Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-29-2026, 20:08
Gladiyator's Avatar
Gladiyator Gladiyator is offline
Family
 
Join Date: Jan 2009
Location: .:: Tehran ::.
Posts: 119
Rept. Given: 79
Rept. Rcvd 68 Times in 23 Posts
Thanks Given: 147
Thanks Rcvd at 156 Times in 43 Posts
Gladiyator Reputation: 68
Lightbulb PS2VM – PowerShell to Bytecode VM

I’d like to share a small open-source project I’ve been working on: PS2VM.

PS2VM is a tool that compiles a subset of Windows PowerShell 5.x scripts into a compact bytecode format (.pbc) and runs them on a simple stack-based virtual machine. The goal is not to replace PowerShell, but to explore an alternate execution path: AST → opcodes → VM, with fallback to the real PowerShell engine on the same runspace when a construct isn’t implemented natively.

What it can do

Compile .ps1 → .pbc

Run bytecode inside the VM

Disassemble .pbc for inspection

Handle common language features (functions, loops, if/switch, arrays, pipelines in a limited form, cmdlet calls, scoped variables, etc.)

Delegate complex features (try/catch, modules, advanced attributes, redirections, and more) to the host PowerShell engine so scripts don’t simply break

What it is not

A full reimplementation of the PowerShell runtime

A guarantee of 100% language coverage

A tool intended for malware, evasion, or unauthorized use

It’s aimed at people interested in compilers, interpreters, PowerShell internals, automation research, and experimentation with custom execution engines — for legitimate and authorized use only.

Feedback, issues, and constructive criticism are welcome.

Thanks for reading.


Github Repo : https://github.com/NIKJOO/PS2VM
Reply With Quote
The Following 2 Users Gave Reputation+1 to Gladiyator For This Useful Post:
blue_devil (09-30-2026), Kurapica (10-02-2026)
The Following 7 Users Say Thank You to Gladiyator For This Useful Post:
blue_devil (09-30-2026), chants (10-02-2026), Kurapica (09-29-2026), MarcElBichon (09-29-2026), niculaita (09-30-2026), SofTw0rm (10-02-2026), tonyweb (10-03-2026)
  #2  
Old 10-02-2026, 14:33
chants's Avatar
chants chants is offline
VIP
 
Join Date: Jul 2016
Posts: 906
Rept. Given: 51
Rept. Rcvd 53 Times in 32 Posts
Thanks Given: 784
Thanks Rcvd at 1,192 Times in 555 Posts
chants Reputation: 53
Cool project, have you considered the various performance implications of custom byte code, some of these or most are pass through optimizations. But check this out "Loops that have fewer than 300 instructions are eligible for JIT-compilation. Loops larger than that are too costly to compile. When the loop has executed 16 times, the script is JIT-compiled in the background. When the JIT-compilation completes, execution is transferred to the compiled code."
Quote:
https://learn.microsoft.com/en-us/powershell/scripting/dev-cross-plat/performance/script-authoring-considerations?view=powershell-7.6
So my guess is virtual execution will not scale well for big loops e.g. a compression/encryption of a file or such use cases at least very easily. But then I was thinking if there were a way to forward the whole loop to the original engine probably it would be okay. Anyway, not sure how common big loops are in PS scripts.

I like the logo too BTW.
Reply With Quote
Reply

Tags
obfuscation, obfuscator, powershell, virtualization

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On



All times are GMT +8. The time now is 13:05.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )