Evade AV detection

This commit is contained in:
2025-07-02 23:35:17 +05:30
parent 5aa7d4f3de
commit ef411e14ca
11 changed files with 93 additions and 93 deletions

View File

@ -207,7 +207,7 @@ goto dk_done
::pstst $ExecutionContext.SessionState.LanguageMode :pstst
for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('!_batp!') -split ':pstst';iex ($f[1])}" %nul6%') do (set tstresult=%%a)
for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('!_batp!') -split ':pstst';& ([scriptblock]::Create($f[1]))}" %nul6%') do (set tstresult=%%a)
if /i not "%tstresult%"=="FullLanguage" (
%eline%
@ -718,7 +718,7 @@ echo Checking SPP permission related issues...
call :checkperms
if defined permerror (
call :dk_color %Red% "[!permerror!]"
%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':fixsppperms\:.*';iex ($f[1])" %nul%
%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split ':fixsppperms\:.*';& ([scriptblock]::Create($f[1]))" %nul%
call :checkperms
if defined permerror (
call :dk_color %Red% "[!permerror!] [Failed To Fix]"
@ -788,8 +788,8 @@ if defined _vis (
echo:
echo Reinstalling system licenses...
%psc% "$sls = Get-WmiObject SoftwareLicensingService; $f=[io.file]::ReadAllText('!_batp!') -split ':xrm\:.*';iex ($f[1]); ReinstallLicenses" %nul%
if %errorlevel% NEQ 0 %psc% "$sls = Get-WmiObject SoftwareLicensingService; $f=[io.file]::ReadAllText('!_batp!') -split ':xrm\:.*';iex ($f[1]); ReinstallLicenses" %nul%
%psc% "$sls = Get-WmiObject SoftwareLicensingService; $f=[System.IO.File]::ReadAllText('!_batp!') -split ':xrm\:.*';& ([scriptblock]::Create($f[1])); ReinstallLicenses" %nul%
if %errorlevel% NEQ 0 %psc% "$sls = Get-WmiObject SoftwareLicensingService; $f=[System.IO.File]::ReadAllText('!_batp!') -split ':xrm\:.*';& ([scriptblock]::Create($f[1])); ReinstallLicenses" %nul%
if %errorlevel% EQU 0 (
echo [Successful]
) else (
@ -1435,7 +1435,7 @@ exit /b
:regownstart
%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':regown\:.*';iex ($f[1]);"
%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split ':regown\:.*';& ([scriptblock]::Create($f[1]));"
exit /b
:: Below code takes ownership of a volatile registry key and deletes it