aboutsummaryrefslogtreecommitdiff
path: root/PETools
diff options
context:
space:
mode:
Diffstat (limited to 'PETools')
-rw-r--r--PETools/Get-DllLoadPath.ps120
-rw-r--r--PETools/Get-PEArchitecture.ps19
-rw-r--r--PETools/Get-PEHeader.ps17
3 files changed, 24 insertions, 12 deletions
diff --git a/PETools/Get-DllLoadPath.ps1 b/PETools/Get-DllLoadPath.ps1
index 360c913..97b0210 100644
--- a/PETools/Get-DllLoadPath.ps1
+++ b/PETools/Get-DllLoadPath.ps1
@@ -1,8 +1,11 @@
-function Get-DllLoadPath {
+function Get-DllLoadPath
+{
<#
.SYNOPSIS
-PowerSploit Module - Get-DllLoadPath
+Outputs the order of paths in which a dll would be loaded.
+
+PowerSploit Function: Get-DllLoadPath
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
@@ -14,7 +17,7 @@ Get-DllLoadPath returns the path from which Windows will load a Dll for the give
.PARAMETER ExecutablePath
- Path to the executable from which the Dll would be loaded.
+Path to the executable from which the Dll would be loaded.
.PARAMETER DllName
@@ -38,7 +41,7 @@ C:\Windows\SysWOW64\Comctl32.dll
.OUTPUTS
-$null, System.Management.Automation.PathInfo
+System.Management.Automation.PathInfo
.NOTES
@@ -51,8 +54,13 @@ http://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.as
#>
Param (
- [Parameter(Position = 0, Mandatory = $True)] [String] $ExecutablePath,
- [Parameter(Position = 1, Mandatory = $True)] [String] $DllName
+ [Parameter(Position = 0, Mandatory = $True)]
+ [String]
+ $ExecutablePath,
+
+ [Parameter(Position = 1, Mandatory = $True)]
+ [String]
+ $DllName
)
if (!(Test-Path $ExecutablePath)) {
diff --git a/PETools/Get-PEArchitecture.ps1 b/PETools/Get-PEArchitecture.ps1
index 6272153..efc80be 100644
--- a/PETools/Get-PEArchitecture.ps1
+++ b/PETools/Get-PEArchitecture.ps1
@@ -1,8 +1,11 @@
-function Get-PEArchitecture {
+function Get-PEArchitecture
+{
<#
.SYNOPSIS
-PowerSploit Module - Get-PEArchitecture
+Outputs the architecture for which a binary was compiled.
+
+PowerSploit Function: Get-PEArchitecture
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
@@ -19,13 +22,11 @@ Path to the executable.
.EXAMPLE
C:\PS> Get-PEArchitecture C:\Windows\SysWOW64\calc.exe
-
X86
.EXAMPLE
C:\PS> Get-PEArchitecture C:\Windows\System32\cmd.exe
-
X64
.LINK
diff --git a/PETools/Get-PEHeader.ps1 b/PETools/Get-PEHeader.ps1
index 49bfbd6..f32239c 100644
--- a/PETools/Get-PEHeader.ps1
+++ b/PETools/Get-PEHeader.ps1
@@ -1,8 +1,11 @@
-function Get-PEHeader {
+function Get-PEHeader
+{
<#
.SYNOPSIS
-PowerSploit Module - Get-PEHeader
+Parses and outputs the PE header of a process in memory or a PE file on disk.
+
+PowerSploit Function: Get-PEHeader
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None