Functions/Get-BinaryType.ps1
|
function Get-BinaryType { <# .SYNOPSIS Gets the binary executable type for a given set of files .DESCRIPTION PowerShell wrapper around the GetBinaryType Windows API that inspects file headers and reports the binary file type (e.g., 32-bit Windows app, 64-bit Windows app, 16-bit DOS/Windows app, etc.) .PARAMETER Path File path(s) to inspect .EXAMPLE #Reports the file type of C:\Windows\Explorer.exe: Get-BinaryType C:\Windows\Explorer.exe .EXAMPLE #Attempts to get the binary type of all files in the current directory Get-ChildItem | where { !$_.PsIsContainer } | Get-BinaryType .EXAMPLE #Attempts to get the binary type of all exe files in the windows directory, #ignoring any non-terminating errors Get-ChildItem $env:windir -filter *.exe | Get-BinaryType -ErrorAction SilentlyContinue .EXAMPLE #From a 32bit process on a 64 bit Windows install, attempts to get the binary type of all exe files #in the windows system32 directory by bypassing filesystem redirection using "sysnative", #ignoring any non-terminating errors, and finally showing the file name and binary type Get-ChildItem $env:windir\sysnative -filter *.exe | Get-BinaryType -ErrorAction SilentlyContinue -passthrough | select Name,BinaryType .NOTES Author: Battleship, Aaron Margosis Inspiration: http://pinvoke.net/default.aspx/kernel32/GetBinaryType.html .LINK http://wonkysoftware.appspot.com #> [CmdletBinding(ConfirmImpact = 'none')] param ( [Parameter(HelpMessage = 'Enter binary file(s) to examine',Position = 0, Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName )] [ValidateNotNullOrEmpty()] [ValidateScript({Test-Path -Path ((get-item -path $_).FullName)})] [string[]] $Path, [Alias('PassThru')] [switch] $PassThrough ) begin { Write-Verbose -Message "Starting [$($MyInvocation.Mycommand)]" $paths = Resolve-Path -Path $path | Select-Object -ExpandProperty Path try { #add the enum for the binary types #Using more user friendly names since they won't likely be used outside this context $enumString = @' public enum BinaryType { BIT32 = 0, // A 32-bit Windows-based application, SCS_32BIT_BINARY DOS = 1, // An MS-DOS - based application, SCS_DOS_BINARY WOW = 2, // A 16-bit Windows-based application, SCS_WOW_BINARY PIF = 3, // A PIF file that executes an MS-DOS based application, SCS_PIF_BINARY POSIX = 4, // A POSIX based application, SCS_POSIX_BINARY OS216 = 5, // A 16-bit OS/2-based application, SCS_OS216_BINARY BIT64 = 6 // A 64-bit Windows-based application, SCS_64BIT_BINARY } '@ Add-Type -TypeDefinition $enumString } catch { Write-Verbose -message 'Info' } #type already been loaded, do nothing try { # create the win32 signature $Signature = @' [DllImport("kernel32.dll")] public static extern bool GetBinaryType( string lpApplicationName, ref int lpBinaryType ); '@ # Create a new type that lets us access the Windows API function Add-Type -MemberDefinition $Signature -Name BinaryType -Namespace PFWin32Utils } catch { Write-Verbose -Message 'Info' } #type already been loaded, do nothing } process { foreach ($Item in $Paths) { $ReturnedType = -1 Write-Verbose -Message "Attempting to get type for file: $($Item.FullName)" $Result = [PFWin32Utils.BinaryType]::GetBinaryType($Item, [ref] $ReturnedType) #if the function returned $false, indicating an error, or the binary type wasn't returned if (!$Result -or ($ReturnedType -eq -1)) { Write-Error -Message "Failed to get binary type for file $($Item.FullName)" } else { $ToReturn = [BinaryType] $ReturnedType if ($PassThrough) { #get the file object, attach a property indicating the type, and passthru to pipeline Get-Item -Path $Item.FullName -Force | Add-Member -MemberType noteproperty -Name BinaryType -Value $ToReturn -Force -PassThru } else { #Put enum object directly into pipeline $ToReturn } } } } end { Write-Verbose -Message "Ending [$($MyInvocation.Mycommand)]" } } |