Skip to content

Instantly share code, notes, and snippets.

@rjk11111

rjk11111/FileReadPrimitive.ps1

Forked from mattifestation/FileReadPrimitive.ps1
Created August 21, 2017 23:53
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save rjk11111/846ea56a3bee827cdd9de01eb3a8820f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save rjk11111/846ea56a3bee827cdd9de01eb3a8820f to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @mattifestation mattifestation revised this gist Aug 21, 2017. 1 changed file with 7 additions and 2 deletions.
    9 changes: 7 additions & 2 deletions FileReadPrimitive.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -4,5 +4,10 @@ $FilePath = 'C:\Windows\System32\notepad.exe'

    # PS_ModuleFile only implements GetInstance (versus EnumerateInstance) so this trick below will force a "Get" operation versus the default "Enumerate" operation.
    $PSModuleFileClass = Get-CimClass -Namespace ROOT/Microsoft/Windows/Powershellv3 -ClassName PS_ModuleFile -CimSession $CimSession
    $InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly -CimSession $CimSession
    Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession
    $InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly
    $FileContents = Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession
    $FileLengthBytes = $FileContents.FileData[0..3]
    [Array]::Reverse($FileLengthBytes)

    $FileLength = [BitConverter]::ToUInt32($FileLengthBytes, 0)
    $FileBytes = $FileContents.FileData[4..($FileLength - 1)]
  2. @mattifestation mattifestation created this gist Aug 21, 2017.
    8 changes: 8 additions & 0 deletions FileReadPrimitive.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,8 @@
    $CimSession = New-CimSession -ComputerName 10.0.0.2

    $FilePath = 'C:\Windows\System32\notepad.exe'

    # PS_ModuleFile only implements GetInstance (versus EnumerateInstance) so this trick below will force a "Get" operation versus the default "Enumerate" operation.
    $PSModuleFileClass = Get-CimClass -Namespace ROOT/Microsoft/Windows/Powershellv3 -ClassName PS_ModuleFile -CimSession $CimSession
    $InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly -CimSession $CimSession
    Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession