Powershell Format-Hex only one specific offset-CodePudding

(I'm not English. Hope you understand.)

Hi, is there any way to print only one specific offset e.g. 00735B24 with function Format-Hex in powershell?

CodePudding user response：

Open the file as a [FileStream] and read from the desired offset like this:

# define the offset   chunk size you want to read
$offset    = 0x00735B24
$chunkSize = 0x00000010

# Open file stream
$file = Get-Item $PathToFile
$filestream = $file.OpenRead()

# Move stream cursor to offset
[void]$filestream.Seek(0x00735B24, [System.IO.SeekOrigin]::Begin)

# Read a chunk into a buffer
$buffer = [byte[]]::new($chunkSize)
$readCount = $filestream.Read($buffer, 0, $buffer.Length)

# Close   dispose of file stream
$filestream.Dispose()

# Truncate buffer if file is smaller than desired chunk size
if($readCount -lt $buffer.Length){
  $tmp = [byte[]]::new($readCount)
  [Array]::Copy($buffer, $tmp, $readCount)
  $buffer = $tmp
}

# Format as hex view
$buffer |Format-Hex

CodePudding user response：

You can index into the bytes property to print as type [Byte]. I'll just make my own simple example. This prints the ascii code for 'a' in hex.

echo abcdefg | set-content file


get-content file | format-hex

           00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000   61 62 63 64 65 66 67                             abcdefg


$offset = 0x00
get-content file | format-hex | 
  foreach-object { $_.bytes[$offset] | % tostring x }

61 # 'a'