Using PowerShell as a Reverse Engineering Tool
summary
PowerShell is used to load and introspect .NET assemblies via Assembly.Load and the Reflection/metadata tokens, extract embedded byte arrays and encoded strings, then reproduce the deobfuscation (XOR decoding, Base64 decode) to write inner executables to disk. The workflow demonstrates IL-level inspection (a custom Get-ILDisassembly), tools like ILSpy and de4dot, and a real sample that unpacks into a Bitcoin miner and DDoS component. Second half is lost due to lack of laptop battery power.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:02What is Reverse Engineering
- 2:36Why use PowerShell
- 4:27Tools for Reverse Engineering
- 8:26Main method
- 9:23Static load
- 10:58Extract wide array
- 11:14Implement logic
- 11:48Load the first executable
- 14:42Metadata Tokens
- 16:55Array Initializer
- 18:18HighFor Loop
- 19:44Trivia
- 22:41Base64 Decoding
related talks
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
50m.NET Reversing and Exploitation for Cool Kids
49mPowerShell obfuskation Techniques & How To Detect Them
01h 40mDefending against PowerShell attacks - in theory, and in practice
41mPowerShell Sandbox — Build It Yourself!
49mIronPython... OMFG
45m"Advanced Malware Threat: handling obfuscated code using..."
53mInside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques