Add PowerShell deobfuscation operations (Format String, EncodedCommand, Backtick, Concatenation, Char Decode)

[vigneshrajan94]

Summary

Partially addresses #2396.

Adds five new operations to the Code tidy category covering all PowerShell obfuscation techniques requested in #2396:

Operation	Technique deobfuscated	Example
PowerShell Format String Deobfuscate	-f format operator	("{0}{2}{1}" -f 'new-ob','t','jec') → new-object
PowerShell Decode EncodedCommand	-enc / -e / -ec Base64 UTF-16LE	powershell -enc SQBFAFgA → IEX
PowerShell Backtick Remove	Backtick character insertion	In`voke-Ex`pression → Invoke-Expression
PowerShell Concatenation Join	String fragment concatenation	'New-'+'Object' → 'New-Object'
PowerShell Char Decode	[char] / [char[]] casting	[char[]](73,69,88) → "IEX"

Implementation details

• Each operation extends Operation with inputType/outputType: "string" and lives in src/core/operations/
• All five include checks patterns so the Magic operation auto-detects obfuscated input
• Backtick Remove has an optional Preserve escape sequences argument (default off) to retain legitimate PS escapes (`n, `t, `r, `$, `", , etc.) while stripping purely obfuscating backticks
• Decode EncodedCommand accepts a raw Base64 token or a full PowerShell command line with any mix of flags (strips the last whitespace-separated token and any surrounding quotes)
• Concatenation Join iterates until convergence, correctly collapsing arbitrarily long chains and mixed single/double-quote fragments
• Char Decode handles both decimal and 0x hex values, single [char]N casts, [char[]](...) arrays, and the -join [char[]] form; out-of-range codes are left unchanged

Tests

Each operation has a dedicated test file in tests/operations/tests/:

File	Tests
PowerShellFormatStringDeobfuscate.mjs	34 (including 10 OSINT-validated samples from Emotet, ANY.RUN, r00t-3xp10it)
PowerShellDecodeEncodedCommand.mjs	16
PowerShellBacktickRemove.mjs	23
PowerShellConcatenationJoin.mjs	19
PowerShellCharDecode.mjs	22

Test cases were validated against real-world OSINT samples from Emotet download cradles, AMSI bypass patterns, Invoke-Obfuscation output, and Invoke-PSObfuscation output.

All 241 existing operation tests continue to pass. The two pre-existing Node API test failures (chef.help count and MAGIC suggestions) are unrelated to this PR and present on the unmodified master branch.

Test plan

• npm test — 241 passing, same 2 pre-existing Node API failures
• Load CyberChef in browser → Code tidy category shows all five new operations
• Paste ("{0}{2}{1}" -f 'new-ob','t','jec') into Format String Deobfuscate → new-object
• Paste SQBFAFgA into Decode EncodedCommand → IEX
• Paste In`voke-Ex`pression into Backtick Remove → Invoke-Expression
• Paste 'New-'+'Object' into Concatenation Join → 'New-Object'
• Paste [char[]](73,69,88) into Char Decode → "IEX"
• Chain all five in a recipe against a heavily obfuscated script

[CLAassistant]

All committers have signed the CLA.

[HackingRepo]

@vigneshrajan94,

What you do now?

powershell deobfuscation is hard process, what you do now? powershell obfuscation is hard and use multiple techniques, just close, i do'nt see any value of that and can be easily defeated, powershell obfuscation is a complex thing

I do'nt see any value for that, obfuscation is not something simple can be solved, AI can even struggle with some

[vigneshrajan94]

@HackingRepo Agree with your point. It is near impossible for us to write recipes for all available obfuscation techniques.

What I have done is added a few of them that may help us in the dropper stage of commodity malware/analysis.

I've come across these a lot of times while working at the SOC previously and it adds value for those members who use it and don't have a separate VM where they can detonate stuff or install additional tools.

[solcoteh]

@HackingRepo
@vigneshrajan94

Thank you for working on this PR and for partially addressing the PowerShell deobfuscation feature request.

I understand that PowerShell obfuscation is a very broad and complex topic, and no single implementation can handle every possible technique from the beginning. However, as an Iranian proverb says: “Drop by drop, a sea is formed.”

Great projects do not usually start as complete and perfect systems. They grow step by step. Even these initial operations can be very useful for analysts, SOC teams, students, and malware researchers who need quick and safe static deobfuscation inside CyberChef.

If this feature continues to be improved over time with more techniques, better detection, and deeper static analysis, it could eventually become a very powerful and professional PowerShell deobfuscation toolkit within CyberChef.

So I believe this PR is a valuable first step, and it can become the foundation for something much bigger in the future.