告别 DNS 缓存坑：Windows WireGuard 动态解析升级版（直查 DNS）

# Copyright (C) 2021 Max Schulze. All Rights Reserved.
# Modified by Kenvix <i@kenvix.com> @ 2023/9/15
# Modified by CorneliaMo <SweetCorneliaMo@163.com> @ 2026/3/9
# 
# near-literal Translation of the linux version by Jason A. Donenfeld
# to decrypt the dpapi Credentials, you have to be the same user as the wireguard tunnel service, i.e. "nt authority\system", check with "whoami"
# this script might be called by task scheduler as 
#  powershell -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -Command ./WireGuard-Reresolve.ps1 -LoopRunAsCron -DelaySeconds 600
# if you want to try it in cmd, remember to elevate the user, i.e. with psexec from sysutils 
#  psexec -s -i powershell -NoPr...
#Requires -RunAsAdministrator
param(
  [switch]$LoopRunAsCron = $false,
  [int]$DelaySeconds = 600,
  # Optional: specify DNS server address for Resolve-DnsName. If not set, use system default DNS.
  [string]$DnsServer = $null,
  # Optional: prefer AAAA record first (IPv6). Default is prefer A first (IPv4).
  [switch]$PreferAAAA = $false
)
Set-StrictMode -Version 3
Add-Type -AssemblyName System.Security
function WireGuard-Reresolve {
  param(
    [Parameter(Mandatory = $true)]
    [string]$File
  )
  Set-Variable CONFIG_FILE -Value $File.ToString().Trim('"')
  Write-Host "Loading $CONFIG_FILE"
  if (-not (Test-Path -Path $CONFIG_FILE)) {
    throw New-Object System.IO.FileNotFoundException("Wireguard Config $CONFIG_FILE File not found.", $CONFIG_FILE)
  }
  $byteCrypted = ((Get-Content -LiteralPath $CONFIG_FILE -Encoding Byte -ReadCount 0))
  $config = [System.Security.Cryptography.ProtectedData]::Unprotect($byteCrypted, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
  $config = [System.Text.UTF8Encoding]::UTF8.GetString($config)
  Set-Variable Interface -Option Constant -Value $(if ($CONFIG_FILE -match '.?([a-zA-Z0-9_=+.-]{1,64})\.conf.dpapi$') { $matches[1] } else { $null })
  function resolve_endpoint_ip () {
    param(
      [Parameter(Mandatory = $true)][string]$Endpoint
    )
    # Endpoint format examples:
    #   example.com:51820
    #   1.2.3.4:51820
    #   [2001:db8::1]:51820
    Write-Host "Resolving $Endpoint"
    $hostAddress = $null
    $port = $null
    if ($Endpoint -match '^\[([^\]]+)\]:(\d+)$') {
      # IPv6 literal
      return $Endpoint
    }
    elseif ($Endpoint -match '^([^:]+):(\d+)$') {
      $hostAddress = $matches[1]
      $port = $matches[2]
    }
    else {
      return $Endpoint
    }

    # If hostAddress is already an IP literal, keep as-is.
    if ($hostAddress -match '^\d{1,3}(\.\d{1,3}){3}$' -or $hostAddress -match '^[0-9a-fA-F:]+$') {
      return $Endpoint
    }

    # Build Resolve-DnsName base parameters, add -Server only if user specified -DnsServer
    $dnsArgsBase = @{
      Name        = $hostAddress
      DnsOnly     = $true
      ErrorAction = 'Stop'
      NoHostsFile = $true
    }
    if ($DnsServer -and $DnsServer.Trim().Length -gt 0) {
      $dnsArgsBase.Server = $DnsServer.Trim()
    }

    # Resolve domain to IP. Default: prefer A (IPv4). If -PreferAAAA is set: prefer AAAA (IPv6).
    $types = if ($PreferAAAA) { @('AAAA', 'A') } else { @('A', 'AAAA') }

    foreach ($t in $types) {
      try {
        $ans = Resolve-DnsName @dnsArgsBase -Type $t
        $ip = $ans |
          Where-Object { $_.Section -eq 'Answer' -and $_.PSObject.Properties.Match('IPAddress').Count -gt 0 } |
          Select-Object -First 1 -ExpandProperty IPAddress

        if ($ip) {
          if ($t -eq 'AAAA') {
            Write-Host "Successfully resolve $Endpoint to [$ip]:$port"
            return "[$ip]:$port"
          } else {
            Write-Host "Successfully resolve $Endpoint to $ip`:$port"
            return "$ip`:$port"
          }
        }
      } catch { }
    }

    return $Endpoint
  }
  function process_peer () {
    if (-not $PEER_SECTION -or ($PUBLIC_KEY -eq $null) -or ($ENDPOINT -eq $null)) { return }
    if (-not ((& wg show "$INTERFACE" latest-handshakes) -replace $PUBLIC_KEY -match ('[0-9]+'))) { return }
    if (((Get-Date) - (New-Object -Type DateTime -ArgumentList 1970, 1, 1, 0, 0, 0, 0).AddSeconds($matches[0]).ToLocalTime()).TotalSeconds -le 135) { return }
    $ENDPOINT_RESOLVED = resolve_endpoint_ip "$ENDPOINT"
    (& wg set "$INTERFACE" peer "$PUBLIC_KEY" endpoint "$ENDPOINT_RESOLVED")
    reset_peer_section
  }
  function reset_peer_section () {
    Set-Variable PEER_SECTION -Value $null
    Set-Variable PUBLIC_KEY -Value $null
    Set-Variable ENDPOINT -Value $null
  }
  reset_peer_section
  Set-Variable PEER_SECTION -Value $null
  foreach ($line in $config.Split([Environment]::NewLine, [StringSplitOptions]::RemoveEmptyEntries)) {
    if ($line.Trim().length -gt 0) {
      $stripped = $line.Trim() -ireplace '\#.*'
      $key = $stripped -ireplace '=.*'; $key = $key.Trim()
      $val = $stripped -ireplace '^.*?='; $val = $val.Trim()
      if ($key -match '\[.*') { process_peer; reset_peer_section; }
      if ($key -eq '[Peer]') { $PEER_SECTION = $true }
      if ($PEER_SECTION) {
        switch ($key) {
          "PublicKey" { $PUBLIC_KEY = $val; continue; }
          "Endpoint" { $ENDPOINT = $val; continue; }
        }
      }
    }
  }
  process_peer
}
function WireGuard-Reresolve-All-Active {
  Get-Service -Name "WireGuardTunnel$*" `
  | Where-Object { $_.Status -eq "Running" } `
  | ForEach-Object { $_.Name.Substring(16) } `
  | ForEach-Object { Get-ChildItem -File "$env:programfiles\wireguard\data\configurations\$_.conf.dpapi" } `
  | ForEach-Object { WireGuard-Reresolve $_.FullName }
}
if ($LoopRunAsCron) {
  Write-Output "Running as Cron DelaySeconds=$DelaySeconds"
  while ($true) {
    WireGuard-Reresolve-All-Active
    Start-Sleep -Seconds $DelaySeconds
  }
} else {
  WireGuard-Reresolve-All-Active
}