How to use SHGetStockIconInfo in Powershell? - powershell

I'm trying to pull folder icons for a listview in a winform. I'm using [Drawing.Icon]::ExtractAssociatedIcon for file icons, but it doesn't work on folders.
I found this question here on stack which said to use SHGetStockIconInfo, but I can't wrap my head around how to load this function and use it in Powershell (I have no C programming experience). I managed to pull this from the linked question, but I'm stuck:
Add-Type -NameSpace WinAPI -Name DefaultIcons -MemberDefinition #'
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct SHSTOCKICONINFO {
public uint cbSize;
public IntPtr hIcon;
public int iSysIconIndex;
public int iIcon;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
public string szPath;
}
[DllImport("shell32.dll")]
public static extern int SHGetStockIconInfo(uint siid, uint uFlags, ref SHSTOCKICONINFO psii);
[DllImport("user32.dll")]
public static extern bool DestroyIcon(IntPtr handle);
private const uint SHSIID_FOLDER = 0x3;
private const uint SHGSI_ICON = 0x100;
private const uint SHGSI_LARGEICON = 0x0;
private const uint SHGSI_SMALLICON = 0x1;
'#
This runs without error, but that's as far as I can get and I don't fully understand what's going on.
I know I need to call the function SHGetStockIconInfo with three parameters:
uint to identify what icon I want
uint flag for the size of icon I want
a reference to a SHSTOCKICONINFO structure
The question I got all this from includes a GetStockIcon function definition, but I keep getting errors trying to include it saying The type or namespace name 'Icon' could not be found (are you missing a using directive or an assembly reference?)

With a few adjustments I got the code from that C# question to work under both PowerShell 5.1 and 7.2.6.
$refAsm = if( $PSVersionTable.PSVersion.Major -le 5 ) {'System.Drawing'} else {'System.Drawing.Common'}
Add-Type -ReferencedAssemblies $refAsm -TypeDefinition #'
using System;
using System.Runtime.InteropServices;
using System.Drawing;
public static class DefaultIcons
{
public static Icon GetStockIcon(uint type, uint size)
{
var info = new SHSTOCKICONINFO();
info.cbSize = (uint)Marshal.SizeOf(info);
SHGetStockIconInfo(type, SHGSI_ICON | size, ref info);
var icon = (Icon)Icon.FromHandle(info.hIcon).Clone(); // Get a copy that does not use the original handle
DestroyIcon(info.hIcon); // Clean up native icon to prevent resource leak
return icon;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct SHSTOCKICONINFO
{
public uint cbSize;
public IntPtr hIcon;
public int iSysIconIndex;
public int iIcon;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
public string szPath;
}
[DllImport("shell32.dll")]
public static extern int SHGetStockIconInfo(uint siid, uint uFlags, ref SHSTOCKICONINFO psii);
[DllImport("user32.dll")]
public static extern bool DestroyIcon(IntPtr handle);
public const uint SHSIID_FOLDER = 0x3;
public const uint SHGSI_ICON = 0x100;
public const uint SHGSI_LARGEICON = 0x0;
public const uint SHGSI_SMALLICON = 0x1;
}
'#
Use it like this:
$folderIconLarge = [DefaultIcons]::GetStockIcon( [DefaultIcons]::SHSIID_FOLDER, [DefaultIcons]::SHGSI_LARGEICON )
$folderIconSmall = [DefaultIcons]::GetStockIcon( [DefaultIcons]::SHSIID_FOLDER, [DefaultIcons]::SHGSI_SMALLICON )

Related

Can I turn a raw memory dump (ReadProcessMemory) into a MiniDump file?

I have the following powershell code to dump the process memory from a given process. In this case, cmd.exe.
It opens the given process with PROCESS_ALL_ACCESS and uses VirtualQueryEx to list all the memory regions. For each memory region it finds, it calls ReadProcessMemory and writes the bytes read to a file.
$typeDefinition = #"
using System;
using System.Text;
using System.Runtime.InteropServices;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
public static partial class MemApi
{
[StructLayout(LayoutKind.Sequential)]
public struct MEMORY_BASIC_INFORMATION64
{
public ulong BaseAddress;
public ulong AllocationBase;
public int AllocationProtect;
public int __alignment1;
public ulong RegionSize;
public int State;
public int Protect;
public int Type;
public int __alignment2;
}
[Flags]
public enum ProcessAccessFlags : uint
{
VM_READ = 0x00000010,
PROCESS_ALL_ACCESS = 0x001F0FFF
}
[DllImport("kernel32.dll")]
public static extern uint GetLastError();
[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public static extern IntPtr OpenProcess(
ProcessAccessFlags dwAccess,
[MarshalAs(UnmanagedType.Bool)]
bool bInheritHandle,
int dwProcId
);
[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public static extern int VirtualQueryEx(
IntPtr hProc,
IntPtr lpAddr,
out MEMORY_BASIC_INFORMATION64 lpBuf,
int dwLen
);
public static List<MEMORY_BASIC_INFORMATION64> ListMemoryRegions(
IntPtr hProc
)
{
long maxAddr = 0x00007FFFFFFFFFFF;
long addr = 0;
List<MEMORY_BASIC_INFORMATION64> regions = new List<MEMORY_BASIC_INFORMATION64>();
do
{
MEMORY_BASIC_INFORMATION64 m;
int result = VirtualQueryEx(hProc, (IntPtr)addr, out m, (int)Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION64)));
if (addr == (long)m.BaseAddress + (long)m.RegionSize)
break;
addr = (long)m.BaseAddress + (long)m.RegionSize;
regions.Add(m);
} while (addr <= maxAddr);
return regions;
}
[DllImport("kernel32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public static extern Boolean ReadProcessMemory(
IntPtr hProc,
IntPtr lpBaseAddr,
byte[] lpBuf,
UInt32 nSize,
ref UInt32 lpNBytes
);
}
"#
Add-Type -TypeDefinition $typeDefinition -Language CSharp
$cmd = Get-Process -Name cmd
$handle = [MemApi]::OpenProcess(0x1F0FFF, $false, $cmd.Id)
$regions = [MemApi]::ListMemoryRegions($handle)
$fileStream = [System.IO.File]::OpenWrite("$env:TEMP\cmd.DMP")
Write-Host "$($regions.Count) memory segments have been found"
for ($i = 0; $i -lt $regions.Count; $i++)
{
Write-Host "Exporting memory region $("{0:d4}/{1:d4}" -f $i, ($regions.Count + 1)) ($("0x{0:X16} - 0x{1:X16}" -f $regions[$i].BaseAddress, ($regions[$i].BaseAddress + $regions[$i].RegionSize)))..."
try
{
$read = 0
$buff = New-Object byte[] $regions[$i].RegionSize
if ([MemApi]::ReadProcessMemory($handle, [System.IntPtr]::new($regions[$i].BaseAddress), $buff, $buff.Length, [ref]$read) -eq $true)
{
$fileStream.Write($buff, 0, $buff.Length)
}
} catch { } finally { }
}
$fileStream.Close()
I would like to avoid using dbghelp.dll to do this, but is there a way I can create a MiniDump file out of this raw memory? Would I need to change the code at all or is there an external tool that can convert this?
I've tried to take a look into the MiniDumpWriteDump function to see if I can replicate it at all but I've had no luck.
I've also tried volatility's raw2dmp function, but this has not worked unfortunately.
Apologies if this is completely on the wrong tracks!
Any help would be much appreciated - Merry Christmas!

Extract Bitmap from DLL for use in PowerShell Script

I'm in the process of building a little utility using powershell and have spent a good deal of time teaching myself about building windows forms and controls using powershell. In order to keep my deployment to a small footprint I have packaged all of my graphics icons (.ico) and images (.bmp) in a dynamically linked library (*.dll) using a third party utilty (greenfish icon editor pro, which I highly recommend).
The problem that I have now is that I can't load the assembly because the resulting *.dll is missing a manifest. I've searched all over but was unable to find any concise answer on how to access the resource without using the add-type cmdlet to load the *.dll.
I was able to find a way to load icons from a dll in an answer to this post from Kazun. Then utilizing technet I was able to find a corresponding entry point in the dll for a method to extract a bitmap. See my kludged together script below which combines both the IconExtractor and my newly created BitmapExtractor classes.
$code = #"
using System;
using System.Drawing;
using System.Runtime.InteropServices;
namespace System {
public class IconExtractor { #Credit to Kazun from https://social.technet.microsoft.com/Forums/windows/en-US/16444c7a-ad61-44a7-8c6f-b8d619381a27/using-icons-in-powershell-scripts?forum=winserverpowershell
public static Icon Extract(string file, int number, bool largeIcon) {
IntPtr large;
IntPtr small;
ExtractIconEx(file, number, out large, out small, 1);
try {
return Icon.FromHandle(largeIcon ? large : small);
} catch {
return null;
}
}
[DllImport("Shell32.dll", EntryPoint = "ExtractIconExW", CharSet = CharSet.Unicode, ExactSpelling = true, CallingConvention = CallingConvention.StdCall)]
private static extern int ExtractIconEx(string sFile, int iIndex, out IntPtr piLargeVersion, out IntPtr piSmallVersion, int amountIcons);
}
public class BitmapExtractor { #Credit to Chad Estes (chadwestes#gmail.com)
public static Bitmap Extract(string file, string resourceID) {
IntPtr hModule = LoadLibraryEx(file,IntPtr.Zero,0x00000020);
Bitmap bmp = null;
IntPtr hBitmap = IntPtr.Zero;
try {
if (hModule != IntPtr.Zero) {
hBitmap = LoadBitmap(hModule, resourceID);
if (hBitmap != IntPtr.Zero) {
bmp = Bitmap.FromHbitmap(hBitmap);
}
}
} catch {
bmp = null;
} finally {
DeleteObject(hBitmap);
FreeLibrary(hModule);
}
return bmp;
}
[DllImport("kernel32.dll", SetLastError = true)]
static extern IntPtr LoadLibraryEx(string lpFileName, IntPtr hReservedNull, uint dwFlags);
[DllImport("kernel32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Bool)]
static extern bool FreeLibrary(IntPtr hModule);
[DllImport("user32.dll")]
static extern IntPtr LoadBitmap(IntPtr hInstance, string lpBitmapName);
[DllImport("gdi32.dll", EntryPoint="DeleteObject", CharSet = CharSet.Unicode, ExactSpelling = true, CallingConvention = CallingConvention.StdCall)]
private static extern bool DeleteObject(IntPtr hBitmap);
}
}
"#
Add-Type -TypeDefinition $code -ReferencedAssemblies System.Drawing
$myImage = [System.BitmapExtractor]::Extract("C:\SomePath\Some.dll", "LOGO")
$myIcon = [System.IconExtractor]::Extract("C:\SomePath\Some.dll", 1, $true)

UnityKinectDepthExplorer - how can I use this example with Kinect v1?

I'm interested in displaying Depth data in Unity with Kinect for Windows. Unfortunately, I have Kinect v1.8 and I know this has been easily done with Kinect V2 (Kinect Fusion).
I found this example: https://github.com/rickbarraza/UnityKinectDepthExplorer
I installed all the necessary components and now getting DLLNOTFOUNDEXCEPTION:
Failed to load 'Assets/Plugins/x86_64/KinectUnityAddin.dll'
Concerning all the posts and forums I've been reading so far, It's because I'm using SDK 1.8 (instead of SDK 2.0).
Is there any way how I can use this example with Kinect v1.8? I tried to contact the author as well but he haven't responded back.
Thanks a lot!
I had the same Problem in an University Project maby its not to late for you.
This is an Kinect v1.8 Wrapper i made to read the kinect depth image only. I used the Kinect with MS-SDK from the Unity-Assetstore as an orientation, you dont have to download it. All you need is this Code.
Use The Init() Method to start and the GetDepthArray() Function to get the Deapth Frame.
hope it works for you !
You have to install the Kinect 1.8 sdk or have at least the Kinect10.dll from the 1.8 sdk in your Windows/System32 folder
using System.Collections;
using System.Collections.Generic;
using UnityEngine;
using System.Runtime.InteropServices;
using System;
using System.Runtime.CompilerServices;
public class OwnKinectWrapper : MonoBehaviour {
DepthBuffer db;
#region Nui Variables/Structs/Intefraces
IntPtr streamReferenz;
public struct NuiImageViewArea
{
public int eDigitalZoom;
public int lCenterX;
public int lCenterY;
}
public struct NuiSurfaceDesc
{
uint width;
uint height;
}
public struct DepthBuffer
{
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 640 * 480, ArraySubType = UnmanagedType.U2)]
public ushort[] pixels;
}
public struct NuiLockedRect
{
public int pitch;
public int size;
public IntPtr pBits;
}
public struct NuiImageFrame
{
public Int64 liTimeStamp;
public uint dwFrameNumber;
public int eImageType;
public int eResolution;
public IntPtr pFrameTexture;
public uint dwFrameFlags_NotUsed;
public NuiImageViewArea ViewArea_NotUsed;
}
[Guid("13ea17f5-ff2e-4670-9ee5-1297a6e880d1")]
[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
[ComImport()]
public interface INuiFrameTexture
{
[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime)]
[PreserveSig]
int BufferLen();
[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime)]
[PreserveSig]
int Pitch();
[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime)]
[PreserveSig]
int LockRect(uint Level, ref NuiLockedRect pLockedRect, IntPtr pRect, uint Flags);
[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime)]
[PreserveSig]
int GetLevelDesc(uint Level, ref NuiSurfaceDesc pDesc);
[MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime)]
[PreserveSig]
int UnlockRect(uint Level);
}
#endregion
// Use this for initialization
public int Init() {
int init = 0;
try {
init = NuiInitialize(0x00000020);
Debug.Log("init : " + init);
streamReferenz = IntPtr.Zero;
NuiImageStreamOpen(4, 2, 0, 2, IntPtr.Zero, ref streamReferenz);
}
catch (DllNotFoundException e)
{
string message = "Please check the Kinect SDK installation.";
Debug.LogError(message);
Debug.LogError(e.ToString());
return -1;
}
catch (Exception e)
{
Debug.LogError(e.ToString());
return -1;
}
return init;
}
// Update is called once per frame
void Update()
{
IntPtr imageStreamFrameReferenz = IntPtr.Zero;
int test = NuiImageStreamGetNextFrame(streamReferenz, 0, ref imageStreamFrameReferenz);
if (test == 0) {
NuiImageFrame imageFrame = (NuiImageFrame)Marshal.PtrToStructure(imageStreamFrameReferenz, typeof(NuiImageFrame));
INuiFrameTexture frameTexture = (INuiFrameTexture)Marshal.GetObjectForIUnknown(imageFrame.pFrameTexture);
NuiLockedRect lockedRectPtr = new NuiLockedRect();
IntPtr r = IntPtr.Zero;
frameTexture.LockRect(0, ref lockedRectPtr, r, 0);
db = (DepthBuffer)Marshal.PtrToStructure(lockedRectPtr.pBits, typeof(DepthBuffer));
frameTexture.UnlockRect(0);
NuiImageStreamReleaseFrame(streamReferenz, imageStreamFrameReferenz);
}
}
void OnDisable() {
NuiShutdown();
}
public ushort[] GetDepthArray(){
return db.pixels;
}
[DllImportAttribute(#"Kinect10.dll",EntryPoint="NuiInitialize")]
public static extern int NuiInitialize (uint dwFlags);
[DllImportAttribute(#"Kinect10.dll", EntryPoint = "NuiImageStreamOpen")]
public static extern int NuiImageStreamOpen(int enumImageType,int enumImgageResolution, uint image_Flags, uint frameBufferLimit, IntPtr nextFrameEvent, ref IntPtr streamHandle );
[DllImportAttribute(#"Kinect10.dll", EntryPoint = "NuiImageStreamGetNextFrame")]
public static extern int NuiImageStreamGetNextFrame(IntPtr streamReferenz, uint dwMillisecondsToWait, ref IntPtr ImageFrameReferenz);
[DllImportAttribute(#"Kinect10.dll", EntryPoint = "NuiImageStreamReleaseFrame")]
public static extern int NuiImageStreamReleaseFrame(IntPtr phStreamHandle, IntPtr ppcImageFrame);
[DllImportAttribute(#"Kinect10.dll",EntryPoint="NuiDepthPixelToDepth")]
public static extern ushort NuiDepthPixelToDepth (ushort depthPixel);
[DllImportAttribute(#"Kinect10.dll", EntryPoint = "NuiShutdown")]
public static extern void NuiShutdown();
}
if something is not working or you need help feel free to write some lines

How can I save Unity Statistics or Unity Profiler Statistics (stats on CPU, Rendering, Memory...) in a file (text or CSV ...)?

I need to know please if I can save the profiler statistics (http://docs.unity3d.com/Manual/ProfilerWindow.html) and/or Unity Rendering Statistics (the overlay window that shows realtime statistics) - http://docs.unity3d.com/Manual/RenderingStatistics.html - into a file like a CSV or an Excel or even a txt file so I can later study them and do some statistical analysis on them.
Yep, you can.
Saving profiler data:
// write FPS to "profilerLog.txt"
Profiler.logFile = Application.persistentDataPath + "/profilerLog.txt";
// write Profiler Data to "profilerLog.txt.data"
Profiler.enableBinaryLog = true;
Profiler.enabled = true;
Then you can show this data in editor:
Profiler.AddFramesFromFile(Application.dataPath + "/profilerLog.txt");
Saving statistics:
You can use any serialization method you want/like. Just use data from UnityEditor.UnityStats. Remember that it's only available from Editor.
This class looks like this, autocompletion should help:
public sealed class UnityStats {
public static extern int drawCalls
public static extern int batchedDrawCalls
public static extern int batches
public static extern int triangles
public static extern int vertices
public static extern int shadowCasters
public static extern int renderTextureChanges
public static extern float frameTime
public static extern float renderTime
public static extern int renderTextureCount
public static extern int renderTextureBytes
public static extern int usedTextureMemorySize
public static extern int usedTextureCount
public static extern string screenRes
public static extern int screenBytes
public static extern int vboTotal
public static extern int vboTotalBytes
public static extern int vboUploads
public static extern int vboUploadBytes
public static extern int ibUploads
public static extern int ibUploadBytes
public static extern int visibleSkinnedMeshes
public static extern int visibleAnimations
public static extern string GetNetworkStats(int i);
}
With a look into the ProfilerWindow class on the decompiled unity code (which you may find online) you can easily write a script that exports the data you need.
The script might look like this
using UnityEditor;
using UnityEditorInternal;
var firstFrameIndex = ProfilerDriver.firstFrameIndex;
var lastFrameIndex = ProfilerDriver.lastFrameIndex;
var profilerSortColumn = ProfilerColumn.TotalTime;
var viewType = ProfilerViewType.Hierarchy;
var profilerData = new ProfilerData();
for (int frameIndex = firstFrameIndex; frameIndex <= lastFrameIndex; ++frameIndex)
{
var property = new ProfilerProperty();
property.SetRoot(frameIndex, profilerSortColumn, viewType);
property.onlyShowGPUSamples = false;
bool enterChildren = true;
while (property.Next(enterChildren))
{
// get all the desired ProfilerColumn
var name = property.GetColumn(ProfilerColumn.FunctionName);
var totalTime = property.GetColumn(ProfilerColumn.TotalTime);
// store values somewhere
}
property.Cleanup();
}
If you want, you can use this script that allows you to export the data as a JSON file and provides also some useful stats when you are profiling.

how to capture clicks event on other window that has been minimized

i want to build an app that work in the background, and will capture all click events
on the minimize button, of all opened forms / windows that actually running. (not only in my current app)
it will be some sort of hook to add minimize handler to all of other windows.
how to setup this kind of hook ? ( please provide some code example in csharp with marsheling )
To better understand the idea : this procedure already exists in program called TrayIt that handle Ctrl+Click on the Minimize button, and send programs to system tray .
EDIT:
i have found that SetWindowsHookEx cannot set a global hook with c# due to limitation in manged code (see the msdn documentation )
but may WinEventProc with EVENT_OBJECT_STATECHANGE should do the work
finely i have found solution for this hook ,
this is not the best solution that i can get but it do the work
i have mixed window_state_change in SetWinEventHook
and component to track Control Key in Gma.UserActivityMonitor
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Windows;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.Security.Permissions;
using Gma.UserActivityMonitor;
namespace example {
public partial class Form1 : Form {
public Form1() {
InitializeComponent();
}
public const uint WINEVENT_OUTOFCONTEXT = 0;
public const uint EVENT_OBJECT_STATECHANGE = 0x800A;
[DllImport("user32.dll")]
public static extern IntPtr SetWinEventHook(uint eventMin, uint eventMax, IntPtr hmodWinEventProc, WinEventDelegate lpfnWinEventProc, uint idProcess, uint idThread, uint dwFlags);
[DllImport("user32.dll")]
public static extern bool UnhookWinEvent(IntPtr hWinEventHook);
public delegate void WinEventDelegate(IntPtr hWinEventHook, uint eventType, IntPtr hwnd, int idObject, int idChild, uint dwEventThread, uint dwmsEventTime);
public static bool ControlDown = false;
public static IntPtr hhook;
static WinEventDelegate procDelegate = new WinEventDelegate(WinEventProc);
private void load(object sender, System.EventArgs e) {
hhook = SetWinEventHook(EVENT_OBJECT_STATECHANGE, EVENT_OBJECT_STATECHANGE, IntPtr.Zero, procDelegate, 0, 0, winapi.WINEVENT_OUTOFCONTEXT);
HookManager.KeyDown += HookManager_KeyDown;
HookManager.KeyUp += HookManager_KeyUp;
}
private void closing(object sender, System.Windows.Forms.FormClosingEventArgs e) {
UnhookWinEvent(hhook);
HookManager.KeyDown -= HookManager_KeyDown;
HookManager.KeyUp -= HookManager_KeyUp;
}
private void HookManager_KeyUp(object sender, KeyEventArgs e) {
if (e.KeyCode == Keys.LControlKey) { ControlDown = false; }
}
private void HookManager_KeyDown(object sender, KeyEventArgs e) {
if (e.KeyCode == Keys.LControlKey) { ControlDown = true; }
}
static void WinEventProc(IntPtr hWinEventHook, uint eventType, IntPtr hwnd, int idObject, int idChild, uint dwEventThread, uint dwmsEventTime) {
if (idObject == -2 && idChild == 2) {
if (ControlDown) {
// HookWindow(hwnd);
.....
}
}
}
}
}
if you like you can setup a simple hook with RegisterHotKey
[DllImport("user32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool RegisterHotKey(IntPtr hWnd, int id, uint fsModifiers, uint vk);