Skip to content

Instantly share code, notes, and snippets.

@mattifestation
Last active April 14, 2019 01:43
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save mattifestation/706a8bc40b3d5ea0eab016d5de5c23c3 to your computer and use it in GitHub Desktop.
Save mattifestation/706a8bc40b3d5ea0eab016d5de5c23c3 to your computer and use it in GitHub Desktop.
If you have the HgsDiagnostics PowerShell module, then you can parse TCG logs.
Import-Module HgsDiagnostics
$GetHgsTrace = Get-Command Get-HgsTrace
$RemoteAttestationCoreReference = $GetHgsTrace.ImplementingType.Assembly.GetReferencedAssemblies() | Where-Object { $_.Name -eq 'Microsoft.Windows.RemoteAttestation.Core' }
Add-Type -AssemblyName $RemoteAttestationCoreReference.FullName
$MostRecentTCGLog = Get-ChildItem C:\Windows\Logs\MeasuredBoot | Sort-Object -Property LastWriteTime -Descending | Select-Object -First 1 | Select-Object -ExpandProperty FullName
$LogBytes = [IO.File]::ReadAllBytes($MostRecentTCGLog)
$ParsedTCGLog = [Microsoft.Windows.RemoteAttestation.Core.TcgEventLog]::Parse($LogBytes)
$ParsedTCGLog.TcgData.Children | Sort-Object -Property PcrIndex | Group-Object -Property PcrIndex
$XmlWriterSettings = New-Object -TypeName System.Xml.XmlWriterSettings
$XmlWriterSettings.Indent = $True
$TcgContentSettings = New-Object -TypeName Microsoft.Windows.RemoteAttestation.Core.TcgContentSettings
$XmlWriter = [Xml.XmlWriter]::Create("$PWD\parsed_tcg_log.xml", $XmlWriterSettings)
$ParsedTCGLog.ToXml($XmlWriter, $TcgContentSettings)
$XmlWriter.Close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment