Surgical .NET Dissection - Using PowerShell Proxy Functions to Extend Get-Member

Download: 'Get-Member' proxy function

tl:dr version

Using proxy functions in PowerShell, a '-Private' parameter can be added to the Get-Member cmdlet which will expose all non-public .NET members. This feature is ideal for those interested in hacking, researching or tearing apart the .NET framework.

---

In previous posts, I've mentioned methods to expose private types and members in .NET with PowerShell. Leveraging these techniques creatively require at least a basic knowledge of reflection and .NET internals. These techniques also consume a lot of keystrokes. After reading an excellent introduction to proxy functions, I learned that any existing cmdlet can be added to or subtracted from. This inspired me to extend the Get-Member cmdlet.

Before proceeding in this article, it is recommended that you become familiar with proxy functions.

For those PowerShell users who have been living under a rock, Get-Member is a required cmdlet to be familiar with. It prints all public members (properties, methods, events, etc.) of both instance and static types. For example, the following command will return all the public and static members of the System.Convert class:

PS> [Convert] | Get-Member -Static

   TypeName: System.Convert

Name                MemberType Definition
----                ---------- ----------
DBNull              Property   static System.Object DBNull {get;}
ChangeType          Method     static System.Object ChangeType(System.Object value, System.Ty...
Equals              Method     static bool Equals(System.Object objA, System.Object objB)
FromBase64CharArray Method     static byte[] FromBase64CharArray(char[] inArray, int offset, ...
FromBase64String    Method     static byte[] FromBase64String(string s)
GetTypeCode         Method     static System.TypeCode GetTypeCode(System.Object value)
IsDBNull            Method     static bool IsDBNull(System.Object value)
ReferenceEquals     Method     static bool ReferenceEquals(System.Object objA, System.Object ...
ToBase64CharArray   Method     static int ToBase64CharArray(byte[] inArray, int offsetIn, int...
ToBase64String      Method     static string ToBase64String(byte[] inArray), static string To...
ToBoolean           Method     static bool ToBoolean(System.Object value), static bool ToBool...
ToByte              Method     static byte ToByte(System.Object value), static byte ToByte(Sy...
ToChar              Method     static char ToChar(System.Object value), static char ToChar(Sy...
ToDateTime          Method     static System.DateTime ToDateTime(System.DateTime value), stat...
ToDecimal           Method     static decimal ToDecimal(System.Object value), static decimal ...
ToDouble            Method     static double ToDouble(System.Object value), static double ToD...
ToInt16             Method     static System.Int16 ToInt16(System.Object value), static Syste...
ToInt32             Method     static int ToInt32(System.Object value), static int ToInt32(Sy...
ToInt64             Method     static long ToInt64(System.Object value), static long ToInt64(...
ToSByte             Method     static System.SByte ToSByte(System.Object value), static Syste...
ToSingle            Method     static float ToSingle(System.Object value), static float ToSin...
ToString            Method     static string ToString(System.Object value), static string ToS...
ToUInt16            Method     static System.UInt16 ToUInt16(System.Object value), static Sys...
ToUInt32            Method     static System.UInt32 ToUInt32(System.Object value), static Sys...
ToUInt64            Method     static System.UInt64 ToUInt64(System.Object value), static Sys...

The Get-Member cmdlet returns objects of the type System.Management.Automation.PSMemberTypes consisting of the following parameters and types:

      Name - String
  Typename - String
MemberType - System.Management.Automation.PSMemberTypes
Definition - String

What you're not seeing in the output above are all of the non-public members. There is a valid reason for this - there is no way to directly access them and most people don't care to see that which they cannot touch. I, on the other hand enjoy touching one's private members... of .NET objects. ;D So I modified Get-Member to produce the following:

PS> [Convert] | Get-Member -Static -Private -Force

   TypeName: System.Convert

Name                  MemberType  Definition
----                  ----------  ----------
.cctor                Constructor static .cctor()
base64Table           Field       static char[]
ConvertTypes          Field       static type[]
EnumType              Field       static type
CalculateOutputLength Method      static int CalculateOutputLength(System.Int32, System.Boolean)
ConvertToBase64Array  Method      static int ConvertToBase64Array(System.Char*, System.Byte*, System....
DefaultToType         Method      static System.Object DefaultToType(System.IConvertible, System.Type...

Adding the '-Private' parameter was no trivial matter. First of all, the MemberType field of the Get-Member output is problematic because non-public members use member types from the System.Reflection.MemberTypes class, not System.Management.Automation.PSMemberTypes. What I did to resolve this was convert the output to custom PSObjects with the same properties of the Get-Member output. This was achieved in the following code snippet:

$Results = foreach ($Type in $TypeTable.Keys) {
$ReturnType = @{
        TypeName = $TypeTable[$Type][0].TypeName
        Name = $TypeTable[$Type][0].Name
        MemberType = $TypeTable[$Type][0].MemberType
        Definition = ($TypeTable[$Type] | ForEach-Object { $_.Definition }) -join ', '
    }
                  
$MemberDef = New-Object PSObject -Property $ReturnType
$MemberDef.PSObject.TypeNames.Insert(0, 'Microsoft.PowerShell.Commands.MemberDefinition')
$MemberDef
}

The PSObject.TypeNames.Insert method was used to trick PowerShell into thinking that my custom object was a MemberDefinition object when it got output to the console. This trick is possible because a custom view for Microsoft.PowerShell.Commands.MemberDefinition is defined in PowerShellCore.format.ps1xml.

To install the proxy function, you can do any of the following:

1) Install in your current session:

PS> . .\Get-Member.ps1

2) Persistant install:

* I placed the script in the same folder as my profile.ps1 script and added this line:

. (Join-Path (Split-Path $PROFILE) Get-Member.ps1)

As usual, let me know if you have any questions or bug reports. For all other PowerShell related questions, Get-Help is your friend. Also, the modified Get-Member is fully documented via `help Get-Member -Full -Category function`.

As a final exercise, I encourage everyone to try out the following commands and observe the interesting results:

PS> [AppDomain]::CurrentDomain.GetAssemblies() | % {$_.GetTypes()} | % {$_ | Get-Member -Private -Force}
PS> [AppDomain]::CurrentDomain.GetAssemblies() | % {$_.GetTypes()} | % {$_ | Get-Member -Private -Static -Force}