Advertisement
Guest User

Untitled

a guest
Aug 21st, 2017
84
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.81 KB | None | 0 0
  1. $CimSession = New-CimSession -ComputerName 10.0.0.2
  2.  
  3. $FilePath = 'C:\Windows\System32\notepad.exe'
  4.  
  5. # PS_ModuleFile only implements GetInstance (versus EnumerateInstance) so this trick below will force a "Get" operation versus the default "Enumerate" operation.
  6. $PSModuleFileClass = Get-CimClass -Namespace ROOT/Microsoft/Windows/Powershellv3 -ClassName PS_ModuleFile -CimSession $CimSession
  7. $InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly
  8. $FileContents = Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession
  9. $FileLengthBytes = $FileContents.FileData[0..3]
  10. [Array]::Reverse($FileLengthBytes)
  11.  
  12. $FileLength = [BitConverter]::ToUInt32($FileLengthBytes, 0)
  13. $FileBytes = $FileContents.FileData[4..($FileLength - 1)]
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement