get-process - Unable to retrieve some process information and command line - powershell

Question

I've 2 questions regarding the code below :
Question 1:
For some unknown reason, the following code does not retrieve information from certain processes.
However, he manages to recover the sha256
Could you please explain why this behavior and how to fix address this behavior ?
Path is Null
WmiPrvSE
- [(PID=5356) () Description=]
-- Path="None (SHA256=AD938C303F12EA8D164433CC7BA46FC7B9AE00F6F899E308D4317DAB46E25642)
-----
Get-FileHash : Impossible de lier l'argument au paramètre « Path », car il a la valeur Null.
Au caractère C:\Users\LEFBE\Desktop\Klic-20-12-2021\Process.ps1:4 : 33
+ $FileHash = (Get-FileHash -Path $_.Path -Algorithm SHA256 -ErrorActio ...
+ ~~~~~~~
+ CategoryInfo : InvalidData : (:) [Get-FileHash], ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Get-FileHash
Question 2:
I'm having trouble retrieving the command line launched by the process. Could you please help me to get this information?
The code :
get-process | ForEach-Object {
$Name = $_.Name
$Desc = $_.Description
$FileHash = (Get-FileHash -Path $_.Path -Algorithm SHA256 -ErrorAction SilentlyContinue).hash
$ID = $_.ID
$Path = $_.Path
$CP = $_.Company
$CL = $_.Commandline
if ($Path -eq $null)
{
Write-Host "Path is Null"
$Path = "None"
Write-Host "$Name"
Write-Host "- [(PID=$ID) ($CP) Description=$Desc]"
Write-Host "-- Path=""$Path (SHA256=$FileHash)"
Write-Host $CL
Write-Host "-----"
}
else
{
Write-Host "$Name"
Write-Host "- [(PID=$ID) ($CP) Description=$Desc]"
Write-Host "-- Path=""$Path (SHA256=$FileHash)"
Write-Host $CL
Write-Host "-----"
}
}
Update 23/12/2021
The updated code works better than the first. (manage Null $Path value)
On the other hand, no command line can be obtained yet.
get-process | ForEach-Object {
$Name = $_.Name
$Desc = $_.Description
$ID = $_.ID
$Path = $_.Path
$CP = $_.Company
$CL = $_.Commandline
IF([string]::IsNullOrEmpty($Path)) {
$Path = "None"
$FileHash = "None"
write-Host "$Name"
Write-Host "- [(PID=$ID) ($CP) Description=$Desc]"
Write-Host "-- Path=""$Path (SHA256=$FileHash)"
Write-Host $CL
Write-Host "-----"
} else {
$FileHash = (Get-FileHash -LiteralPath $_.Path -Algorithm SHA256 -ErrorAction SilentlyContinue).hash
Write-Host "$Name"
Write-Host "- [(PID=$ID) ($CP) Description=$Desc]"
Write-Host "-- Path=""$Path (SHA256=$FileHash)"
Write-Host $CL
Write-Host "-----"
}
}
Thanks for your help,
LEFBE

Answer 1

You can use a calculated property with Select-Object to generate your new object. As for "having trouble retrieving the command line", I'm assuming you're unable to capture the output of your script with Out-File or similar, this is because Write-Host sends the output to the Information Stream and it's output can't be captured unless redirected (6>&1).
Get-Process | Select-Object Name, Description, #{
Name = 'Hash'
Expression = { (Get-FileHash $_.Path -Algorithm SHA256).Hash }
}, ID, Path, Company, CommandLine