|
| 1 | +<# |
| 2 | +.Synopsis |
| 3 | + Registers or unregisters the PowerShell ETW manifest |
| 4 | +.Parameter Path |
| 5 | + The fully qualified path to the PowerShell.Core.Instrumentation.man manifest file. |
| 6 | + The default value is the location of this script. |
| 7 | +
|
| 8 | +.Parameter Unregister |
| 9 | + Specify to unregister the manifest. |
| 10 | +.Notes |
| 11 | + The PowerShell.Core.Instrumentation.man and PowerShell.Core.Instrumentation.dll files are |
| 12 | + expected to be at the location specified by the Path parameter. |
| 13 | + When registered, PowerShell.Core.Instrumentation.dll is locked to prevent deleting or changing. |
| 14 | + To update the binary, first unregister the manifest using the -Unregister switch. |
| 15 | +#> |
| 16 | +[CmdletBinding()] |
| 17 | +param |
| 18 | +( |
| 19 | + [ValidateNotNullOrEmpty()] |
| 20 | + [string] $Path = $PSScriptRoot, |
| 21 | + |
| 22 | + [switch] $Unregister |
| 23 | +) |
| 24 | +Set-StrictMode -Version Latest |
| 25 | +$ErrorActionPreference = 'Stop' |
| 26 | + |
| 27 | +function Start-NativeExecution([scriptblock]$sb, [switch]$IgnoreExitcode) |
| 28 | +{ |
| 29 | + $backupEAP = $script:ErrorActionPreference |
| 30 | + $script:ErrorActionPreference = "Continue" |
| 31 | + try |
| 32 | + { |
| 33 | + & $sb |
| 34 | + # note, if $sb doesn't have a native invocation, $LASTEXITCODE will |
| 35 | + # point to the obsolete value |
| 36 | + if ($LASTEXITCODE -ne 0 -and -not $IgnoreExitcode) |
| 37 | + { |
| 38 | + throw "Execution of {$sb} failed with exit code $LASTEXITCODE" |
| 39 | + } |
| 40 | + } |
| 41 | + finally |
| 42 | + { |
| 43 | + $script:ErrorActionPreference = $backupEAP |
| 44 | + } |
| 45 | +} |
| 46 | + |
| 47 | +function Test-Elevated |
| 48 | +{ |
| 49 | + [CmdletBinding()] |
| 50 | + [OutputType([bool])] |
| 51 | + Param() |
| 52 | + |
| 53 | + # if the current Powershell session was called with administrator privileges, |
| 54 | + # the Administrator Group's well-known SID will show up in the Groups for the current identity. |
| 55 | + # Note that the SID won't show up unless the process is elevated. |
| 56 | + return (([Security.Principal.WindowsIdentity]::GetCurrent()).Groups -contains "S-1-5-32-544") |
| 57 | +} |
| 58 | +$IsWindowsOs = $PSHOME.EndsWith('\WindowsPowerShell\v1.0', [System.StringComparison]::OrdinalIgnoreCase) -or $IsWindows |
| 59 | + |
| 60 | +if (-not $IsWindowsOs) |
| 61 | +{ |
| 62 | + throw 'This script must be run on Windows.' |
| 63 | +} |
| 64 | + |
| 65 | +if (-not (Test-Elevated)) |
| 66 | +{ |
| 67 | + throw 'This script must be run from an elevated process.' |
| 68 | +} |
| 69 | + |
| 70 | +$manifest = Get-Item -Path (Join-Path -Path $Path -ChildPath 'PowerShell.Core.Instrumentation.man') |
| 71 | +$binary = Get-Item -Path (Join-Path -Path $Path -ChildPath 'PowerShell.Core.Instrumentation.dll') |
| 72 | + |
| 73 | +$files = @($manifest, $binary) |
| 74 | +foreach ($file in $files) |
| 75 | +{ |
| 76 | + if (-not (Test-Path -Path $file)) |
| 77 | + { |
| 78 | + throw "Could not find $($file.Name) at $Path" |
| 79 | + } |
| 80 | +} |
| 81 | + |
| 82 | +[string] $command = "wevtutil um {0}" -f $manifest.FullName |
| 83 | + |
| 84 | +# Unregister if present. Avoids warnings when registering the manifest |
| 85 | +# and it is already registered. |
| 86 | +Write-Verbose "unregister the manifest, if present: $command" |
| 87 | +Start-NativeExecution {Invoke-Expression $command} $true |
| 88 | + |
| 89 | +if (-not $Unregister) |
| 90 | +{ |
| 91 | + $command = "wevtutil.exe im {0} /rf:{1} /mf:{1}" -f $manifest.FullName, $binary.FullName |
| 92 | + Write-Verbose -Message "Register the manifest: $command" |
| 93 | + Start-NativeExecution { Invoke-Expression $command } |
| 94 | +} |
0 commit comments