Unable to deobfuscate Invoke-Obfuscation about box-ps HOT 2 CLOSED

Interesting, thank you. I'll check it out!

from box-ps.

This was definitely due to a difference between Windows and Linux, specifically string encoding. That PtrToStringAuto method in a linux environment interprets null bytes as the end of the string, so when you give it a UTF-16 string it stops after the first character because they're pretty much always padded with null bytes. I added an override for that method in the harness that just takes the pointer and passes it to PtrToStringBSTR to do the string conversion.

Nice find. Thanks again!

from box-ps.