Certain binaries cannot be scanned

[ESIC-DA]

Hi

Get-PESecurity is a great tool, and it works well to scan a wide variety of EXEs and DLLs...I have one EXE that fails to scan (hasplms.exe sentinel security license manger) with the error at line 592:

"Cannot find type [PE.IMAGE_SECTION_HEADER, Win32, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null]: make sure the assembly containing this type is loaded."

Is there anything that can be done about that? I can send the EXE to someone for analysis if that's helpful.

Thanks in advance :)

-Dave

Edit: this is on a Server 2008R2 Standard 64bit machine with PowerShell 2.0 in case that makes any difference.

[ESIC-DA]

Although, if trying it in powershell directly after importing the module like this:

Get-PESecurity -File C:\Windows\system32\hasplms.exe -EA SilentlyContinue

I get output to the console:

FileName         : C:\Windows\system32\hasplms.exe
ARCH             : I386
DotNET           : False
ASLR             : False
DEP              : False
Authenticode     : True
StrongNaming     : N/A
SafeSEH          : False
ControlFlowGuard : False
HighentropyVA    : False

but if I call it from within a script like so

Import-Module .\Get-PESecurity.psm1    

$temporaryTestVar =$null
try 
{ 
    $temporaryTestVar=Get-PESecurity -File 'C:\Windows\system32\hasplms.exe' -EA SilentlyContinue
} 
catch { Write-Host ('Unable to scan file Error: {0}' -f @($Error[0])) }
if (!$temporayrTestVar) { write-host 'its null' }

which outputs this when run in ps2.0 on 2008r2:

>powershell.exe -file .\test.ps1
Unable to scan file Error: Cannot find type [PE.IMAGE_SECTION_HEADER, Win32, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null]: make sure the assembly containing this type is loaded.
its null

I get an exception thrown and end up in my catch with the $tmp set to $null ...but perhaps there's some facet of powershell exception handling I've missed. It wouldn't do me any good to remove it from this trycatch, as we're multiple levels of try deep while working on this line already.

[egru]

I'll take a look at it. I really haven't tried using it inside of another PowerShell script before.

[ESIC-DA]

Thanks so much! :)

-Dave