Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Extracts msobjs.dll message table strings
$Source = @'
using System;
using System.Runtime.InteropServices;
using System.Text;
public class Win32Native {
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
public static extern IntPtr LoadLibraryEx(string libFilename, IntPtr reserved, int flags);
[DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool FreeLibrary(IntPtr hModule);
[DllImport("kernel32.dll", BestFitMapping = true, CharSet = CharSet.Auto)]
public static extern int FormatMessage(int dwFlags, IntPtr lpSource, int dwMessageId, int dwLanguageId, StringBuilder lpBuffer, int nSize, IntPtr va_list_arguments);
}
'@
Add-Type -TypeDefinition $Source
function Get-MSObjsMessage {
param (
[Parameter(ValueFromPipeline)]
[Int[]]
$MessageIDs
)
BEGIN {
$LOAD_LIBRARY_AS_IMAGE_RESOURCE = 0x20
$hMSObjs = [Win32Native]::LoadLibraryEx('C:\Windows\System32\msobjs.dll', [IntPtr]::Zero, $LOAD_LIBRARY_AS_IMAGE_RESOURCE)
$StrBuilder = New-Object -TypeName System.Text.StringBuilder -ArgumentList 0x500
$FORMAT_MESSAGE_IGNORE_INSERTS = 0x200
$FORMAT_MESSAGE_FROM_HMODULE = 0x800
$FORMAT_MESSAGE_ALLOCATE_BUFFER = 0x1000
}
PROCESS {
foreach ($Id in $MessageIDs) {
$Result = [Win32Native]::FormatMessage(($FORMAT_MESSAGE_IGNORE_INSERTS -bor $FORMAT_MESSAGE_FROM_HMODULE -bor $FORMAT_MESSAGE_ALLOCATE_BUFFER), $hMSObjs, $Id, 0, $StrBuilder, $StrBuilder.Capacity, [IntPtr]::Zero)
if ($Result) { $StrBuilder.ToString() }
$null = $StrBuilder.Clear()
}
}
END {
$null = [Win32Native]::FreeLibrary($hMSObjs)
}
}
$ChannelMessageIDs = 0x1400..0x140F
$ChannelMessageIDs | Get-MSObjsMessage
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.