admin/PowerShellMafia-PowerSploit
1
0
Fork 0
mirror of https://github.com/PowerShellMafia/PowerSploit synced 2026-06-08 12:13:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added ProcessModuleTrace cmdlets

Browse Source 
Added *-ProcessModuleTrace cmdlets to trace details when modules are
loaded into a process. These can be useful for malware analysis.
This commit is contained in:
mattifestation
2013-08-29 19:56:01 +00:00
parent fcdd3ad642
commit 6807da424f
4 changed files with 153 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ReverseEngineering/ProcessModuleTrace.format.ps1xml
+36
View File
@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="utf-8" ?>
<Configuration>
<ViewDefinitions>
<View>
<Name>ProcessModuleTraceView</Name>
<ViewSelectedBy>
<TypeName>LOADED_MODULE</TypeName>
</ViewSelectedBy>
<ListControl>
<ListEntries>
<ListEntry>
<ListItems>
<ListItem>
<PropertyName>TimeCreated</PropertyName>
</ListItem>
<ListItem>
<PropertyName>ProcessId</PropertyName>
</ListItem>
<ListItem>
<PropertyName>FileName</PropertyName>
</ListItem>
<ListItem>
<Label>ImageBase</Label>
<ScriptBlock>"0x$($_.ImageBase.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
</ListItem>
<ListItem>
<PropertyName>ImageSize</PropertyName>
<FormatString>0x{0:X8}</FormatString>
</ListItem>
</ListItems>
</ListEntry>
</ListEntries>
</ListControl>
</View>
</ViewDefinitions>
</Configuration>