powershell 中的字符串混淆

例子1

(VarIaBLE '*MDr*').naMe[3,11,2]-JoiN''

執行結果是 iex

解析：

PS > VarIaBLE '*MDr*'             #執行命令 variable '*MDr'

Name                           Value                                                                                                             
----                           -----                                                                                                             
MaximumDriveCount              4096     
 
PS >$var=(VarIaBLE '*MDr*')      #$var 是上述命令的結果

PS >$var |Get-Member             #獲取成員函數
 TypeName: System.Management.Automation.SessionStateCapacityVariable

Name         MemberType Definition                                                                    
----         ---------- ----------                                                                    
Equals       Method     bool Equals(System.Object obj)                                                
GetHashCode  Method     int GetHashCode()                                                             
GetType      Method     type GetType()                                                                
IsValidValue Method     bool IsValidValue(System.Object value)                                        
ToString     Method     string ToString()                                                             
Attributes   Property   System.Collections.ObjectModel.Collection[System.Attribute] Attributes {get;} 
Description  Property   string Description {get;set;}                                                 
Module       Property   psmoduleinfo Module {get;}                                                    
ModuleName   Property   string ModuleName {get;}                                                      
Name         Property   string Name {get;}        //name 是其中的一個屬性                                                    
Options      Property   System.Management.Automation.ScopedItemOptions Options {get;set;}             
Value        Property   System.Object Value {get;set;}                                                
Visibility   Property   System.Management.Automation.SessionStateEntryVisibility Visibility {get;set;}

PS >$var.Name
MaximumDriveCount
> $var.Name[3,11,2]
i
e
x

參考：https://ss64.com/ps/syntax-operators.html

While a simple ( ) grouping expression means 'execute this part first', a subexpression $( ) means 'execute this first and then treat the result like a variable'.

一個簡單的（）分組表達式表示“首先執行此部分”，而子表達式$（）表示“首先執行此部分，然後將結果視爲變量”。