Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <# use certutil to get the signing time of a (driver) file since Microsoft's drivers deliberately have old dates https://devblogs.microsoft.com/oldnewthing/20170208-00/?p=95395
- 0092: | 18 12 ; GENERALIZED_TIME (12 Bytes)
- 0094: | | 32 30 32 34 31 31 30 32 30 33 32 30 30 32 2e 38 ; 20241102032002.8
- 00a4: | | 36 5a ; 6Z
- | | ; 02/11/2024 03:20
- #>
- [string[]]$formats = @( 'yyyyMMddHHmmss.fff\Z' , 'yyyyMMddHHmmss.ff\Z' ,'yyyyMMddHHmmss.f\Z' , 'yyyyMMddHHmmss\Z' )
- ls C:\Windows\System32\drivers\*.sys -file -PipelineVariable file |% { certutil -dump $file.FullName | sls '^[0-9a-f]{4}:.+\; GENERALIZED_TIME \(([0-9a-f]{2}) Bytes\)' -Context 0,2|select @{n='File';e={$file.Name}},@{n='Signed';e={$timestamp = ($_.Context.PostContext -replace '^[0-9a-f]{4}:.+.*;\s*(.+)$', '$1') -join ''; [datetime]::ParseExact( $timestamp , $formats , $null , 'None' ) }} }
Advertisement
Add Comment
Please, Sign In to add comment