capstone/bindings/powershell/README

Usage

Invoke-Capstone is ready for use, there are two options to access the capstone
library from PowerShell:

  * Script dot sourcing:

     PS C:\> . .\Invoke-Capstone.ps1

  * Adding the script to one of the PowerShell module directories:

     # Global PSModulePath path
     %Windir%\System32\WindowsPowerShell\v1.0\Modules

     # User PSModulePath path
     %UserProfile%\Documents\WindowsPowerShell\Modules

Notes

  * Invoke-Capstone drops the Capstone DLL, x32/64 respectively, to the user's
    temporary folder the first time it runs. Further runs will use this cached DLL.

  * The "Out-UnmanagedDll" script can be used to generate a compressed DLL which
    allows for easy integration with Invoke-Capstone. This script is based on
    @mattifestation’s post here
    http://www.exploit-monday.com/2012/12/in-memory-dll-loading.html.

     # Redirect script output to file
     PS C:\> Out-UnmanagedDll -FilePath C:\Some\Path\capstone.dll