差别
这里会显示出您选择的修订版和当前版本之间的差别。
两侧同时换到之前的修订记录前一修订版 | |||
itwiki:windows-powershell [2024/01/06 06:23] – 修改小标题 ovwx@live.io | itwiki:windows-powershell [Unknown date] (当前版本) – 移除 - 外部编辑 (Unknown date) 127.0.0.1 | ||
---|---|---|---|
行 1: | 行 1: | ||
- | ====== Windows Powershell 基本使用 ====== | ||
- | |||
- | ====== 实现操作系统功能 ====== | ||
- | |||
- | ===== 进程管理 ===== | ||
- | |||
- | ==== 启动进程 ==== | ||
- | |||
- | PowerShell 指定工作目录并隐藏窗口 | ||
- | |||
- | < | ||
- | Powershell -WindowStyle Hidden -command start -WindowStyle Hidden -WorkingDirectory C: | ||
- | </ | ||
- | |||
- | * -WindowStyle 窗口风格, | ||
- | * -WorkingDirectory 工作目录 | ||
- | * -Arg arg1, | ||
- | * -RedirectStandardOutput 将标准输出重定向到文件,适合于需要保存控制台输出为日志的文件 | ||
- | |||
- | 修改窗口风格是为了使得程序隐藏运行,因为一个命令行程序不隐藏运行会有一个黑乎乎的窗口,看着不好。 | ||
- | |||
- | 修改工作目录是有些应用会在工作目录下读取配置文件,指定工作目录是为了让 当前目录、上级目录 等标识符起作用,这样就不用在命令行参数传递长长的配置文件名 | ||
- | |||
- | 单独传参数表是因为有些命令行程序可能不止接收一个参数,直接放在Start-Process 可执行文件后面可能会无法工作 | ||
- | |||
- | ===== 文件管理 ===== | ||
- | |||
- | ==== 搜索文件 ==== | ||
- | |||
- | < | ||
- | Get-ChildItem *.txt | select-string " | ||
- | </ | ||
- | |||
- | ===== Windows 防火墙管理 ===== | ||
- | |||
- | ==== 新建规则 ==== | ||
- | |||
- | < | ||
- | New-NetFirewallRule -Name sshd -DisplayName " | ||
- | </ | ||
- | |||
- | * -Name 名称 | ||
- | * -DisplayName 显示名称(控制面板-防火墙显示名称) | ||
- | * -Description 描述 | ||
- | * -Profile 指规则生效的范围,Public-公共,Private-专用, | ||
- | * -Enabled 是否启用 | ||
- | * -Direction Inbound/ | ||
- | * -Protocol Tcp/udp | ||
- | * -LocalPort 22 22号端口 | ||
- | * -Action Allow/Deny 允许或拒绝 | ||
- | |||
- | ==== 允许应用程序经过防火墙 ==== | ||
- | |||
- | < | ||
- | # 提供3个必选参数即可 | ||
- | New-NetFirewallRule -DisplayName Notebook -Program ' | ||
- | Get-NetFirewallApplicationFilter | where-object -property Program -match Notepad | ||
- | Remove-NetFirewallRule -DisplayName Notebook | ||
- | </ | ||
- | |||
- | ==== 查询规则 ==== | ||
- | |||
- | |||
- | 注:查询规则时不会显示具体的规则内容,要用下面的 Get-XXXFilter 系列命令才可以) | ||
- | |||
- | < | ||
- | Get-NetFirewallRule | ||
- | Get-NetFirewallAddressFilter | ||
- | Get-NetFirewallPortFilter | ||
- | Get-NetFirewallApplicationFilter | ||
- | |||
- | </ | ||
- | |||
- | ===== 磁盘:虚拟磁盘管理 ===== | ||
- | |||
- | DISKPART | ||
- | |||
- | < | ||
- | diskpart | ||
- | create vdisk file=" | ||
- | select vdisk file=" | ||
- | attach vdisk # | ||
- | list vdisk # | ||
- | create partition primary # | ||
- | format fs=ntfs label=" | ||
- | assign letter=m # | ||
- | |||
- | </ | ||
- | |||
- | < | ||
- | # Powershell 命令 | ||
- | mount-diskimage -imagePath d: | ||
- | </ | ||
- | |||
- | ====== 内置库和三方库(.NET) ====== | ||
- | |||
- | ===== .NET事件:文件变化监控 ===== | ||
- | |||
- | < | ||
- | # 以下代码监控D: | ||
- | $path = " | ||
- | $w=new-object io.filesystemwatcher | ||
- | $w.path=$path | ||
- | $w.filter=" | ||
- | register-objectevent $w Changed -action { | ||
- | write-host $event.sourceeventargs.fullpath | ||
- | write-host $event.sourceeventargs | get-member | ||
- | } # | ||
- | </ | ||
- | |||
- | ===== 文件变化轮询:有变化就输出变化 ===== | ||
- | |||
- | < | ||
- | $folder = ' | ||
- | # 定义每次监控的间隔时间,这时定义为1000毫秒,即1秒 | ||
- | $timeout = 1000 | ||
- | # 创建文件系统监视对象 | ||
- | $FileSystemWatcher = New-Object System.IO.FileSystemWatcher $folder | ||
- | Write-Host ”按 CTRL+C 来退出对文件夹 $folder 的监控” | ||
- | while ($true) { | ||
- | # 监控文件夹内的所有变化 | ||
- | $result = $FileSystemWatcher.WaitForChanged(' | ||
- | if ($result.TimedOut -eq $false) | ||
- | { | ||
- | # 当文件夹的内容变化时,发出警告提示 | ||
- | | ||
- | } | ||
- | } | ||
- | Write-Host ' | ||
- | </ | ||
- | |||
- | ===== 文件监控样例: | ||
- | |||
- | < | ||
- | ### SET FOLDER TO WATCH + FILES TO WATCH + SUBFOLDERS YES/NO | ||
- | $watcher = New-Object System.IO.FileSystemWatcher | ||
- | $watcher.Path = " | ||
- | $watcher.Filter = " | ||
- | $watcher.IncludeSubdirectories = $true | ||
- | $watcher.EnableRaisingEvents = $true | ||
- | |||
- | ### DEFINE ACTIONS AFTER AN EVENT IS DETECTED | ||
- | $action = { $path = $Event.SourceEventArgs.FullPath | ||
- | $changeType = $Event.SourceEventArgs.ChangeType | ||
- | $logline = " | ||
- | Add-content " | ||
- | } | ||
- | ### DECIDE WHICH EVENTS SHOULD BE WATCHED | ||
- | Register-ObjectEvent $watcher " | ||
- | Register-ObjectEvent $watcher " | ||
- | Register-ObjectEvent $watcher " | ||
- | Register-ObjectEvent $watcher " | ||
- | while ($true) {sleep 5} | ||
- | |||
- | </ | ||
- | |||
- | ===== 正则表达式 ===== | ||
- | |||
- | < | ||
- | $rawtext = " | ||
- | $rawtext -match " | ||
- | $regex = [regex]" | ||
- | $regex.Matches($rawtext) # | ||
- | |||
- | $domaintest = " | ||
- | $domainreg = [regex]" | ||
- | $domainreg.matches($domaintest).value | ||
- | </ | ||
- | |||
- | ==== 常见正则 ==== | ||
- | |||
- | * 匹配邮箱:`$email = [regex]" | ||
- | * 匹配域名:`$domain = [regex]" | ||
- | |||
- | |||
- | ====== 语法 ====== | ||
- | |||
- | ===== 参数和字典 ===== | ||
- | |||
- | < | ||
- | $array1 = ' | ||
- | $array[4] = ' | ||
- | $dict = @{ | ||
- | key1 = ' | ||
- | key2 = ' | ||
- | key3 = ' | ||
- | } | ||
- | $dict.key4 = ' | ||
- | |||
- | Write-Output $dict[' | ||
- | Write-Output $dict.key1 | ||
- | Write-Output $array1[0] | ||
- | |||
- | </ | ||
- | |||
- | |||
- | ====== 杂项 ====== | ||
- | |||
- | Powershell 内容显示不全(有省略号)的处理方法 | ||
- | |||
- | < | ||
- | # 修改变量 | ||
- | $FormatEnumerationLimit = -1 | ||
- | # 使用WRAP选项输出结果 | ||
- | Get-Process -Name dllhost | Select -Property Modules | Format-Table -Wrap | ||
- | </ | ||
- | |||
- | ===== 绕过权限限制执行PS1脚本 ===== | ||
- | |||
- | 主要是注册表写启动项 | ||
- | < | ||
- | Powershell -file xxx.ps1 -ExecutionPolicy ByPass # | ||
- | Powershell -C " | ||
- | </ | ||
- | |||
- | ===== 系统自带屏幕记录器 ===== | ||
- | |||
- | |||
- | 可用作录制操作手册 #cmd | ||
- | |||
- | < | ||
- | psr.exe | ||
- | /start /output d:\step.zip 开始录制,并保存到d: | ||
- | /stop 停止录制 | ||
- | /gui 0 显示软件界面,如果需要显示软件界面,就使用 /gui 1 或者省略该参数 | ||
- | /maxsc 10 最大截图数量 | ||
- | </ | ||
- | |||