pkeyconfig Info Reader +Plus+ [v18.0.1]

i think i start use IntParse --> its bigger than int value
let's me try biginteger, or unit instead

Edit. solved it. [bigInt] is my solution

 

extract data from Kernel - polices registry

Edit.
Improve results, and upload a better version

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

v16.4 [compiled at 28-06-25]

Code:

* Remove Local error resources
  And use Api instead.
* Extract, Error info messege option, Using APi
  For WU, CBS, used harcoded table.
* Add "SPPC.dll", to Activation dll Errols API
  in addition to "SLC.dll"
* Some error ware return hresults & Activation error, 
  ware fixed with -bor option
  -Flags ([ErrorMessageType]::ACTIVATION -bor [ErrorMessageType]::HRESULT)
* Also remove any Tail for 0x / decimal number's end,
  not belong to 0x / decimal format

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

v16.3 [compiled at 28-06-25]

Code:

* Remove Local error resources
  And use Api instead.
* Extract, Error info messege option, Using APi
  For WU, CBS, used harcoded table.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

my new extract screen option ->







~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Code:

# ***************************** #
#  v16.2 compiled at 28-06-25 #
# ***************************** #
<#
* Remove Local error resources
  And use Api instead.
#>

I ALso think to add error decoder,
with type-s ->
will be next time
this signature is allready ready

Code:

enum ErrorMessegeType {
    ALL        = 0
    WIN32      = 1
    NTSTATUS   = 2
    ACTIVATION = 3
    NETWORK    = 4
    CBS        = 5
    BITS       = 6
    HTTP       = 7
    UPDATE     = 8
    HRESULT    = 99
}
function Parse-ErrorMessage {
    param (
        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $MessageId,

        [Parameter(Mandatory = $false)]
        [ValidateSet("ALL", "WIN32", "NTSTATUS", "ACTIVATION", "NETWORK", "CBS", "BITS", "HTTP", "UPDATE", "HRESULT")]
        [ErrorMessegeType]$Type = "ALL",

        [Parameter(Mandatory=$false)]
        [bool]$Log = $false
    )

 

You need to login to view this posts content.

 

OK, interesting case,
WARNING: win32ERR = 752, MessageId = 277
SO, 0x000000115 is also NTSTAUS, and ALSO win32 ERROR
And also, is 752 win32 error {from NTSTAUS}

 

this is nice features that no one explore,
first tool that also parse error by catogerie
nice option, but i agree with you.

* i did it because i don't want to save libary of error's in my script
like every one else do

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

Re uploaded. again. because found interesting bug
So, .net GC work very fast, and he reason i mention it is,
RtlInitUnicodeString vs RtlCreateUnicodeString --> very big, RtlInitUnicodeString use pointer like RtlCreateUnicodeString,
but first one use pointer to pointer Pass by .Net -> string Pass my Api Call. and than, what GC do, clean this String value,
So, replace with RtlCreateUnicodeString, which, make new pointer, to store 'Text' provide by user.
And, So, we make sure, GC, will not kill our unicodeString Pointer,
this later force me to clean pointer twice, by API & by .Net. [i know, sound weird]
so, end up. with. -->

Code:

$null = $Global:ntdll::RtlCreateUnicodeString(
     $unicodeStringPtr, $valueName)

.............

$null = $Global:ntdll::RtlFreeUnicodeString($unicodeStringPtr)
New-IntPtr -hHandle $unicodeStringPtr -Release

........
So, in --> char __fastcall RtlCreateUnicodeString(__int64 a1, _WORD *a2)

Code:

  StringRoutine = (void *)NtdllpAllocateStringRoutine(v5);
  *(_QWORD *)(a1 + 8) = StringRoutine;
  if ( !StringRoutine )

while, in -> void __stdcall RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)

Code:

DestinationString->Buffer = (wchar_t *)SourceString; --> this is actually pointer from Managed .Net

------------
test result --> see yourself. very fast.

Code:

$Global:ntdll::RtlInitUnicodeString(
    $unicodeStringPtr, $valueName)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
10
test
test
test
test

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
[Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
Ů 〸쯻
Ů 岨쯓
Ů 岨쯓
Ů 岨쯓

and after few second later
for each second left, memory is cleared again,
and i get net garbage data

Code:

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
  혀㦎

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
ntat

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
ntat

PS C:\Users\Administrator>
PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
  ꎀ㔭

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)

now the garbage data, become more intersting.

Code:

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
Ů *

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
Ů ޸쓧

PS C:\Users\Administrator> [Marshal]::PtrToStringUni(
    [Marshal]::ReadIntPtr($unicodeStringPtr, 8),
    [Marshal]::ReadInt16($unicodeStringPtr) / 2
)
  䙈亵