ps1

Getting significant bytes

If you need to split a decimal into bytes, you can use  a function called ConvertTo-HighLow, which uses a clever combination of type casts to...

read more

Splitting hex dumps

Imagine you have a text string with a hex dump so that each hex number consists of two characters. How would you split this into individual hex...

read more

Finding new processes

Get-Process will return a list of all processes. If you just want to see those started within the last 10 minutes, you can check StartTime. Both...

read more

Load registry user hive

If you need to manipulate registry data from another user, you may be out of luck because HKEY_CURRENT_USER always points to your own user data....

read more

Dump enumerations

You can create a simple helper function called Get-Enum  to list all the values in an enumeration: function Get-Enum($name){...

read more

Find Latest Processes

You should try this piece of code to find all processes that were started within the past 10 minutes: Get-Process | Where-Object { try {...

read more

Use Multiple Wildcards

Did you know that you can use multiple wildcards in paths? This will give you a lot of control. Check this out: This line will find all DLL-files in...

read more

Finding Software Updates

In Windows Vista/Server 2008, Microsoft introduced many new service and application specific log files. PowerShell can access those with...

read more