I need help with this Get-ChildItem script.

Question

I need help with this Get-ChildItem script.

IT-User9733 71

Hi I need help with this Get-ChildItem script.

I believe that it was created to look for an instance of the JndiLookup.class in the C:\

gci 'C:\' -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path

This is how I interpret it.

get child item, recurse all directories and inc hidden and system files, look for all .jar files, and continue on any errors.
select string "JndiLookup.class", and select all the current attributes and export the path to the screen.

Am I wrong?

Thanks

CASlim 1 Reputation point

2021-12-31T01:34:28.18+00:00

Your explanation doesn't describe what the select-string is doing.

What you described is what only the first part does: "gci 'C:\' -rec -force -include *.jar -ea 0"

If you run that in PowerShell you will see that it finds the JAR files just using that.

The foreach {select-string "JndiLookup.class" $_} portion then takes each file found and uses the SELECT-STRING to search IN each JAR file found for the 'JndiLookup.class' TEXT (not filename).
If found, Select-String then returns a MATCH OBJECT which is then used to output the PATH.
This part is missing in the version from Rich - which is why it didn't work.

As Limitless said you can use the -filter instead of -include and it is more efficient because it will filter out all other file types at the start of processing.

You can also add the -List attribute to Select-String so that it will stop searching the file at the first occurrence found in the file and not keep searching (you probably only care that it was found in the file - not how many times it was found).

gci 'C:\' -rec -force -filter *.jar -ea 0 | foreach {select-string "JndiLookup.class" -List $_} | select -exp Path
CASlim 1 Reputation point

2021-12-31T01:47:21.633+00:00

Also note that will probably NOT find the jndilookup text in JAR files IN a JAR file because the JAR file in a JAR file is compressed a second time and the text is not searchable.

2 answers

Your answer

CASlim 1 Reputation point

2021-12-31T01:34:28.18+00:00

Your explanation doesn't describe what the select-string is doing.

What you described is what only the first part does: "gci 'C:\' -rec -force -include *.jar -ea 0"

If you run that in PowerShell you will see that it finds the JAR files just using that.

The foreach {select-string "JndiLookup.class" $_} portion then takes each file found and uses the SELECT-STRING to search IN each JAR file found for the 'JndiLookup.class' TEXT (not filename).
If found, Select-String then returns a MATCH OBJECT which is then used to output the PATH.
This part is missing in the version from Rich - which is why it didn't work.

As Limitless said you can use the -filter instead of -include and it is more efficient because it will filter out all other file types at the start of processing.

You can also add the -List attribute to Select-String so that it will stop searching the file at the first occurrence found in the file and not keep searching (you probably only care that it was found in the file - not how many times it was found).

gci 'C:\' -rec -force -filter *.jar -ea 0 | foreach {select-string "JndiLookup.class" -List $_} | select -exp Path
CASlim 1 Reputation point

2021-12-31T01:47:21.633+00:00

Also note that will probably NOT find the jndilookup text in JAR files IN a JAR file because the JAR file in a JAR file is compressed a second time and the text is not searchable.

Answer 1

Rich Matheisen 47,901

You'd be correct if you didn't use the "-Include" parameter. Once you use that you have to change the "-Path" parameter value to include, say, an asterisk in this case.

Also, the Get-ChildItem cmdlet doesn't produce a string, it creates an object.

This is probably what you'd want:

Get-ChildItem -Path C:\* -Recurse -Force -Include *.jar -ErrorAction 0 | 
    Where-Object {$_.Name -eq "JndiLookup.class"} | 
        Select-Object -Expand Path

IT-User9733 71 Reputation points

2021-12-15T18:14:12.59+00:00

@Rich Matheisen Thank you.

I like the look of your script and I just ran it on my machine but it didn't manage to find anything.

Here is what the other version returned.

Thanks
Rich Matheisen 47,901 Reputation points

2021-12-15T20:14:33.8+00:00

I have neither Java nor any jar files on my machine!

If you were to use "Get-ChildItem c:......\PAD.JavaBridge.jar", do you get just one item retuned? Is it a File or Directory? Or do you get all the files in the jar file returned? If you add "-Recurse" what do you get?

Also, if you examine a JAR file that has other JAR files in it, do you also find the files in the embedded JAR?

Answer 2

Limitless Technology 39,916

Hi @IT-User9733

No, you need a force parameter to display hidden files.
You can get all items directly within a folder by using Get-ChildItem. Add the optional Force parameter to display hidden or system items.

Get-ChildItem can filter items with its Path, Filter, Include, and Exclude parameters, but those are typically based only on name. You can perform complex filtering based on other properties of items by using Where-Object.

Get-ChildItem doesn't display empty directories. When a Get-ChildItem command includes the Depth or Recurse parameters, empty directories aren't included in the output.

Hope this resolves your Query!!

---------------

--If the reply is helpful, please Upvote and Accept it as an answer--

IT-User9733 71 Reputation points

2021-12-15T18:15:25.073+00:00

@Limitless Technology Thank you for your reply. That was really helpful.

Share via

I need help with this Get-ChildItem script.

2 answers

Your answer