Lee Holmes

In 1799, Napoleon’s explorers discovered a 4-foot tall, 700 lb stone slab in Rosetta (Rashid), Egypt. It was carved with three sections of writing. Two were well known to archaeologists: Demotic script, and ancient Greek (Coptic). The most interesting part - the hieroglyphic symbols - were also very well known to the scientific community. But they were also a great mystery. All attempts to decipher hieroglyphic …

If you’ve ever been interested in having all of Wikipedia in a plain-text format, you might have been disappointed to learn that Wikipedia doesn’t actually make this format available. Fortunately, they do offer an XML version of the entire database, so I’ve written a PowerShell script to convert that XML dump into individual plain-text articles. The script tries to remove as much of …

Edit: If you want to see how deep this rabbit hole goes, check out our Black Hat / DEF CON presentation: https://www.youtube.com/watch?v=x97ejtv56xw

In a recent post, we talked a little bit about detecting obfuscated PowerShell through the use of PowerShell’s tokenizer - tackling, as an example, the highly irregular variable names generated by MetaSploit’s PowerShell encoder. Obfuscation has been around as …

In preparation for some upcoming presentations, I wanted to make some images of the current Fortune 500 logos. No such resource existed, so now it does.

The attached ZIP has:

• Logos for the Fortune 500, numbered by their position
• A PowerPoint deck with a slide where they are composed together
• An image of the logos in a grid
• An image of the logos in a grid, with a “Fortune 500” logo on top.

Link: …

I recently had my HP Photosmart Premium stop working. Initially, it failed with an error message requesting that I clear the carriage jam. This was caused by the carriage being stuck at the far right of the printer where it normally goes to clean the print head.

The carriage was stuck enough that moving it with my hands didn’t work. When I took the sides of the printer off, there was a movable plate stuck below the …

Edit: If you want to see how deep this rabbit hole goes, check out our Black Hat / DEF CON presentation: https://www.youtube.com/watch?v=x97ejtv56xw

I was recently looking at a sample that was encoded using MSF’s basic template obfuscation (stolen without attribution from Matt Graeber of course): …

We had an interesting discussion at work the other day about how to launch modern Windows applications from the command line.

There are a few solutions out there (Tome’s is close), although few of them are happy with their results :)

Many of them rely on protocol handlers (i.e.: “start bingnews://”), but that means memorizing a bunch of protocol handler prefixes.

Tome’s blog mentions the Get-AppxPackage cmdlet – the …

I got a question today about the handwriting recognition capabilities of my ScanSnap ix500. I’m still madly in love with the ScanSnap for paperwork and automatic document filing, but handwriting isn’t its strong point. Here’s an example document I scanned:

Here’s what was recognized:

e//o vjon ‘anreo/ia//po/n/ 0 V/or d reqw ar 3a eilo yor, c 0 Worio /C Ol2 “po/yi //e[[o is/oMiiaftc …

We recently had a customer question where they were concerned that some commands might be typed accidentally and end up causing significant disruption. In general, commands that fit that classification include a confirmation message to warn you, but sometimes you just don’t agree with what the cmdlet author thought was a high-impact action. While Restart-Computer might be a day-to-day operation for some servers, it …

If you’ve been using PowerShell for long, you are probably familiar with the concept of wildcards. At the very least, you’ve done something like this:

PS C:\temp> dir *.txt

    Directory: C:\temp

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-a---         1/21/2015  10:01 AM        664 test.txt 

Or perhaps you’ve taken a lap or two around about_wildcards and …