Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save CaledoniaProject/0a5293cee63e4b5c14c2846b4cb77598 to your computer and use it in GitHub Desktop.
Save CaledoniaProject/0a5293cee63e4b5c14c2846b4cb77598 to your computer and use it in GitHub Desktop.
If you have the HgsDiagnostics PowerShell module, then you can parse TCG logs.
Import-Module HgsDiagnostics
$GetHgsTrace = Get-Command Get-HgsTrace
$RemoteAttestationCoreReference = $GetHgsTrace.ImplementingType.Assembly.GetReferencedAssemblies() | Where-Object { $_.Name -eq 'Microsoft.Windows.RemoteAttestation.Core' }
Add-Type -AssemblyName $RemoteAttestationCoreReference.FullName
$MostRecentTCGLog = Get-ChildItem C:\Windows\Logs\MeasuredBoot | Sort-Object -Property LastWriteTime -Descending | Select-Object -First 1 | Select-Object -ExpandProperty FullName
$LogBytes = [IO.File]::ReadAllBytes($MostRecentTCGLog)
$ParsedTCGLog = [Microsoft.Windows.RemoteAttestation.Core.TcgEventLog]::Parse($LogBytes)
$ParsedTCGLog.TcgData.Children | Sort-Object -Property PcrIndex | Group-Object -Property PcrIndex
$XmlWriterSettings = New-Object -TypeName System.Xml.XmlWriterSettings
$XmlWriterSettings.Indent = $True
$TcgContentSettings = New-Object -TypeName Microsoft.Windows.RemoteAttestation.Core.TcgContentSettings
$XmlWriter = [Xml.XmlWriter]::Create("$PWD\parsed_tcg_log.xml", $XmlWriterSettings)
$ParsedTCGLog.ToXml($XmlWriter, $TcgContentSettings)
$XmlWriter.Close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment