 32 32 47 46 39 32 32 32 32 32 32 62 62 41 13 10 32 32 32 32 32 124 32 32 32 32 32 32 32 32 92 32 32 32 32 32 32 32 124 92 32 32 32 32 32 124 13 10 32 32 32 32 32 124 32 32 32 32 32 46 39 32 32 39 45 46 32 32 32 32 124 32 92 32 32 32 32 47 13 10 32 32 32 32 32 124 32 32 32 32 47 32 32 32 32 32 47 32 32 32 32 32 47 32 47 32 32 32 47 13 10 32 32 32 32 32 32 32 32 32 32 115 110 100 32 32 32 124 32 32 32 32 47 32 13 10";$ofs="";[string]($m.Split() |% {[char][int]$_})
    Wednesday, May 26, 2010 9:54 PM
  • See if this works

    *My signature hasn't changed for some reason

    [string]([regex]::Matches("6B61726C6D69747363686B65406D742E6E6574",'(.{2})')|%{[char][Convert]::ToInt32($_.value,16)})


    http://unlockpowershell.wordpress.com
    Email me@ [regex]::Matches("107097114108109105116115099104107101064109116046110101116",'(.{3})')|%{$m+=[char][int]$_.value};$m

    Thursday, May 27, 2010 5:41 PM
  • Lee Holmes (http://www.leeholmes.com/blog/) shortened my new sig to:

    -join("6B61726C6D69747363686B65406D742E6E6574"-split"(?<=\G.{2})",19|%{[char][int]"0x$_"})

    Now it's more PowerShelly :)


    http://unlockpowershell.wordpress.com
    [string]([regex]::Matches("6B61726C6D69747363686B65406D742E6E6574",'(.{2})')|%{[char][Convert]::ToInt32($_.value,16)})
    Tuesday, June 01, 2010 9:29 PM
  • Whoa.  I'll have to chew on that for a while.  I've seen a couple of Lee's posts on the forums today. 

    I meant to follow up on that hex conversion you posted.  Thank you, that does work.  I'm still debating whether to go with the hex version or stay with the offset.  As far as being obfuscated goes, it seems less likely the offset version would be picked up than a straight conversion to either hex or decimal in the literal string.


    [string](0..33|%{[char][int](46+("686552495351636652556262185355647068516270555358646562655775 0645570").substring(($_*2),2))})-replace " "
    Tuesday, June 01, 2010 9:55 PM
  • Yes, I am still chewing on it, myself ;)

    I agree, and I ewas just doing the same thing (adding 46), when you moidified yours.

    Although you can inspire me, I can't flat out copy you, so I did the hex ;)

    Karl


    http://unlockpowershell.wordpress.com
    -join("6B61726C6D69747363686B65406D742E6E6574"-split"(?<=\G.{2})",19|%{[char][int]"0x$_"})
    Wednesday, June 02, 2010 7:16 PM
  • Karl,

    That is awesome!  Interesting with the -join at the beginning too.

     

     


    write-host ((0..56)|%{if (($_+1)%3 -eq 0){[char][int]("116111101110117102102064103109097105108046099111109"[($_-2)..$_] -join "")}}) -separator ""
    Wednesday, June 02, 2010 9:14 PM
  • Yes, I love it :)

    It was quite an honor to have Lee help with it, and ironically, I was using his post as an inspiration:

    http://www.leeholmes.com/blog/HolidayWishes.aspx and

    http://www.leeholmes.com/blog/AnExerciseInDeObfuscation.aspx

    Karl


    http://unlockpowershell.wordpress.com
    -join("6B61726C6D69747363686B65406D742E6E6574"-split"(?<=\G.{2})",19|%{[char][int]"0x$_"})
    Wednesday, June 02, 2010 9:41 PM
  • -join([char[]][Convert]::FromBase64String(''+'ICAg'*13+'ICwgICAsCi'+'AgIC'*13+
    'AkLCAgJCwgICAgICwKICBObyBkcmFnb24gY2FuIHJlc2lzd'+'CAgI'*6+'CJzcy4kc3MuIC5zJw'+
    'ogICAgdGhlIGZhc2NpbmF0aW9u'+'ICAg'*4+'ICwgICAgIC5zcyQkJCQkJCQkJCRzLAogICAgb2'+
    'YgcmlkZGxpbmcgdGFsay'+'AgIC'*4+'QuIHM'+'kJCQ'*4+'kJGAkJFNzCiAgIGFuZCBvZiB3YX'+
    'N0aW5nIHRpbWUgICAgICAgICAgIi'+'QkJC'*5+'QkJG8kJCQgICAgICAgLAogdHJ5aW5nIHRvIH'+
    'VuZGVyc3RhbmQgaXQgICAgICAgcy'+'QkJC'*7+'QkJHMsICAscwogIC0tIEouIFIuIFRvbGtpZW'+
    '4gICAgICAgICAgICBzJCQkJCQkJCQkIiQkJCQkJCIiIiIkJCQkJCQiJCQkJCQsCi'+'AgIC'*9+
    'AgIHMkJCQkJCQkJCQkcyIiJCQkJHNzc3NzcyIkJCQkJCQkJCIK'+'ICAg'*9+'ICBzJCQkJCQkJC'+
    'QkJCcgICAgICAgICBgIiIic3MiJCIkcyIiCi'+'AgIC'*9+'AgcyQkJCQkJCQkJCQs'+'ICAg'*4+
    'ICBgIiIiIiIkICAucyQkcwo'+'gICA'*9+'gIHMkJCQkJCQkJCQkJCRzLC4uLi'+'AgIC'*4+
    'AgIGBzJCQnICBgCi'+'AgIC'*8+'Bgc3Nzcy'+'QkJC'*6+'QkIyMjI3MuICAgICAuJCQiJC4gIC'+
    'AsIHMtCi'+'AgIC'*8+'AgIGAiIiIi'+'JCQk'*6+'JCQjIyMjIyQkJCQkJCIgICAgICQuJCcKIC'+
    'BGZXcgaGFja2VycyBjYW4gcmVzaXN0ICAgICAgICI'+'kJCQ'*7+'jIyMjcyIiICAgICAuJCQkfA'+
    'ogICAgIHNvbHZpbmcgYSBwcm9ibGVtICAgICAgICAgICI'+'kJCQ'*8+'jI3MgICAgLiQkIiAkCi'+
    'AgIHdoZW4gdGhleSBjYW4gc29sdmUgaXQsICAgICAgICQkIiI'+'kJCQ'*9+'kJCIgICBgCiBhbm'+
    'Qgbm8gb25lIGVsc2UgaXMgc29sdmluZyBpdC4gICQkIiAgIiQi'+'JCQk'*6+'JCRTIiIiIicKIC'+
    'AgICAtLSBUaGUgSGFja2VyIEZBUSAgICAgICAsICAgLCIgICAgICcgI'+'CQkJ'*5+'CQjIyMjcwo'+
    'gICA'*9+'gICQuICAgICAgICAgIC5z'+'JCQk'*5+'JCQjIyMjIgo'+'gICA'*5+'gICwgICAgICA'+
    'gICAgICIkcy4gICAuLnNzUy'+'QkJC'*6+'QjIyMjIgo'+'gICA'*5+'gICQgICAgICAgICAgIC4k'+
    'JCRT'+'JCQk'*8+'IyMjIyMiCi'+'AgIC'*5+'AgU3MgICAgIC4uc1M'+'kJCQ'*9+'jIyMjIyMiIgo'+
    'gICA'*6+'iJCRzUy'+'QkJC'*9+'MjIyMjIyMjIgogICAgICAgICAgICwgICAgICBz'+'JCQk'*8+
    'IyMjIyMjIyMjIiInCiAgICAgICAgICAgJCAgICBz'+'JCQk'*7+'IyMjIyMjIyIiJyAgICAgIHMnI'+
    'CAgICAgICAgLAogICAgICAgICAgICQkLi4'+'kJCQ'*6+'jIyMjIyMiJyAgICAgICAuLi4uLCQkLi'+
    '4uLiAgICAsJAo'+'gICA'*4+'i'+'JCQk'*5+'IyMjIyMjIicgLCAgICAgLnNT'+'JCQk'*5+
    'JHMkJAo'+'gICA'*4+'gI'+'CQkJ'*4+'CMjIyMjIiAgICAgJCwgLnM'+'kJCQ'*7+'kJCRzLgogI'+
    'CApICAgICAgICAgICQkJCQkJCQkJCQkIyMjIyMnICAgICAgYCQkJCQkJCQkJCMjIyMjIyMjIyMjJC'+
    'QkJCQkJCQkJCQuCiAgKCggICAgICAgICAgJCQkJCQkJCQkJCQjIyMjIyAgICAgICAkJCQkJCQkJCM'+
    'jIyIgICAgICAgIiMjIyMkJCQkJCQkJCQkCiAgKSBcICAgICAgICAg'+'JCQk'*4+'IyMjIy4gICAg'+
    'ICQkJCQkJCMjIyI'+'gICA'*4+'gIiMjIyQkJCQkJCQkJCAgIHMnCiAoICAgKSAgICAgICAg'+
    'JCQk'*4+'JCMjIyMuICAgJCQkJCQjIyMi'+'ICAg'*5+'ICMjIyMkJCQkJCQkJHMkJCcKICkgICgg'+
    'KCAgICAgICAkJCIkJCQkJCQkJCQkJCMjIyMjLiQkJCQkIyMjJyAgICAtIEpheWt1bCAgICAuIyMjJ'+
    'CQkJCQkJCQkJCIKICggICkgICkgICBfLCQiICAg'+'JCQk'*4+'IyMjIyMjLiQkIyMn'+'ICAg'*5+
    'IC4jIyMkJCQkJCQkJCQkCiApICggICggXC4gICAgICAgICAi'+'JCQk'*4+'JCMjIyMjIyMsLCwuI'+
    'CAgICAgICAgIC4uIyMjIyQkJCQkJCQkJCQkIgooICAgKSQgKSAgKSAgICAgICAgL'+'CQkJ'*6+'C'+
    'MjIy'*6+'MjJCQkJCQkJCQkJCQiCiggICAoJCQgICggXCAgICAgX3NTIiAgYCI'+'kJCQ'*13+'kJ'+
    'FMkJCwKICkgICkkJCRzICkgKSAgLiAgICAgIC4gICBg'+'JCQk'*12+'JCInICBgJCQKICAoICAgJ'+
    'CQkU3MvICAuJCwgICAgLiQsLHMkJCQkJCQjI1M'+'kJCQ'*7+'kJCRTIiIgICAgICAgICcKICAgIF'+
    'wpXy'+'QkJC'*7+'QkIyMiICAkJCAgICAgICAgYCQkLiAgICAgICAgYCQkLgogICAgICAgIGAiUy'+
    'QkJC'*5+'QkIyIgICAgICAkICAgICAgICAgIGAkICAgICAgICAgIGAkCiAgICAgICAgICAgIGA'+
    'iIiI'*4+'iJyAgICAgICAgICcgICAgICAgICAgICcgICAgICAgICAgICc='))
    
    
    (ok, fine, I'll line-wrap it)
    Thursday, April 07, 2011 6:10 PM
  • You can get rid of the hard coded length using a negative lookahead

    -join('4a61796b756c40487564646c65644d61737365732e6f7267'-split"(?<=\G..)(?!$)"|%{[char][int]"0x$_"})

    But you have to ask if all that regex is worth it, vs Base64, which is shorter...

    -join([char[]][Convert]::FromBase64String('SmF5a3VsQEh1ZGRsZWRNYXNzZXMub3Jn'))

    Thursday, April 07, 2011 6:19 PM
  • Cheating!  Way too easy to figure out what's going on.  You need to obfuscate the FromBase64String somehow :)

    Oh, and the dragon is nowhere near as cool!  Although to be honest, I did steal mine from rec.arts.ascii

    I must admit: J.R.R. Tolkien quote is a nice touch.


    http://twitter.com/toenuff
    write-host ((0..56)|%{if (($_+1)%3 -eq 0){[char][int]("116111101110117102102064103109097105108046099111109"[($_-2)..$_] -join "")}}) -separator ""
    Thursday, April 07, 2011 6:27 PM
  • Wow, you guys are awesome, It took me an hour to make mu signature
    ([string](0..40|%{[char][int](32+("46738372797663 0357269848489088380727378888884697673676584723289657279791467797709").substring(($_*2),2))}) -replace "\s{1}","")
    Sunday, August 28, 2011 8:04 AM
  • It took me awhile to figure out how you guys were doing this, but now I have (finally) created my own sig.... $12=[string](0..21|%{[char][int](46+('545168536565625518635554 07163595358 0555471').substring(($_*2),2) )})-replace ' ';$32=[string](0..45|%{[char][int](46+('385859645769497359626249525549525570705568496564535549756571-76855492374535851645755544912-5').substring(($_*2),2) )})-replace ' ' -replace '_',' ';$12+" | "+$32 Nothing fancy, but it works!
    Wednesday, March 28, 2012 2:37 PM
  • Here is my Dragon:

    $e = "13 10 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 124 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 92 39 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 94 94 94 47 32 124 94 92 90 32 32 32 32 32 32 32 32 32 32 32 47 32 32 124 39 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 124 32 32 32 32 32 32 32 32 32 92 90 32 32 32 32 32 32 32 32 32 47 32 32 32 124 39 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 32 64 32 32 32 32 32 32 32 32 92 90 32 32 32 32 32 32 32 47 32 32 32 47 32 92 95 95 95 95 95 95 95 39 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 40 32 32 92 32 32 32 32 32 32 95 32 47 32 32 32 32 32 32 32 32 32 32 32 32 92 90 32 32 32 32 32 47 32 32 32 47 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 40 32 32 32 32 32 45 45 45 45 32 47 71 32 32 32 32 32 32 32 124 92 32 32 32 32 32 32 124 90 32 32 32 47 32 32 32 47 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 40 32 32 47 32 45 45 45 45 32 92 32 32 32 32 47 45 45 45 39 47 92 32 32 32 32 32 124 90 32 32 47 32 32 32 47 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 92 47 45 45 39 32 32 32 47 45 45 47 32 32 32 47 90 32 32 47 32 32 32 32 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 124 32 32 32 32 32 47 45 45 47 32 32 32 124 90 32 32 47 32 32 32 32 32 32 32 32 32 32 32 32 47 32 92 95 95 95 95 95 95 95 39 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 47 45 45 47 32 32 32 32 124 90 32 32 92 32 32 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 47 45 45 47 32 32 32 32 32 47 45 45 47 32 32 32 32 32 92 90 32 32 32 124 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 47 32 32 47 32 32 32 32 32 47 45 45 47 32 32 32 32 32 32 32 92 90 32 32 47 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 124 45 45 124 32 32 32 32 32 32 32 32 32 92 90 47 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 32 124 45 45 45 124 32 32 32 32 32 32 32 32 47 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 45 45 45 45 47 39 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 47 32 32 32 32 32 32 32 47 45 45 47 32 32 32 32 32 32 92 90 32 32 47 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 39 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 45 45 45 124 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 94 94 94 94 94 94 94 94 94 94 94 94 92 90 39 32 32 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 47 32 32 32 32 32 47 32 32 32 32 32 32 32 32 124 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 90 39 32 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 45 47 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 90 39 32 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 47 32 32 32 32 32 32 32 32 124 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 90 39 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 45 45 45 39 32 32 32 32 124 92 95 95 95 95 95 95 95 95 124 32 32 32 32 32 32 124 95 95 95 95 95 95 95 32 32 32 32 32 32 32 32 32 32 124 90 39 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 92 45 45 39 32 32 32 32 32 47 92 47 32 92 124 95 124 95 124 95 124 124 32 32 32 32 32 32 124 95 124 95 124 95 124 95 124 92 95 32 32 32 32 32 32 32 124 90 39 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 95 95 95 95 95 95 47 32 32 32 32 32 32 32 32 32 32 32 32 47 32 32 32 32 32 47 32 32 47 32 32 32 32 32 32 124 95 32 32 32 32 32 32 32 47 90 39 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 45 45 45 39 32 32 32 32 124 32 32 47 32 39 39 39 39 32 32 32 32 32 32 32 32 32 32 32 47 90 39 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 45 45 39 32 32 32 32 32 47 92 47 32 32 92 32 32 95 95 95 95 95 95 95 95 95 95 95 95 95 47 90 39 32 32 115 13 10 115 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 92 95 95 95 95 95 95 47 32 32 32 32 32 32 92 47 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 32 80 111 119 101 114 83 104 101 108 108 32 52 46 48 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 115 13 10 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 115 13 10";$ofs="";[string]($e.Split() |% {[char][int]$_})

    http://bm3dconcept.com



    Sunday, May 10, 2015 7:49 AM
  • Cool


    When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
    My Blog: Unlock PowerShell
    My Book: Windows PowerShell 2.0 Bible
    My E-mail: -join('6D73646E5F6B61726C406F75746C6F6F6B2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}})

    Sunday, May 10, 2015 2:31 PM