Replace the ps2exe wrapper with a native launcher (v1.123.0) - #108
Merged
Conversation
RackStack.exe is now a small C# host that starts Windows PowerShell's own console host and runs the monolithic script from an embedded plain-text resource. It is compiled in CI with the csc.exe that ships inside Windows, so nothing is downloaded or installed to produce the shipped binary. Every release through v1.122.4 was produced by ps2exe. Its script-host wrapper is widely reused by malware droppers, so heuristic engines scored each build as a packed script host regardless of content: a hash Microsoft had cleared was re-flagged within weeks, and the same file drifted from 8 to 19 VirusTotal detections without changing a byte. Also: - The self-destruct cleanup task runs a readable script file from a SYSTEM/Administrators-only directory (owner verified before the task is registered) instead of a base64 -EncodedCommand. - Elevation from the EXE relaunches the executable itself; the old path passed an empty script path to powershell.exe when $PSCommandPath was unset. - Run-Tests Section 209 now pins the launcher build: no ps2exe, in-box compiler by fixed path, nothing downloaded during compile, UAC manifest present, version resource populated and matching RackStack.psd1. Mutation-verified (ps2exe reintroduced, manifest downgraded, company drifted) - each fails exactly the intended assertion. - Docs and comments updated; 5511/5511 structural tests, PSSA 0 errors.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
RackStack.exeis now a small C# launcher (dist/launcher/) that starts Windows PowerShell's own console host and runs the monolithic script from an embedded plain-text resource. CI compiles it with thecsc.exethat ships inside Windows; nothing is downloaded or installed to produce the binary.Why
Every release through v1.122.4 was built with ps2exe. Its script-host wrapper is widely reused by malware droppers, so heuristic engines scored each build as a packed script host regardless of what the script did. A hash Microsoft had cleared on 2026-08-12 was re-flagged by the winget validation pipeline on 2026-09-08, and the same file drifted from 8 to 19 VirusTotal detections without changing a byte. Per-hash disputes were a treadmill.
Also in this change
-EncodedCommand.powershell.exewhen$PSCommandPathwas unset.RackStack.psd1. Mutation-verified three ways.Verification
TheAbider / RackStack / 1.123.0.0,requireAdministratormanifest present, embedded resource byte-identical to the monolithic, Defender (1.459.111.0, cloud on) clean.$PSCommandPathis empty inside the script exactly as it was under ps2exe.