Struct ScriptResult 

pub struct ScriptResult { /* private fields */ }

Contains the complete result of parsing and evaluating a PowerShell script.

This structure holds the final result value, any output generated, parsing errors encountered, and the tokenized representation of the script. It’s particularly useful for debugging and deobfuscation purposes.

Examples

use ps_parser::PowerShellSession;

let mut session = PowerShellSession::new();
let script_result = session.parse_command("$a = 42; $a").unwrap();

// Access different parts of the result
println!("Final value: {:?}", script_result.result());
println!("Output: {:?}", script_result.output());
println!("Errors: {:?}", script_result.errors());

Implementations

impl ScriptResult

pub fn result(&self) -> PsValue

Examples found in repository

examples/panic_hunt.rs (line 201)

fn depth_matrix() {
    let patterns: &[(&str, &str, &str)] = &[
        ("paren", "(", ")"),
        ("block", "& {", "}"),
        ("sub", "$(", ")"),
        ("dq", "\"$(", ")\""),
        ("idx", "$a[", "]"),
        ("if", "if(1){", "}"),
        ("ifelse", "if(0){1}else{", "}"),
        ("arr", "@(", ")"),
        ("hash", "@{a=", "}"),
        ("neg", "-(", ")"),
        ("method", "'a'.Replace((", "),'b')"),
        ("plus", "+(", ")"),
        ("not", "!(", ")"),
        ("cast", "[int](", ")"),
        ("sb", "{", "}"),
        ("cmd", "echo (", ")"),
    ];
    let only = std::env::args().nth(2);
    let depths: Vec<usize> = match std::env::args().nth(3) {
        Some(d) => d.split(',').map(|d| d.parse().unwrap()).collect(),
        None => vec![5, 10, 20, 40, 60, 80, 100, 300, 1500, 5000],
    };
    for n in depths {
        println!("--- depth {n}");
        let mut cases: Vec<(String, String)> = patterns
            .iter()
            .filter(|(name, _, _)| only.as_deref().is_none_or(|o| o == "all" || o == *name))
            .map(|(name, o, c)| (name.to_string(), format!("$a=1;{}1{}", o.repeat(n), c.repeat(n))))
            .collect();
        cases.push((
            "func".into(),
            format!("function f($n) {{ if ($n -gt 0) {{ f ($n - 1) }} else {{ 'done' }} }}; f {n}"),
        ));
        for (name, script) in cases {
            let (tx, rx) = std::sync::mpsc::channel();
            std::thread::Builder::new()
                .stack_size(1 << 20)
                .spawn(move || {
                    let t = std::time::Instant::now();
                    let r = PowerShellSession::new().parse_script(&script).map(|r| r.result());
                    let _ = tx.send(format!("{:?} [{} ms]", r, t.elapsed().as_millis()));
                })
                .unwrap();
            let res = rx
                .recv_timeout(std::time::Duration::from_secs(20))
                .unwrap_or_else(|_| "TIMEOUT".into());
            let short: String = res.chars().take(70).collect();
            println!("{name:>7}: {short}");
        }
    }
    std::process::exit(0);
}

fn run(script: &str) -> Option<String> {
    LAST.with(|l| l.borrow_mut().clear());
    let res = panic::catch_unwind(|| {
        let mut ps = PowerShellSession::new();
        let _ = ps.parse_script(script);
        let _ = PowerShellSession::new().parse_command(script);
    });
    // the hook fires even when the parser catches the panic internally
    let last = LAST.with(|l| l.borrow().clone());
    (res.is_err() || !last.is_empty()).then_some(last)
}

fn main() {
    panic::set_hook(Box::new(|info| {
        let loc = info
            .location()
            .map(|l| format!("{}:{}", l.file(), l.line()))
            .unwrap_or_default();
        let msg = info
            .payload()
            .downcast_ref::<&str>()
            .map(|s| s.to_string())
            .or_else(|| info.payload().downcast_ref::<String>().cloned())
            .unwrap_or_default();
        LAST.with(|l| *l.borrow_mut() = format!("{loc} | {msg}"));
    }));

    if std::env::args().nth(1).as_deref() == Some("--depth") {
        depth_matrix();
        return;
    }

    if let Some(script) = std::env::args().nth(1) {
        let (tx, rx) = std::sync::mpsc::channel();
        std::thread::spawn(move || {
            let t = std::time::Instant::now();
            let r = PowerShellSession::new().parse_script(&script).map(|r| r.result());
            let _ = tx.send(format!("[{} ms] {:?}", t.elapsed().as_millis(), r));
        });
        let res = rx
            .recv_timeout(std::time::Duration::from_secs(15))
            .unwrap_or_else(|_| "TIMEOUT".into());
        println!("{}", res.chars().take(200).collect::<String>());
        std::process::exit(0);
    }

    // location -> (count, shortest input)
    let mut found: BTreeMap<String, (usize, String)> = BTreeMap::new();
    let mut record = |input: &str, panic: String| {
        let key = panic.split(" | ").next().unwrap_or_default().to_string();
        let e = found.entry(key).or_insert((0, input.to_string()));
        e.0 += 1;
        if input.len() < e.1.len() {
            e.1 = input.to_string();
        }
        let _ = panic;
    };

    let mut runs = 0;
    for s in TARGETED {
        runs += 1;
        if let Some(p) = run(s) {
            println!("TARGETED PANIC: {s:?}\n    {p}");
            record(s, p);
        }
    }

    let corpus = [
        "test_scripts/comprehensive/input.ps1",
        "test_scripts/parser_focused/input.ps1",
        "test_scripts/stress/input.ps1",
        "test_scripts/enc_oneliner.ps1",
    ];
    for path in corpus {
        // local samples (e.g. enc_oneliner.ps1) are not in the repo
        let Ok(text) = std::fs::read_to_string(path) else {
            continue;
        };
        let lines: Vec<&str> = text.lines().collect();

        // every single line on its own, and every line truncated at each char boundary
        for line in &lines {
            let idxs: Vec<usize> = line.char_indices().map(|(i, _)| i).chain([line.len()]).collect();
            for &i in &idxs {
                runs += 1;
                let s = &line[..i];
                if let Some(p) = run(s) {
                    record(s, p);
                }
            }
        }

        // whole file truncated at every line boundary
        for n in 0..=lines.len() {
            runs += 1;
            let s = lines[..n].join("\n");
            if let Some(p) = run(&s) {
                record(&s, p);
            }
        }
    }

    println!("\n=== {runs} runs, {} distinct panic locations ===", found.len());
    for (loc, (count, input)) in &found {
        let short: String = input.chars().take(160).collect();
        println!("{loc}  (x{count})\n    shortest: {short:?}");
    }
}

pub fn deobfuscated_lines(&self) -> Vec<String>

pub fn deobfuscated(&self) -> String

Examples found in repository

examples/enc_oneliner.rs (line 12)

fn main() {
    let Some(path) = std::env::args().nth(1) else {
        eprintln!("usage: cargo run --example enc_oneliner -- <script.ps1>");
        std::process::exit(1);
    };
    let script = std::fs::read_to_string(path).unwrap();

    println!("=== parse_command ===");
    match PowerShellSession::new().parse_command(script.trim()) {
        Ok(res) => println!("deob:\n{}\nout:\n{}", res.deobfuscated(), res.output()),
        Err(e) => println!("error: {e:?}"),
    }

    println!("=== parse_script ===");
    match PowerShellSession::new().parse_script(script.trim()) {
        Ok(res) => println!("deob:\n{}\nout:\n{}", res.deobfuscated(), res.output()),
        Err(e) => println!("error: {e:?}"),
    }
}

pub fn tokens(&self) -> Tokens

pub fn errors(&self) -> Vec<ParserError>

pub fn output(&self) -> String

Examples found in repository

examples/enc_oneliner.rs (line 12)

fn main() {
    let Some(path) = std::env::args().nth(1) else {
        eprintln!("usage: cargo run --example enc_oneliner -- <script.ps1>");
        std::process::exit(1);
    };
    let script = std::fs::read_to_string(path).unwrap();

    println!("=== parse_command ===");
    match PowerShellSession::new().parse_command(script.trim()) {
        Ok(res) => println!("deob:\n{}\nout:\n{}", res.deobfuscated(), res.output()),
        Err(e) => println!("error: {e:?}"),
    }

    println!("=== parse_script ===");
    match PowerShellSession::new().parse_script(script.trim()) {
        Ok(res) => println!("deob:\n{}\nout:\n{}", res.deobfuscated(), res.output()),
        Err(e) => println!("error: {e:?}"),
    }
}

pub fn output_lines(&self) -> Vec<String>

pub fn script_variables(&self) -> HashMap<String, PsValue>

Trait Implementations

impl Debug for ScriptResult

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.