EvaluatorOptions class for defining behavioral options in vbSparkle

.github/workflows/dotnet.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Setup .NET
       uses: actions/setup-dotnet@v2
       with:
-        dotnet-version: 6.0.x
+        dotnet-version: 8.0.x
     - name: Restore dependencies
       run: dotnet restore
     - name: Build

.github/workflows/main.yml

@@ -0,0 +1,66 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Log level'     
+        required: true
+        default: 'warning'
+      tags:
+        description: 'Test scenario tags'  
+
+jobs:
+  release:
+    name: Release
+    strategy:
+      matrix:
+        kind: ['linux', 'windows', 'macOS']
+        include:
+          - kind: linux
+            os: ubuntu-latest
+            target: linux-x64
+          - kind: windows
+            os: windows-latest
+            target: win-x64
+          - kind: macOS
+            os: macos-latest
+            target: osx-x64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v1
+
+      - name: Setup dotnet
+        uses: actions/setup-dotnet@v1
+        with:
+          dotnet-version: 3.1.101
+
+      - name: Build
+        shell: bash
+        run: |
+          tag=$(git describe --tags --abbrev=0)
+          release_name="vbSparkle-$tag-${{ matrix.target }}"
+
+          # Build everything
+          dotnet publish Sources/vbSparkle.Console/ --framework netcoreapp3.1 --runtime "${{ matrix.target }}" -c Release -o "$release_name"
+
+          # Pack files
+          if [ "${{ matrix.target }}" == "win-x64" ]; then
+            # Pack to zip for Windows
+            7z a -tzip "${release_name}.zip" "./${release_name}/*"
+          else
+          tar czvf "${release_name}.tar.gz" "$release_name"
+          fi
+
+          # Delete output directory
+          rm -r "$release_name"
+
+      - name: Publish
+        uses: softprops/action-gh-release@v1
+        with:
+          files: "vbSparkle-*"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -28,11 +28,30 @@ string deobfuscated = VbPartialEvaluator.PrettifyEncoded(obfuscatedVB);
 ## As a CLI
 The attached project `vbSparkle.CLI` is an exemple of use of vbSparkle as a CLI.
 The current exemple take either a path as an argument or a full binary in `StdIn`, and return the deobfuscated result.
-![Railroad Diagram](/Resources/cli-exemple.JPG)
+![cli-exemple](/Resources/cli-exemple.JPG)
+
+
+```
+  -p, --path                (Group: input) Path of directory or script file(s)
+                            to be deobfuscated.
+
+  --stdin                   (Group: input) (Default: false) Read from stdin
+
+  -o, --output              File offset.
+
+  --sym-rename-mode         (Default: None) Define how symbols can be renamed.
+                            Valid values: None, Variables, Constants, All
+
+  --junk-code-processing    (Default: Comment) Define how junk code should be
+                            processed. Valid values: Nothing, Remove, Comment
+
+  -i, --indent-spacing      (Default: 4) Defines the number of spaces taken into
+                            account for the indentation of the code.
+```
 
 ## Web UI
 The attached project `vbSparkle.Web` is an exemple of use of vbSparkle within a Web UI.
-![Railroad Diagram](/Resources/webUI.PNG)
+![web-ui](/Resources/webUI.PNG)
 
 # Why to write a VBScript de-obfuscator based on partial-evaluation ?
 VBScript and VBA code obfuscation are popular among attackers and allow to evade detection measures, antivirus, firewalls, EDRs, and allows to make malware analysis more difficult.

Sources/vbSparkle.Web/wwwroot/samples/real_1 - Copy.txt → Resources/samples/sample_10.txt

@@ -1,14 +1,6 @@
 wscript.sleep(10000)
 dim KWteaHafFeaq,JHgfeomgLpfMj:ZZFJFG58GJ55H85U5:dim kiolmp:kiolmp = chr(101):dhgprdt():i = 10 + 120 - 130:SDRertserfty = chr(10+10+10+9)
-Function chr(MYURTHFYTR6YFH6RYHF)
-Dim Z7UR7UFHEFRURGHRYHGYR
-dim SDRRFGTYHGFGFGf
-Z7UR7UFHEFRURGHRYHGYR = chr(MYURTHFYTR6YFH6RYHF)
-for i = 1000 - 999 to len(Z7UR7UFHEFRURGHRYHGYR)
-SDRRFGTYHGFGFGf = chr(asc(Z7UR7UFHEFRURGHRYHGYR))
-next
-W = SDRRFGTYHGFGFGf
-end Function
+
 function OPLMITJGUCN57 (OLGTUR783J4H6UR,NHGUIRTNVUTI65,KIOYKGJUTH6785HT)
 OPLMITJGUCN57 = Replace(OLGTUR783J4H6UR,NHGUIRTNVUTI65,KIOYKGJUTH6785HT)
 end function