Forked from mattifestation/wmi_provider_association.ps1
Created
June 30, 2016 06:32
-
-
Save z3v2cicidi/7580d7fdd46741a8f2674ec93d4c9bf8 to your computer and use it in GitHub Desktop.
Enumerates WMI providers, the DLLs that back the provider, and the classes hosted by the provider.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <# | |
| Author: Matthew Graeber (@mattifestation) | |
| License: BSD 3-Clause | |
| #> | |
| function Get-WmiNamespace { | |
| [OutputType([String])] | |
| Param ( | |
| [String] | |
| [ValidateNotNullOrEmpty()] | |
| $Namespace = 'ROOT', | |
| [Switch] | |
| $Recurse | |
| ) | |
| $BoundParamsCopy = $PSBoundParameters | |
| $null = $BoundParamsCopy.Remove('Namespace') | |
| # Exclude locale specific namespaces | |
| Get-WmiObject -Class __NAMESPACE -Namespace $Namespace -Filter 'NOT Name LIKE "ms_4%"' | ForEach-Object { | |
| $FullyQualifiedNamespace = '{0}\{1}' -f $_.__NAMESPACE, $_.Name | |
| $FullyQualifiedNamespace | |
| if ($Recurse) { | |
| Get-WmiNamespace -Namespace $FullyQualifiedNamespace @BoundParamsCopy | |
| } | |
| } | |
| } | |
| function Get-WmiProviderAssociation { | |
| $UnhostedClasses = New-Object 'Collections.ObjectModel.Collection`1[System.Management.ManagementClass]' | |
| Get-WmiNamespace -Recurse | ForEach-Object { | |
| $Namespace = $_ | |
| $ClassProviderMapping = @{} | |
| Get-WmiObject -Namespace $Namespace -List | % { | |
| if ($_.Qualifiers['Provider']) { | |
| $HostingProvider = $_.Qualifiers['Provider'].Value.ToLower() | |
| if (-not $ClassProviderMapping.ContainsKey($HostingProvider)) { | |
| $ClassProviderMapping[$HostingProvider] = New-Object 'Collections.ObjectModel.Collection`1[System.Management.ManagementClass]' | |
| } | |
| $ClassProviderMapping[$HostingProvider].Add($_) | |
| } else { | |
| $UnhostedClasses.Add($_) | |
| } | |
| } | |
| Get-WmiObject -Namespace $_ -Class __Win32Provider | ForEach-Object { | |
| $ProviderCLSID = $_.CLSID | |
| $ClientCLSID = $_.ClientLoadableCLSID | |
| $ProviderImage = (Invoke-WmiMethod -Namespace root/default -Class StdRegProv -Name GetStringValue -ArgumentList @([UInt32] 2147483648, "CLSID\$ProviderCLSID\InprocServer32", $null)).sValue | |
| $ClientImage = (Invoke-WmiMethod -Namespace root/default -Class StdRegProv -Name GetStringValue -ArgumentList @([UInt32] 2147483648, "CLSID\$ClientCLSID\InprocServer32", $null)).sValue | |
| $HostedClasses = $null | |
| if ($ClassProviderMapping.ContainsKey($_.Name.ToLower())) { | |
| $HostedClasses = $ClassProviderMapping[$_.Name.ToLower()] | |
| } | |
| $Properties = [Ordered] @{ | |
| Namespace = $Namespace | |
| ProviderName = $_.Name | |
| HostingModel = $_.HostingModel | |
| ProviderImage = $ProviderImage | |
| ClientImage = $ClientImage | |
| HostedClasses = $HostedClasses | |
| } | |
| New-Object -TypeName PSObject -Property $Properties | |
| } | |
| } | |
| # Add a catch-all entry for all classes for which there is no provider | |
| if ($UnhostedClasses.Count -gt 0) { | |
| # Create a "null" provider object | |
| $Properties = [Ordered] @{ | |
| Namespace = $null | |
| ProviderName = $null | |
| HostingModel = $null | |
| ProviderImage = $null | |
| ClientImage = $null | |
| HostedClasses = $UnhostedClasses | |
| } | |
| New-Object -TypeName PSObject -Property $Properties | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment