Implements five new operations under the 'Code tidy' category to
deobfuscate common PowerShell obfuscation techniques:
- PowerShell Format String Deobfuscate: resolves (-f) format operator
expressions such as ("{0}{2}{1}" -f 'new-ob','t','jec') -> new-object
- PowerShell Decode EncodedCommand: decodes -enc / -e / -ec Base64
UTF-16LE payloads, accepting raw tokens or full command lines
- PowerShell Backtick Remove: strips obfuscating backticks with an opt-in
'Preserve escape sequences' mode for legitimate PS escapes
- PowerShell Concatenation Join: iteratively joins 'frag'+'ment' string
literals, handling mixed quote types and arbitrary chain lengths
- PowerShell Char Decode: decodes [char]N and [char[]](N,N,...) casts
supporting both decimal and 0x hex values
Each operation includes auto-detection checks for the Magic operation,
comprehensive unit tests, and OSINT-validated test cases sourced from
Emotet, AMSI bypass, and Invoke-Obfuscation real-world samples.
19dd80b10e