GetStringHeapObjects.ps1

# Recovering strings objects from .NET Heap
# Using clrMD "Microsoft.Diagnostics.Runtime.dll" - https://github.com/microsoft/clrmd
# Use 32-bit PowerShell to investigate 32-bit process and 64-bit PowerShell to investigate 64-bit process

[System.Reflection.Assembly]::LoadFile([System.IO.Path]::GetFullPath("Microsoft.Diagnostics.Runtime.dll")) | Out-Null
$processID = (Get-Process -Name "TestStrings_confused").Id
$dataTarget = [Microsoft.Diagnostics.Runtime.DataTarget]::AttachToProcess($processID, $false)
$clrInfo = $dataTarget.ClrVersions[0]
$clrRuntime = $clrInfo.CreateRuntime()
$objects = $clrRuntime.Heap.EnumerateObjects().Where{$_.Type.IsString}
$defaultState = $objects.ForEach{$_.AsString()}
$defaultState
Start-Sleep 1

0..100 | ForEach-Object {
    $clrRuntime = $clrInfo.CreateRuntime()
    $objects = $clrRuntime.Heap.EnumerateObjects().Where{$_.Type.IsString}
    $newState = $objects.ForEach{$_.AsString()}

    if(Compare-Object -ReferenceObject $defaultState -DifferenceObject $newState)
    {
        Compare-Object -ReferenceObject $defaultState -DifferenceObject $newState -PassThru
        $defaultState = $newState
    }
    Start-Sleep 1
}