Pkg.PowerShellBeautifier — API for deobfuscating Microsoft PowerShell scripts

Overview

The Pkg.PowerShellBeautifier module contains the API for deobfuscating Microsoft PowerShell scripts.

Beautifying a PowerShell Script

The following code example demonstrates how to beautify a PowerShell script:

from Pkg.PowerShellBeautifier import *

script = r"""$A = get-childitem c:\temp

$B = gET-cHILDITEM c:\temp

$C = get-conTENT c:\temp\asdf.txt

$D = DIR C:\

iF (1 -eq 1) {
    Write-hOSt "hi"
}
"""

bt = PowerShellBeautifier()
bt.deobfuscate_code = True
bt.keep_comments = True
bt.name_variables = True
bt.remove_unused_variables = True
bt.replace_variables = True
bt.known_variables = bt.defaultKnownVariables()

output = bt.beautify(script, "text")
print(output)

Module API

Pkg.PowerShellBeautifier module API.

Classes:

PowerShellBeautifier()

Beautifier for PowerShell scripts.

class PowerShellBeautifier

Beautifier for PowerShell scripts.

Methods:

beautify(script[, fmt])	Beautifies the input script.
defaultKnownVariables()	Returns a dictionary that can be used to initialize known_variables.

Attributes:

deobfuscate_code	If True, deobfuscates the code.
indent_spaces	The amount of indentation spaces.
keep_comments	If True, keeps the comments in the code.
known_variables	A dictionary used to resolve known variables.
name_variables	If True, automatically names variables.
remove_unused_variables	If True, removes unused variables in the code.
replace_variables	If True, replaces the variables in the code.

beautify(script: str, fmt: str = 'text') → Optional[str]

Beautifies the input script.

Parameters

• script (str) – The script to beautify.

• fmt (str) – The output format. Only "text" is supported.

Returns

Returns the beautified code as a string if successful; otherwise returns None.

Return type

Optional[str]

defaultKnownVariables() → Dict[str, Union[str, int]]

Returns

Returns a dictionary that can be used to initialize known_variables.

Return type

Dict[str, Union[str, int]]

See also known_variables.

deobfuscate_code

If True, deobfuscates the code.

indent_spaces

The amount of indentation spaces.

keep_comments

If True, keeps the comments in the code.

known_variables

A dictionary used to resolve known variables.

Note

The variable names must be lowercase.

See also defaultKnownVariables().

name_variables

If True, automatically names variables.

remove_unused_variables

If True, removes unused variables in the code.

replace_variables

If True, replaces the variables in the code.