cobbr / cobbr/PSAmsi

PSAmsi cannot obfuscate Invoke-Mimikatz.ps1 (obfuscation fails)

Open
#4 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
397
Forks
71
PR merge metrics
No merged PRs in 30d

Description

The obfuscation functionality fails and this line is reached:

```ps
# If we've run through all the strings and the string is still flagged, obfuscation fails
If (($TokenIndex -ge ($MatchingTokens.Count-1))) { $DoneObfuscating = $True }
```
(https://github.com/cobbr/PSAmsi/blob/master/PSAmsiClient.ps1#L3177)

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with Invoke-Mimikatz.ps1 and inspect PSAmsiClient.ps1 around line 3177, where obfuscation is reported as failed after the matching tokens are processed. Trace the token-processing path to determine why the input remains flagged, then verify that obfuscation completes successfully for this script.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.