{"id":35,"date":"2013-04-21T17:20:00","date_gmt":"2013-04-21T13:20:00","guid":{"rendered":"http:\/\/use-powershell.com\/?p=35"},"modified":"2013-09-18T15:08:26","modified_gmt":"2013-09-18T11:08:26","slug":"obfuscate-email-addresses-with-powershell","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/powershell\/obfuscate-email-addresses-with-powershell\/","title":{"rendered":"Obfuscate email addresses with PowerShell"},"content":{"rendered":"

Came across the following piece of code in someone’s<\/a> signature today.<\/p>\n

\r\n[string](0..33|%{[char][int](46+(\"686552495351636652556262185355647068516270555358646562655775 0645570\").substring(($_*2),2))})-replace \" \"\r\n<\/pre>\n
It’s a geeky way of obfuscating your email address. If you copy paste that bit of code into a PowerShell window and press ENTER<\/code>, you get an email address.<\/p>\n
I’d like to make something similar. Especially since it just coincides with what I was playing around with today morning<\/a>. But before that I’d also like to understand what’s going on above. So let’s break this one-liner and peek behind the curtain. <\/p>\n
Understanding<\/h2>\n
First things first: if I remove the [string]<\/code> type cast and run the code I get a bunch of characters – one on each line. So what the type cast does is convert these characters to a one-liner string.<\/p>\n
Next, I piped the email address that was output to the Measure-Object<\/code> cmdlet with the -Character<\/code> switch. That gave me the number of characters in the address: 34. This coincides with the next bit of the code – 0..33<\/code> – which is shorthand for generating the numbers 0 to 33 (34 numbers). So looks like that bit is responsible for driving something to generate each character of the address.<\/p>\n
Great. What’s happening next?<\/p>\n
The code generates 34 numbers. For each of these numbers it does something.<\/p>\n
\r\n46+(\"686552495351636652556262185355647068516270555358646562655775 0645570\").substring(($_*2),2)\r\n<\/pre>\n
First a sub-string is extracted from that long series of numbers. This long series of numbers is stored as a string (hence the double-quotes). From this a sub-string of 2 characters is extracted. The starting point of extraction jumps forward by 2 each time (position 0, then 2, then 4, 6, 10, and so on up to 66) – breaking the long string into a series of 2 digit numbers.<\/p>\n
Here’s the relevant code:<\/p>\n
\r\n0..33 | %{ \"686552495351636652556262185355647068516270555358646562655775 0645570\".SubString($_*2,2) }\r\n<\/pre>\n
This generates numbers 68,65,52, … 70.<\/p>\n
To each of these the code adds the number 46. So the numbers actually output are 114,111,98, … 116. Each of these is then converted to a character – which is what the [char][int]<\/code> bit does. And the rest we already know – these characters are converted to one long string showing the email address. (There’s one gotcha though, in that the string has the characters separated by a space. Which is why we have a -replace \" \"<\/code> tacked on the end – this simply replaces are spaces with nothing, combining all the characters into one word). <\/p>\n
Genius! (At least for a PowerShell child like me).<\/p>\n
Creating<\/h2>\n
Okay. So how do I create something similar? <\/p>\n
First things first: if I were to just convert an email address to ASCII\/ UTF-8 codes what do I get?<\/p>\n
\r\nPS C:\\> [int[]][char[]]\"abc@example.com\"\r\n97\r\n98\r\n99\r\n64\r\n101\r\n120\r\n97\r\n109\r\n112\r\n108\r\n101\r\n46\r\n99\r\n111\r\n109\r\n<\/pre>\n
I could join these numbers, with dots perhaps, to form a long string. <\/p>\n
\r\nPS C:\\> [int[]][char[]]\"abc@example.com\" -join \".\"\r\n97.98.99.64.101.120.97.109.112.108.101.46.99.111.109\r\n<\/pre>\n
If I wanted to get my address from such a string I’d do something like this: <\/p>\n
\r\nPS C:\\> \"97.98.99.64.101.120.97.109.112.108.101.46.99.111.109\".Split(\".\")\r\n97\r\n98\r\n99\r\n64\r\n101\r\n120\r\n97\r\n109\r\n112\r\n108\r\n101\r\n46\r\n99\r\n111\r\n109\r\n<\/pre>\n
That outputs the numbers, I can just convert them back to an address. <\/p>\n
\r\nPS C:\\> [char[]][int[]](\"97.98.99.64.101.120.97.109.112.108.101.46.99.111.109\".Split(\".\"))\r\na\r\nb\r\nc\r\n@\r\ne\r\nx\r\na\r\nm\r\np\r\nl\r\ne\r\n.\r\nc\r\no\r\nm\r\n\r\nPS C:\\> [string][char[]][int[]](\"97.98.99.64.101.120.97.109.112.108.101.46.99.111.109\".Split(\".\"))\r\na b c @ e x a m p l e . c o m\r\n\r\nPS C:\\> [string][char[]][int[]](\"97.98.99.64.101.120.97.109.112.108.101.46.99.111.109\".Split(\".\")) -replace \" \"\r\nabc@example.com\r\n<\/pre>\n
Great. So that’s something I could paste in a signature somewhere and anyone running that code will get an email address. <\/p>\n
I got side tracked though. What would I do to get something similar to the code the user created? Backtracking:<\/p>\n
\r\nPS C:\\> [int[]][char[]]\"abc@example.com\" -join \" \"\r\n97 98 99 64 101 120 97 109 112 108 101 46 99 111 109\r\n<\/pre>\n
I have a series of numbers. They are of varying length so I can’t just club them together and hope to extract. I need to get them all to a uniform length, so an easy idea would be to just subtract them all by some number to make them 2 digits each. The number has to be larger than 46 – as that’s the smallest number – so why not just use 46 as the number to subtract from all? <\/p>\n
\r\nPS C:\\> [int[]][char[]]\"abc@example.com\" | %{ $_ - 46 }\r\n51\r\n52\r\n53\r\n18\r\n55\r\n74\r\n51\r\n63\r\n66\r\n62\r\n55\r\n0\r\n53\r\n65\r\n63\r\n\r\nPS C:\\> ([int[]][char[]]\"abc@example.com\" | %{ $_ - 46 }) -join \"\"\r\n51525318557451636662550536563\r\n<\/pre>\n
So now all I need to do to reverse the process is (a) split the long number into chunks of two, (b) add 46 to each, (c) convert to a char, and (d) convert the array of characters into a string. <\/p>\n
\r\nPS C:\\> [string](0..14|%{[char][int](46+(\"51525318557451636662550536563\").substring(($_*2),2))})-replace \" \"\r\nException calling \"Substring\" with \"2\" argument(s): \"Index and length must refer to a location within the string.\r\nParameter name: length\"\r\nAt line:1 char:18\r\n+ [string](0..14|%{[char][int](46+(\"51525318557451636662550536563\").substring(($_* ...\r\n+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException\r\n    + FullyQualifiedErrorId : ArgumentOutOfRangeException\r\n\r\nabc@example3Rf\r\n<\/pre>\n
It worked! Sort of. Something messed up though. And the email address is mostly generated but for the last 4 characters. It looks like the string is falling short for the Substring<\/code> method. <\/p>\n
A few minutes of head scratching later, I realize the problem. When I converted all the numbers to two digits, one of them was one digit – the number 46 that got subtracted by itself. This was resulting in a string that fell short. Not to worry, all I had to do was pad a 0 to that number and then it will work. <\/p>\n
\r\nPS C:\\> [string](0..14|%{[char][int](46+(\"515253185574516366625500536563\").substring(($_*2),2))})-replace \" \"\r\nabc@example.com\r\n<\/pre>\n
Automating<\/h2>\n
Can I automate this process? One where any string I give is converted to code that will generate the string when run. <\/p>\n
A proper generic code would take a bit more effort and time, but since I am mainly concerned with email addresses I can take some short cuts. If I were going to build a generic code I’d (1) need a way to find the smallest ASCII\/ UTF-8 code in the set entered, (2) while subtracting that number from every number I’d have to ensure any single digit number is accordingly padded, and (3) I’d also have to be concerned with any text that may have an ASCII\/ UTF-8 code which won’t reduce to two digits when I do the subtraction above. <\/p>\n
First thing to notice is that the number that we are subtracting – in my example above, as well as the code I started off with – is 46. Which turns out to be the dot in the email address. Next thing to notice is that letters A-Z and a-z have codes 65-90 and 97-122. Similarly the numbers 0-9 have codes 48-57. So by limiting myself to this set of characters I can be sure that the lowest number will always be 46, and that I can subtract it from any of the expected characters and expect a single or double digit result.<\/p>\n
But why not got a teeny weeny step further. Checking WikiPedia for the syntax of valid email address<\/a> I see that the lowest ASCII\/ UTF-8 code for an allowed character is 32 (the character being “) and the highest allowed ASCII\/ UTF-8 code for an allowed character is 126 (the character being ~). So the code I generate will be similar to the code I started this post with, except that I’ll be adding 32 instead of 46. And so the code I create to generate this code will output 32. <\/p>\n
So without much ado here’s the code:<\/p>\n
\r\n\"abc@example.com\" | \"[string](0..$($_.Length-1)|%{[char][int](32+(`\"\" + -join ([int[]][char[]]$_ | %{ if ($_-32 -lt 9 ) { \"0$($_-32)\" } else { $_-32 } }) + \"`\").substring((`$_*2),2))})\" + '-replace \" \"'\r\n<\/pre>\n
Of course, replace “abc@example.com” with the email address you’d like to obfuscate. <\/p>\n
For the curious, here’s an explanation of my code (the bit after the first pipeline). <\/p>\n
\r\n\"[string](0..$($_.Length-1)|%{[char][int](32+(`\"\" + `\r\n-join ([int[]][char[]]$_ | %{ if ($_-32 -lt 9 ) { \"0$($_-32)\" } else { $_-32 } }) + `\r\n\"`\").substring((`$_*2),2))})\" + '-replace \" \"'\r\n<\/pre>\n
Line 1 outputs the part of the final code that starts with a [string]<\/code> and ends at the beginning of the series of digits (just before the left bracket). <\/p>\n
Line 3 outputs the part of the final code that starts where the digits end (just after the right bracket) and goes all the way up to -replace \" \"<\/code>.<\/p>\n
These two lines are pretty straight-forward. Only point to note is I escape the $<\/code> symbols with a backtick (`<\/code>) so they don’t get interpreted as variables. And I get the length of the input text via $_.Length<\/code> (this is why I put the whole block within a ForEach-Object<\/code> loop as that’s the only way to make $_<\/code> variable available). Also, I put the expression as $($_.Length-1)<\/code> because if I don’t do that PowerShell expands $_<\/code> into a string and then tacks “.Length-1” to it as another string. <\/p>\n
Line 2 is a variant of what I created earlier. It converts the input string into an array of characters, cast into an array of integers, and pipes these into another ForEach-Object<\/code> loop that subtracts the number 32 from each and if the result is less than 9 (i.e. single digit) pads a “0” before outputting the number. <\/p>\n
And that’s it!<\/p>\n
\r\n# Generate the code\r\nPS C:\\> \"abc@example.com\" | %{\r\n>>     \"[string](0..$($_.Length-1)|%{[char][int](32+(`\"\" + -join ([int[]][char[]]$_ | %{ if ($_-32 -lt 9 ) { \"0$($_-32)\"\r\n } else { $_-32 } }) + \"`\").substring((`$_*2),2))})\" + '-replace \" \"'\r\n>>  }\r\n>>\r\n[string](0..14|%{[char][int](32+(\"656667326988657780766914677977\").substring(($_*2),2))})-replace \" \"\r\n\r\n# And test it\r\nPS C:\\> [string](0..14|%{[char][int](32+(\"656667326988657780766914677977\").substring(($_*2),2))})-replace \" \"\r\nabc@example.com\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
Came across the following piece of code in someone’s signature today. [string](0..33|%{[char][int](46+(“686552495351636652556262185355647068516270555358646562655775 0645570″).substring(($_*2),2))})-replace ” ” It’s a geeky way of obfuscating your email address. If you copy paste that bit of code into a PowerShell window and press ENTER, you get an email address. I’d like to make something similar. Especially since it just coincides … Continue reading Obfuscate email addresses with PowerShell<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[2],"tags":[6,7,28,36],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/35"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=35"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/35\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=35"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=35"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=35"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}