diff options
Diffstat (limited to 'RE_Tools/Get-KernelModuleInfo.format.ps1xml')
| -rw-r--r-- | RE_Tools/Get-KernelModuleInfo.format.ps1xml | 83 |
1 files changed, 83 insertions, 0 deletions
diff --git a/RE_Tools/Get-KernelModuleInfo.format.ps1xml b/RE_Tools/Get-KernelModuleInfo.format.ps1xml new file mode 100644 index 0000000..3e3f347 --- /dev/null +++ b/RE_Tools/Get-KernelModuleInfo.format.ps1xml @@ -0,0 +1,83 @@ +<?xml version="1.0" encoding="utf-8" ?>
+<Configuration>
+ <DefaultSettings>
+ <EnumerableExpansions>
+ <EnumerableExpansion>
+ <Expand>Both</Expand>
+ </EnumerableExpansion>
+ </EnumerableExpansions>
+ </DefaultSettings>
+ <ViewDefinitions>
+ <View>
+ <Name>SystemModuleView</Name>
+ <ViewSelectedBy>
+ <TypeName>SystemInformation.SYSTEM_MODULE</TypeName>
+ </ViewSelectedBy>
+ <TableControl>
+ <AutoSize/>
+ <TableHeaders>
+ <TableColumnHeader>
+ <Label>ImageBaseAddress</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>ImageSize</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>Flags</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>Id</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>Rank</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>W018</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>NameOffset</Label>
+ </TableColumnHeader>
+ <TableColumnHeader>
+ <Label>Name</Label>
+ </TableColumnHeader>
+ </TableHeaders>
+ <TableRowEntries>
+ <TableRowEntry>
+ <TableColumnItems>
+ <TableColumnItem>
+ <ScriptBlock>"0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>ImageSize</PropertyName>
+ <FormatString>0x{0:X8}</FormatString>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>Flags</PropertyName>
+ <FormatString>0x{0:X8}</FormatString>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>Id</PropertyName>
+ <FormatString>0x{0:X4}</FormatString>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>Rank</PropertyName>
+ <FormatString>0x{0:X4}</FormatString>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>w018</PropertyName>
+ <FormatString>0x{0:X4}</FormatString>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>NameOffset</PropertyName>
+ <FormatString>0x{0:X4}</FormatString>
+ </TableColumnItem>
+ <TableColumnItem>
+ <PropertyName>Name</PropertyName>
+ </TableColumnItem>
+ </TableColumnItems>
+ </TableRowEntry>
+ </TableRowEntries>
+ </TableControl>
+ </View>
+ </ViewDefinitions>
+</Configuration>
\ No newline at end of file |