etc/parser/test_golang.ps1
|
function Test-Golang { [CmdletBinding()] param( [Parameter(Mandatory)] [ValidateScript({!!($script:file = Convert-Path -Path $_ -ErrorAction 0)})] [ValidateNotNullOrEmpty()] [String]$Path ) end { $offset = (Get-PeHeaders -Path ($Path = $file) | Out-String | Select-String '\.text(\s+([^\s]\w+)){4}' ).Matches.Groups[2].Value -join(Format-Hex -Path $Path -Offset "0x$offset" -Count 13).Bytes.ForEach{ "\x$($_.ToString('x'))" } -eq '\xff\x20\x47\x6f\x20\x62\x75\x69\x6c\x64\x20\x49\x44' } } |