en-US/PSPhlebotomist.dll-Help.xml
|
<?xml version="1.0" encoding="utf-8"?> <helpItems schema="maml" xmlns="http://msh"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"> <command:details> <command:name>New-Injection</command:name> <command:verb>New</command:verb> <command:noun>Injection</command:noun> <maml:description> <maml:para>Injects one or more DLLs into a target process.</maml:para> <maml:para>Aliases: New-Syringe, New-Needle, New-Patient, Insert-Needle</maml:para> </maml:description> </command:details> <maml:description> <maml:para>A PowerShell cmdlet for injecting one or more DLLs into a target process, supporting both process ID and process name selection, optional elevation, and interactive or automated operation.</maml:para> <maml:para>This cmdlet can be invoked using several aliases, including 'New-Syringe', 'New-Injection', 'New-Patient', and 'Insert-Needle', because at one point I decided that I'm all-in on the bit.</maml:para> <maml:para>It supports both automated and interactive modes: if no parameters are provided, or only the -Admin parameter is provided, the cmdlet will prompt for input interactively. The cmdlet will attempt to elevate privileges and relaunch with the original commandline args if the 'Admin' switch is specified and it is not already running within an Administrator security context. If already running within an Administrator security context, the -Admin switch is ignored and the normal injection workflow and logic continues. This Cmdlet prefers to use an implmentation of sudo to elevate privileges if available, otherwise it will use the standard Windows process launch and UAC prompt/runas flow.</maml:para> <maml:para>Output is a PatientDiagnosis object representing the result of the injection attempt(s). For best results, ensure that the target process is accessible and that DLL paths are valid. Thread safety is not guaranteed; concurrent invocations on the same process should probably be avoided, although multiple DLL injections within the same Cmdlet call are a native and supported feature. Use the 'Wait' switch to block and wait for the process to launch (only valid when using Process Name, not PID), and 'Timeout' to specify the maximum process launch wait duration in seconds.</maml:para> </maml:description> <command:syntax> <command:syntaxItem> <maml:name>New-Injection</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="AsAdmin, Administrator, AsAdministrator, Root"> <maml:name>Admin</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should attempt to elevate privileges and relaunch as administrator. When this switch is specified and the cmdlet is not already running with administrator privileges, it will attempt to relaunch itself in an elevated context, preserving the original command-line arguments. The cmdlet prefers using a sudo implementation if available, otherwise it falls back to the standard UAC prompt. If already running within an Administrator security context, this parameter is ignored.</maml:para> </maml:description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="ProcessId, PID"> <maml:name>Id</maml:name> <maml:description> <maml:para>Specifies the Process ID (PID) of the target process which will receive the injected DLLs/PE images. This parameter is mandatory when using the 'pid' parameter set. The process must be accessible and running for injection to succeed when using this parameter. This parameter cannot be used simultaneously with the `ProcessName` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">IntPtr</command:parameterValue> <dev:type> <maml:name>IntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Inject</maml:name> <maml:description> <maml:para>Specifies an array of file paths (or a single string) to DLL files that will be injected into the target process. This parameter accepts multiple DLL paths and can be provided by property name. If no DLLs are specified, the cmdlet will enter interactive mode to prompt for input. Paths should be valid and accessible to the current user context. Providing a single string to this parameter instead of an array will result in the input being treated as an array with a single element.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="Name, PName"> <maml:name>ProcessName</maml:name> <maml:description> <maml:para>Specifies the name of the target process to inject DLLs into. This parameter is mandatory when using the 'pname' parameter set. When combined with the Wait switch, the cmdlet will wait for a process with this name to launch before attempting injection. This parameter cannot be used simultaneously with the `Id` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Timeout</maml:name> <maml:description> <maml:para>Specifies the maximum time (in seconds) to wait for a process to launch when using the `Wait` switch. This parameter only applies when the `Wait` switch and a process name is specified, and is ignored otherwise. If the target process does not launch within the specified timeout period, the cmdlet will terminate with an error. The default value is the maximum unsigned integer value for the current architecture.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">UIntPtr</command:parameterValue> <dev:type> <maml:name>UIntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>Maximum UInt value (platform-dependent)</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Wait</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should wait for the target process to launch before attempting injection. This switch is primarily useful when using the ProcessName parameter to specify a process by name. When enabled, the cmdlet will block and monitor for a process with the specified name to start, up to the timeout duration. This is useful for injecting into processes that are about to be launched.</maml:para> </maml:description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="proga"> <maml:name>ProgressAction</maml:name> <maml:description> <maml:para>Controls how progress messages are displayed. This is a common parameter available in PowerShell 7+.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">ActionPreference</command:parameterValue> <dev:type> <maml:name>ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>New-Injection</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="AsAdmin, Administrator, AsAdministrator, Root"> <maml:name>Admin</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should attempt to elevate privileges and relaunch as administrator. When this switch is specified and the cmdlet is not already running with administrator privileges, it will attempt to relaunch itself in an elevated context, preserving the original command-line arguments. The cmdlet prefers using a sudo implementation if available, otherwise it falls back to the standard UAC prompt. If already running within an Administrator security context, this parameter is ignored.</maml:para> </maml:description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="ProcessId, PID"> <maml:name>Id</maml:name> <maml:description> <maml:para>Specifies the Process ID (PID) of the target process which will receive the injected DLLs/PE images. This parameter is mandatory when using the 'pid' parameter set. The process must be accessible and running for injection to succeed when using this parameter. This parameter cannot be used simultaneously with the `ProcessName` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">IntPtr</command:parameterValue> <dev:type> <maml:name>IntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Inject</maml:name> <maml:description> <maml:para>Specifies an array of file paths (or a single string) to DLL files that will be injected into the target process. This parameter accepts multiple DLL paths and can be provided by property name. If no DLLs are specified, the cmdlet will enter interactive mode to prompt for input. Paths should be valid and accessible to the current user context. Providing a single string to this parameter instead of an array will result in the input being treated as an array with a single element.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="Name, PName"> <maml:name>ProcessName</maml:name> <maml:description> <maml:para>Specifies the name of the target process to inject DLLs into. This parameter is mandatory when using the 'pname' parameter set. When combined with the Wait switch, the cmdlet will wait for a process with this name to launch before attempting injection. This parameter cannot be used simultaneously with the `Id` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Timeout</maml:name> <maml:description> <maml:para>Specifies the maximum time (in seconds) to wait for a process to launch when using the `Wait` switch. This parameter only applies when the `Wait` switch and a process name is specified, and is ignored otherwise. If the target process does not launch within the specified timeout period, the cmdlet will terminate with an error. The default value is the maximum unsigned integer value for the current architecture.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">UIntPtr</command:parameterValue> <dev:type> <maml:name>UIntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>Maximum UInt value (platform-dependent)</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Wait</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should wait for the target process to launch before attempting injection. This switch is primarily useful when using the ProcessName parameter to specify a process by name. When enabled, the cmdlet will block and monitor for a process with the specified name to start, up to the timeout duration. This is useful for injecting into processes that are about to be launched.</maml:para> </maml:description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="proga"> <maml:name>ProgressAction</maml:name> <maml:description> <maml:para>Controls how progress messages are displayed. This is a common parameter available in PowerShell 7+.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">ActionPreference</command:parameterValue> <dev:type> <maml:name>ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> <command:syntaxItem> <maml:name>New-Injection</maml:name> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="AsAdmin, Administrator, AsAdministrator, Root"> <maml:name>Admin</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should attempt to elevate privileges and relaunch as administrator. When this switch is specified and the cmdlet is not already running with administrator privileges, it will attempt to relaunch itself in an elevated context, preserving the original command-line arguments. The cmdlet prefers using a sudo implementation if available, otherwise it falls back to the standard UAC prompt. If already running within an Administrator security context, this parameter is ignored.</maml:para> </maml:description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="ProcessId, PID"> <maml:name>Id</maml:name> <maml:description> <maml:para>Specifies the Process ID (PID) of the target process which will receive the injected DLLs/PE images. This parameter is mandatory when using the 'pid' parameter set. The process must be accessible and running for injection to succeed when using this parameter. This parameter cannot be used simultaneously with the `ProcessName` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">IntPtr</command:parameterValue> <dev:type> <maml:name>IntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Inject</maml:name> <maml:description> <maml:para>Specifies an array of file paths (or a single string) to DLL files that will be injected into the target process. This parameter accepts multiple DLL paths and can be provided by property name. If no DLLs are specified, the cmdlet will enter interactive mode to prompt for input. Paths should be valid and accessible to the current user context. Providing a single string to this parameter instead of an array will result in the input being treated as an array with a single element.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="Name, PName"> <maml:name>ProcessName</maml:name> <maml:description> <maml:para>Specifies the name of the target process to inject DLLs into. This parameter is mandatory when using the 'pname' parameter set. When combined with the Wait switch, the cmdlet will wait for a process with this name to launch before attempting injection. This parameter cannot be used simultaneously with the `Id` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Timeout</maml:name> <maml:description> <maml:para>Specifies the maximum time (in seconds) to wait for a process to launch when using the `Wait` switch. This parameter only applies when the `Wait` switch and a process name is specified, and is ignored otherwise. If the target process does not launch within the specified timeout period, the cmdlet will terminate with an error. The default value is the maximum unsigned integer value for the current architecture.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">UIntPtr</command:parameterValue> <dev:type> <maml:name>UIntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>Maximum UInt value (platform-dependent)</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Wait</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should wait for the target process to launch before attempting injection. This switch is primarily useful when using the ProcessName parameter to specify a process by name. When enabled, the cmdlet will block and monitor for a process with the specified name to start, up to the timeout duration. This is useful for injecting into processes that are about to be launched.</maml:para> </maml:description> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="proga"> <maml:name>ProgressAction</maml:name> <maml:description> <maml:para>Controls how progress messages are displayed. This is a common parameter available in PowerShell 7+.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">ActionPreference</command:parameterValue> <dev:type> <maml:name>ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:syntaxItem> </command:syntax> <command:parameters> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="AsAdmin, Administrator, AsAdministrator, Root"> <maml:name>Admin</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should attempt to elevate privileges and relaunch as administrator. When this switch is specified and the cmdlet is not already running with administrator privileges, it will attempt to relaunch itself in an elevated context, preserving the original command-line arguments. The cmdlet prefers using a sudo implementation if available, otherwise it falls back to the standard UAC prompt. If already running within an Administrator security context, this parameter is ignored.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="ProcessId, PID"> <maml:name>Id</maml:name> <maml:description> <maml:para>Specifies the Process ID (PID) of the target process which will receive the injected DLLs/PE images. This parameter is mandatory when using the 'pid' parameter set. The process must be accessible and running for injection to succeed when using this parameter. This parameter cannot be used simultaneously with the `ProcessName` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">IntPtr</command:parameterValue> <dev:type> <maml:name>IntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Inject</maml:name> <maml:description> <maml:para>Specifies an array of file paths (or a single string) to DLL files that will be injected into the target process. This parameter accepts multiple DLL paths and can be provided by property name. If no DLLs are specified, the cmdlet will enter interactive mode to prompt for input. Paths should be valid and accessible to the current user context. Providing a single string to this parameter instead of an array will result in the input being treated as an array with a single element.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String[]</command:parameterValue> <dev:type> <maml:name>String[]</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="Name, PName"> <maml:name>ProcessName</maml:name> <maml:description> <maml:para>Specifies the name of the target process to inject DLLs into. This parameter is mandatory when using the 'pname' parameter set. When combined with the Wait switch, the cmdlet will wait for a process with this name to launch before attempting injection. This parameter cannot be used simultaneously with the `Id` parameter in the same parameter set, unless the cmdlet is receiving input from the pipeline, such as output from the `Get-Process` cmdlet.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">String</command:parameterValue> <dev:type> <maml:name>String</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Timeout</maml:name> <maml:description> <maml:para>Specifies the maximum time (in seconds) to wait for a process to launch when using the `Wait` switch. This parameter only applies when the `Wait` switch and a process name is specified, and is ignored otherwise. If the target process does not launch within the specified timeout period, the cmdlet will terminate with an error. The default value is the maximum unsigned integer value for the current architecture.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">UIntPtr</command:parameterValue> <dev:type> <maml:name>UIntPtr</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>Maximum UInt value (platform-dependent)</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="named" aliases="none"> <maml:name>Wait</maml:name> <maml:description> <maml:para>Indicates whether the cmdlet should wait for the target process to launch before attempting injection. This switch is primarily useful when using the ProcessName parameter to specify a process by name. When enabled, the cmdlet will block and monitor for a process with the specified name to start, up to the timeout duration. This is useful for injecting into processes that are about to be launched.</maml:para> </maml:description> <command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue> <dev:type> <maml:name>SwitchParameter</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>False</dev:defaultValue> </command:parameter> <command:parameter required="false" variableLength="true" globbing="false" pipelineInput="False" position="named" aliases="proga"> <maml:name>ProgressAction</maml:name> <maml:description> <maml:para>Controls how progress messages are displayed. This is a common parameter available in PowerShell 7+.</maml:para> </maml:description> <command:parameterValue required="true" variableLength="false">ActionPreference</command:parameterValue> <dev:type> <maml:name>ActionPreference</maml:name> <maml:uri /> </dev:type> <dev:defaultValue>None</dev:defaultValue> </command:parameter> </command:parameters> <command:inputTypes> <command:inputType> <dev:type> <maml:name>System.String[]</maml:name> </dev:type> <maml:description> <maml:para>You can pipe an array of DLL file paths to this cmdlet.</maml:para> </maml:description> </command:inputType> <command:inputType> <dev:type> <maml:name>System.IntPtr</maml:name> </dev:type> <maml:description> <maml:para>You can pipe a process ID to this cmdlet.</maml:para> </maml:description> </command:inputType> <command:inputType> <dev:type> <maml:name>System.String</maml:name> </dev:type> <maml:description> <maml:para>You can pipe a process name to this cmdlet.</maml:para> </maml:description> </command:inputType> <command:inputType> <dev:type> <maml:name>System.Management.Automation.SwitchParameter</maml:name> </dev:type> <maml:description> <maml:para>You can pipe switch parameter values to this cmdlet.</maml:para> </maml:description> </command:inputType> <command:inputType> <dev:type> <maml:name>System.UIntPtr</maml:name> </dev:type> <maml:description> <maml:para>You can pipe an unsigned integer timeout value to this cmdlet.</maml:para> </maml:description> </command:inputType> </command:inputTypes> <command:returnValues> <command:returnValue> <dev:type> <maml:name>PSPhlebotomist.Core.PatientDiagnosis</maml:name> </dev:type> <maml:description> <maml:para>Returns a PatientDiagnosis object containing the results of the injection attempt(s), including injection success/failure status, target process information, error details (if any), and diagnostic information.</maml:para> </maml:description> </command:returnValue> </command:returnValues> <maml:alertSet> <maml:alert> <maml:para>- Thread safety is not guaranteed. Avoid concurrent invocations on the same process, although multiple DLL injections within the same cmdlet call are supported.</maml:para> <maml:para>- When privilege elevation is required, the cmdlet will attempt to use an available sudo implementation before falling back to the standard Windows UAC prompt.</maml:para> <maml:para>- If no parameters are provided (or only -Admin is specified), the cmdlet enters interactive mode.</maml:para> <maml:para>- This cmdlet uses the classic CreateRemoteThread approach via Windows API P/Invoke for DLL injection.</maml:para> <maml:para>- All handles are tracked and properly released regardless of success/failure to avoid memory leaks.</maml:para> <maml:para>- IMPORTANT: When piping input to this cmdlet as part of a pipeline, ensure that the filtering criteria in the cmdlet immediately prior to this cmdlet in the pipeline matches your intent. PowerShell will invoke this cmdlet FOR EACH element in the pipeline, so if you call `Get-Process "notepad.exe"` and there are 4 instances of `notepad.exe` running, this cmdlet will be called 4 TIMES and attempt to inject your DLLs into each running instance. If the intent is to inject into only one of the running processes, adjust your filtering criteria in or after `Get-Process` or other cmdlet to ensure only one object is returned. This is a behavior inherent to PowerShell's pipeline processing model and cannot be changed; it is not specific to this cmdlet.</maml:para> </maml:alert> </maml:alertSet> <command:examples> <command:example> <maml:title>-------------- Example 1: Injection by Process ID --------------</maml:title> <dev:code>PS C:\> New-Injection -Id 98472 -Inject "C:\path\to\my.dll"</dev:code> <dev:remarks> <maml:para>Injects the specified DLL into the process with ID 98472.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>------------- Example 2: Injection by Process Name -------------</maml:title> <dev:code>PS C:\> New-Injection -ProcessName "notepad" -Inject "C:\path\to\my.dll"</dev:code> <dev:remarks> <maml:para>Injects the specified DLL into a process named "notepad". The .exe extension is optional.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------------- Example 3: Multiple DLL injection --------------</maml:title> <dev:code>PS C:\> New-Injection -Id 9970 -Inject "C:\First.dll", "C:\Second.dll", "C:\Third.dll"</dev:code> <dev:remarks> <maml:para>Injects three DLLs into the process with ID 9970 in the specified order.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>Example 4: Multiple DLL injection, explicit PowerShell array syntax</maml:title> <dev:code>PS C:\> New-Injection -Id 9970 -Inject @("C:\First.dll", "C:\Second.dll", "C:\Third.dll")</dev:code> <dev:remarks> <maml:para>Injects three DLLs into the process with ID 9970 in the specified order, using explicit PowerShell array syntax.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------------- Example 5: Wait for process launch --------------</maml:title> <dev:code>PS C:\> New-Injection -ProcessName "target.exe" -Inject "C:\Your.dll" -Wait</dev:code> <dev:remarks> <maml:para>Waits indefinitely for a process named "target.exe" to start, then injects the DLL "C:\Your.dll" immediately upon launch.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>----------------- Example 6: Wait with timeout -----------------</maml:title> <dev:code>PS C:\> New-Injection -ProcessName "application.exe" -Inject "C:\intercept.dll" -Wait -Timeout 60</dev:code> <dev:remarks> <maml:para>Waits up to 60 seconds for a process named "application.exe" to start, then injects the DLL "C:\intercept.dll" immediately upon launch. If the target process is not detected after 60 seconds have elapsed, the command times out and the injection attempt is abandoned.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-- Example 7: Elevate privileges first, inject by Process ID --</maml:title> <dev:code>PS C:\> New-Injection -Id 9924 -Inject "C:\Your.dll" -Admin</dev:code> <dev:remarks> <maml:para>Relaunches the cmdlet with Administrator privileges, then injects the DLL "C:\Your.dll" into the process. If already running within an Administrator security context, this parameter is ignored.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>----------------- Example 8: Interactive mode -----------------</maml:title> <dev:code>PS C:\> New-Injection</dev:code> <dev:remarks> <maml:para>Enters interactive mode. You will be prompted step-by-step for all required information.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>-------- Example 9: Pipeline input (SEE NOTES SECTION) --------</maml:title> <dev:code>PS C:\> Get-Process notepad | New-Injection -Inject "C:\logger.dll"</dev:code> <dev:remarks> <maml:para>Accepts process information from the pipeline (specifically the `ProcessName` and `Id` attributes) and injects the DLL "C:\logger.dll" into ALL matching notepad processes. If you want to target a single instance of a process with multiple running threads, ensure your filter criteria in `Get-Process` (or other cmdlet) returns only a single object.</maml:para> </dev:remarks> </command:example> <command:example> <maml:title>------------------ Example 10: Using aliases ------------------</maml:title> <dev:code>PS C:\> New-Syringe -ProcessName "calc" -Inject "C:\hook.dll"</dev:code> <dev:remarks> <maml:para>Uses the 'New-Syringe' alias to inject a DLL into the calculator process.</maml:para> </dev:remarks> </command:example> </command:examples> <command:relatedLinks> <maml:navigationLink> <maml:linkText>Project Repository:</maml:linkText> <maml:uri>https://github.com/christopher-conley/PSPhlebotomist</maml:uri> </maml:navigationLink> <maml:navigationLink> <maml:linkText>Get-Process:</maml:linkText> <maml:uri>https://docs.microsoft.com/powershell/module/microsoft.powershell.management/get-process</maml:uri> </maml:navigationLink> </command:relatedLinks> </command:command> </helpItems> |