TypeConfuseDelegatePowerShell
gadget
Requires Microsoft.PowerShell.Commands.Utility, Version=3.0.0.0 on the target and the application setting microsoft:WorkflowComponentModel:DisableActivitySurrogateSelectorTypeCheck=true. That setting is mandatory on current serviced .NET Framework and cannot be armed by another object in the same graph before Workflow resolves the comparer. The measured target is .NET Framework 4.8.1; older Framework versions are not claimed. The graph needs two distinct command fields, so a one-part --rawcmd value is refused. Local --test runs only when Workflow's effective setting is already true in this process.
Declared metadata, not a runtime result. How to read evidence.
.\ysonet.exe -g TypeConfuseDelegatePowerShell -hTarget declarations
| Variant | Formatters | Inputs | Requirements | Runtime tokens |
|---|---|---|---|---|
| Default | BinaryFormatter, LosFormatter | command | extra-assembly, net-framework | net-fx-4.8.1 |
No module-specific options declared.
Credit: [Finders: James Forshaw, Soroush Dalili] [Contributors: Soroush Dalili]