Skip to content

README.md

Latest commit

 

History

History
29 lines (22 loc) · 1.56 KB

README.md

File metadata and controls

29 lines (22 loc) · 1.56 KB

Mario-Head BSOD Experiment

About This Repository

This repository contains an experiment where a simple Mario-head BSOD executable is triggered via a Ducky Script. The focus here is on making the execution flow as obscure as possible without going completely overboard with obfuscation.

Repository Contents

  • nicecomputer.ps1 – A PowerShell script that downloads, decrypts, and executes the BSOD trigger.
  • mario_dist.exe – The compiled executable responsible for the actual BSOD.
  • nicecomputer.txt – The Ducky Script used to deliver and execute the payload.

How It Works

  1. The Ducky Script executes the PowerShell payload.
  2. The PowerShell script:
    • Uses base64 encoding, character shifting, and XOR to obfuscate the download URL.
    • Fetches the mario_dist.exe from an obscure URL.
    • Executes the file and deletes it after execution.
  3. The executable triggers a BSOD with a Mario-head twist.

Why This Approach?

  • Obfuscation without insanity – The PowerShell script is structured to be difficult to read at a glance but not impossible to reverse-engineer.
  • Minimal dependencies – Uses built-in Windows utilities to execute the payload.
  • Experimentation – This is a test of how well obfuscation techniques can hide intent while maintaining functionality.

Future Plans

Eventually, I will document why I chose specific obfuscation techniques, potential improvements, and how this experiment could evolve.

Disclaimer

This project is for educational and research purposes only. Do not use it for malicious activities.