2

I have a PowerShell command that looks like this: Get-WmiObject -Query "SELECT CommandLine FROM Win32_Process WHERE Name LIKE ""%Java%"" AND CommandLine LIKE ""%accessToken%"""

My attempt at transforming this to C# looks like this

using System.Management.Automation;
using System.Management.Automation.Runspaces;

String a = String.Format("Get-WmiObject -Query \"SELECT CommandLine FROM Win32_Process WHERE Name LIKE \"\" % Java % \"\" AND CommandLine LIKE \"\" % accessToken % \"\"\"");
Console.WriteLine(getToken(a));

private string getToken(string script)
{
    Runspace runspace = RunspaceFactory.CreateRunspace();
    runspace.Open();
    Pipeline pipeline = runspace.CreatePipeline();
    pipeline.Commands.AddScript(script);
    pipeline.Commands.Add("Out-String");
    Collection<PSObject> results = pipeline.Invoke();
    runspace.Close();
    StringBuilder stringBuilder = new StringBuilder();
    foreach (PSObject pSObject in results)
        stringBuilder.AppendLine(pSObject.ToString());
    return stringBuilder.ToString();
}

This method only works when there are no parameters so for example if you just want Get-WmiObject

Any help is apreciated!

Henktorius
  • 23
  • 4
  • 2
    One option may be to skip the PowerShell intermediary and use System.Management.Infrastructure directly https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-with-c- – Flydog57 Jul 03 '22 at 22:53
  • Does this answer your question? [Invoking PowerShell Script with Arguments from C#](https://stackoverflow.com/questions/10260597/invoking-powershell-script-with-arguments-from-c-sharp) – Charlieface Jul 03 '22 at 22:57
  • I recently had similar issues. The double quotes were giving issues. Finally broke code into smaller pieces so I didn't have to use double quotes inside double quotes. I also change in some cases double quotes to single quotes. – jdweng Jul 04 '22 at 00:09
  • It looks like the spaces around the `%` instances shouldn't be there. – mklement0 Jul 04 '22 at 02:50
  • As an aside: The CIM cmdlets (e.g., `Get-CimInstance`) superseded the WMI cmdlets (e.g., `Get-WmiObject`) in PowerShell v3 (released in September 2012). Therefore, the WMI cmdlets should be avoided, not least because PowerShell (Core) v6+, where all future effort will go, doesn't even _have_ them anymore. Note that WMI still _underlies_ the CIM cmdlets, however. For more information, see [this answer](https://stackoverflow.com/a/54508009/45375). – mklement0 Jul 04 '22 at 02:50

1 Answers1

0

Since PowerShell accepts using single quotes inside of double quotes using single quotes will clean this up some. Also, if you are looking only for the CommandLine value you should pipe the results to Select-Object -ExpandPropery CommandLine so that only the value of CommandLine is returned rather than objects with additional properties.

String query = "SELECT CommandLine FROM Win32_Process WHERE Name LIKE '%Java%' AND CommandLine LIKE '%accessToken%'";
String a = $"Get-CimInstance -Query \"{query}\" | Select-Object -ExpandProperty CommandLine";
Daniel
  • 4,792
  • 2
  • 7
  • 20