aboutsummaryrefslogtreecommitdiff
path: root/RE_Tools/Get-KernelModuleInfo.format.ps1xml
blob: 3e3f347f19424e38a67b741e88a34e66e9b4b3a8 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
<?xml version="1.0" encoding="utf-8" ?>
<Configuration>
  <DefaultSettings>
    <EnumerableExpansions>
        <EnumerableExpansion>
            <Expand>Both</Expand>
        </EnumerableExpansion>
    </EnumerableExpansions>
  </DefaultSettings>
    <ViewDefinitions>
        <View>
            <Name>SystemModuleView</Name>
                <ViewSelectedBy>
		            <TypeName>SystemInformation.SYSTEM_MODULE</TypeName>
		        </ViewSelectedBy>
                <TableControl>
                    <AutoSize/>
                    <TableHeaders>
                        <TableColumnHeader>
                            <Label>ImageBaseAddress</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>ImageSize</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>Flags</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>Id</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>Rank</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>W018</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>NameOffset</Label>
                        </TableColumnHeader>
                        <TableColumnHeader>
                            <Label>Name</Label>
                        </TableColumnHeader>
                    </TableHeaders>
                    <TableRowEntries>
                        <TableRowEntry>
                            <TableColumnItems>
                                <TableColumnItem>
                                    <ScriptBlock>"0x$($_.ImageBaseAddress.ToString("X$([IntPtr]::Size * 2)"))"</ScriptBlock>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>ImageSize</PropertyName>
                                    <FormatString>0x{0:X8}</FormatString>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>Flags</PropertyName>
                                    <FormatString>0x{0:X8}</FormatString>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>Id</PropertyName>
                                    <FormatString>0x{0:X4}</FormatString>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>Rank</PropertyName>
                                    <FormatString>0x{0:X4}</FormatString>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>w018</PropertyName>
                                    <FormatString>0x{0:X4}</FormatString>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>NameOffset</PropertyName>
                                    <FormatString>0x{0:X4}</FormatString>
                                </TableColumnItem>
                                <TableColumnItem>
                                    <PropertyName>Name</PropertyName>
                                </TableColumnItem>
                            </TableColumnItems>
                        </TableRowEntry>
                    </TableRowEntries>
                </TableControl>
        </View>
    </ViewDefinitions>
</Configuration>