Skip to content

Instantly share code, notes, and snippets.

@mgreen27

mgreen27/Get-InjectedThreadEx.ps1

Last active February 21, 2023 12:16
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mgreen27/b37467aa725e0445d966c9589c90381a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mgreen27/b37467aa725e0445d966c9589c90381a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. mgreen27 revised this gist Feb 21, 2023. 1 changed file with 7 additions and 16 deletions.
    23 changes: 7 additions & 16 deletions Get-InjectedThreadEx.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -3153,25 +3153,16 @@ function GetProcAddress
    #endregion Win32 API Abstractions

    # Uses environment variables to determine execution options
    $Results = $null
    $ScanType = $Env:GetInjectedThreadScan
    $TargetPid = $Env:GetInjectedThreadTarget

    if( $TargetPid ){
    If ( $ScanType -eq 'Aggressive' ) {
    $Results = Get-InjectedThreadEx -Aggressive -ProcessId $TargetPid }
    Elseif( $ScanType -eq 'Brief' ) {
    $Results = Get-InjectedThreadEx -Brief -ProcessId $TargetPid }
    Else {
    $Results = Get-InjectedThreadEx -ProcessId $TargetPid }
    If ( $ScanType -eq 'Aggressive' ) { Get-InjectedThreadEx -Aggressive -ProcessId $TargetPid }
    Elseif( $ScanType -eq 'Brief' ) { Get-InjectedThreadEx -Brief -ProcessId $TargetPid }
    Else { Get-InjectedThreadEx -ProcessId $TargetPid }
    }
    else {
    If( $ScanType -eq 'Aggressive') {
    $Results = Get-InjectedThreadEx -Aggressive }
    Elseif( $ScanType -eq 'Brief') {
    $Results = Get-InjectedThreadEx -Brief }
    Else {
    $Results = Get-InjectedThreadEx }
    }

    $Results
    If( $ScanType -eq 'Aggressive') { Get-InjectedThreadEx -Aggressive }
    Elseif( $ScanType -eq 'Brief') { Get-InjectedThreadEx -Brief }
    Else { Get-InjectedThreadEx }
    }
  2. mgreen27 revised this gist Feb 21, 2023. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion Get-InjectedThreadEx.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -3171,7 +3171,7 @@ else {
    Elseif( $ScanType -eq 'Brief') {
    $Results = Get-InjectedThreadEx -Brief }
    Else {
    $ScanType = Get-InjectedThreadEx }
    $Results = Get-InjectedThreadEx }
    }

    $Results
  3. mgreen27 revised this gist Feb 21, 2023. 1 changed file with 7 additions and 7 deletions.
    14 changes: 7 additions & 7 deletions Get-InjectedThreadEx.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -3152,24 +3152,24 @@ function GetProcAddress
    }
    #endregion Win32 API Abstractions

    # Uses environment variable s to determione execution options
    # Uses environment variables to determine execution options
    $Results = $null
    $ScanType = $Env:GetInjectedThreadScan
    $TargetPid = $Env:GetInjectedThreadTarget

    if( $TargetPid ){
    If ( $ScanType -eq 'Agressive' ) {
    If ( $ScanType -eq 'Aggressive' ) {
    $Results = Get-InjectedThreadEx -Aggressive -ProcessId $TargetPid }
    Elseif( $ScanType -eq 'Breif' ) {
    $Results = Get-InjectedThreadEx -Breif -ProcessId $TargetPid }
    Elseif( $ScanType -eq 'Brief' ) {
    $Results = Get-InjectedThreadEx -Brief -ProcessId $TargetPid }
    Else {
    $Results = Get-InjectedThreadEx -ProcessId $TargetPid }
    }
    else {
    If( $ScanType -eq 'Agressive') {
    If( $ScanType -eq 'Aggressive') {
    $Results = Get-InjectedThreadEx -Aggressive }
    Elseif( $ScanType -eq 'Breif') {
    $Results = Get-InjectedThreadEx -Breif }
    Elseif( $ScanType -eq 'Brief') {
    $Results = Get-InjectedThreadEx -Brief }
    Else {
    $ScanType = Get-InjectedThreadEx }
    }
  4. mgreen27 created this gist Feb 20, 2023.
    3,177 changes: 3,177 additions & 0 deletions Get-InjectedThreadEx.ps1
    View file
    3,177 additions, 0 deletions not shown because the diff is too large. Please use a local Git client to view these changes.