DevCentral > Weblogs > Joe Pruitt - A Software Architect's take on Network Security

posted on Friday, April 17, 2009 11:00 AM

sysinternals If you’ve ever had to diagnose something with your Windows system, odds are you’ve come across the Sysinternals product suite by Mark Russinovich and Bryce Cogswell.  Their PsTools suite has saved my behind many times and since they regularly make updates to the tools, it’s kind of a pain to make sure that the tools you are using are always up to date.  I’ve been using these so long I still have my tools directory named after the their original “NTInternals” name.  Anyone else been using them this long?

As part of the transition into Microsoft, they have made available the Sysinternals Live service which enables you to execute Sysinternals tools directly from the Web.  All you have to do is to type them into your browser or windows explorer as follows and you will always be up-to-date with the latest version of the tools.

http://live.sysinternals.com/<toolname>
–or-
\\live.sysinternals.com\toolname

They provide a full list of the tools at the http://live.sysinternals.com website which is handy if you don’t remember the tool you are wanting to use.

Now, I’m a command-line guy and I spend most of my time in the shell and I spend part of my time offline when I’m out of wireless range with my laptop so I like to have a copy of the tools locally.  So, I went ahead and wrote up this little script that will download the latest versions of all the tools to my tools directory.  It will first make a backup of the existing files and then download the new version in their place.  I’ll still have to run the script periodically, but it will download the latest revisions of all available commands.

The script is configurable in allowing you to specify a target directory for the utilities as well as a list of specific utilities you want to update.

 

   1: #===================================================================================
   2: # Update-SysInternals.ps1
   3: #===================================================================================
   4: param(
   5:     [string]$tools_dir = $null,
   6:     [string[]]$commands = $null
   7: );
   8:  
   9: if ( !$tools_dir ) { $tools_dir = (Get-Location).Path; }
  10: $script:TOOLSDIR = $tools_dir;
  11:  
  12: #-----------------------------------------------------------------------------------
  13: # function Download-Command
  14: #-----------------------------------------------------------------------------------
  15: function Download-Command()
  16: {
  17:     param([string]$command = $null);
  18:     if ( $command )
  19:     {
  20:         $url = "http://live.sysinternals.com/$command";
  21:         $target = "$($script:TOOLSDIR)\$command";
  22:         
  23:         $wc = New-Object System.Net.WebClient
  24:         $wc.DownloadFile($url, $target);
  25:         $time = ([DateTime]::Now).ToLongTimeString();
  26:         $fi = Get-ChildItem $target -ErrorAction SilentlyContinue
  27:         if ( $fi )
  28:         {
  29:             $len = $fi.Length;
  30:             
  31:             "$time URL:$url [$len/$len] -> ""$target""";
  32:         }
  33:     }
  34: }
  35:  
  36: #-----------------------------------------------------------------------------------
  37: # function Update-Command
  38: #-----------------------------------------------------------------------------------
  39: function Update-Command()
  40: {
  41:     param([string]$command);
  42:     if ( $command )
  43:     {
  44:         pushd $script:TOOLSDIR;
  45:         $full_command = "$($script:TOOLSDIR)\$command";
  46:         
  47:         if ( [System.IO.File]::Exists($full_command) )
  48:         {
  49:             Write-Host "Renaming $full_command to ${full_command}.bak...";
  50:             # Rename file
  51:             Copy-Item $command "${command}.bak"
  52:             Remove-Item $command;
  53:         }
  54:         
  55:         Download-Command $command;
  56:         
  57:         popd;
  58:     }
  59: }
  60:  
  61: #-----------------------------------------------------------------------------------
  62: # function Update-Commands
  63: #-----------------------------------------------------------------------------------
  64: function Update-Commands()
  65: {
  66:     param([string[]]$commands);
  67:     if ( $commands )
  68:     {
  69:         foreach ($command in $commands)
  70:         {
  71:             Update-Command $command;
  72:         }
  73:     }
  74: }
  75:  
  76: #-----------------------------------------------------------------------------------
  77: # function Get-Command
  78: #-----------------------------------------------------------------------------------
  79: function Get-Commands()
  80: {
  81:     $commands = @();
  82:  
  83:     Write-Host "Querying commands from live.sysinternals.com...";
  84:     
  85:     $wc = New-Object System.Net.WebClient;
  86:     $site = $wc.DownloadString('http://live.sysinternals.com');
  87:     [regex]$re = ">[a-zA-Z0-9._-]*</A>";
  88:     $found_matches = $re.Matches($site);
  89:     foreach ($found_match in $found_matches)
  90:     {
  91:         $cmd = $found_match.Value.Substring(1, $found_match.Value.Length-5);
  92:         $do_download = $false;
  93:         switch -wildcard ($cmd.ToLower())
  94:         {
  95:             "*.exe" { $do_download = $true; }
  96:             "*.dll" { $do_download = $true; }
  97:             "*.chm" { $do_download = $true; }
  98:             "*.hlp" { $do_download = $true; }
  99:             "*.sys" { $do_download = $true; }
 100:         }
 101:         if ( $do_download )
 102:         {
 103:             $commands += @($cmd);
 104:         }
 105:     }
 106:     $commands;
 107: }
 108:  
 109: #-----------------------------------------------------------------------------------
 110: # Main program logic
 111: #-----------------------------------------------------------------------------------
 112: if ( ![System.IO.Directory]::Exists($script:TOOLSDIR) )
 113: {
 114:     mkdir $script:TOOLSDIR;
 115: }
 116:  
 117: if ( $null -eq $commands )
 118: {
 119:     $commands = Get-Commands;
 120: }
 121:  
 122: Update-Commands $commands;

 

Now you can rest assured that you are always running the latest and greatest Sysinternals tools thanks to PowerShell!

Download the full script here: Update-SysInternals.ps1


Feedback

4/17/2009 6:24 PM
Gravatar 122 lines, or:

xcopy.exe \\live.sysinternals.com\tools c:\tools /s
John W
4/17/2009 6:31 PM
Gravatar I've gotta say, I'm at a loss here as well. Robocopy, wget or xcopy would happily do this better, incrementally and without the excess complexity. Is this purely academic?
denon
4/20/2009 1:25 PM
Gravatar Thanks for the feedback!

The xcopy route doesn't work for me due to firewalls. I'm sure others are in this boat as well. If you have network directory access outside of your firewall, then the xcopy route should be fine. I was providing this as an alternative way using their HTTP server.

-Joe
Joe Pruitt
4/21/2009 11:20 AM
Gravatar how cool is this! http://devcentral.f5.com/weblogs/Joe/archive/2009/04/17/use-powershell-to-auto-update-your-sysinternals.asp
Carpe Diem: Flaphead.com
5/13/2009 11:58 AM
Gravatar I have a very similar script, but mine is for v2 but has some added features ;)
http://bsonposh.com/archives/680


Brandon
8/1/2009 11:35 PM
Gravatar devcentral.f5.com/.../...te-your-sysinternals.aspx
and
http://bsonposh.com/archives/680

is good but i prefer Joe script than Brandon Script.
Nail Biting
11/5/2009 10:29 PM
Gravatar I have written a VBScript -- plan to update it to PowerShell too -- to automatically download only the updated files. You may check it out here http://www.ravichaganti.com/blog/?p=844
Ravikanth

Let Me Know What You Think


Please use the form below if you have any comments, questions, or suggestions.

Title:
 
Name:
 
Email: (so we can show your gravatar)
Website:
Comment: Allowed tags: blockquote, a, strong, em, p, u, strike, super, sub, code
 
Please add 8 and 4 and type the answer here:
Blog Stats
Posts:375
Comments:945
Stories:1
Trackbacks:291
Article Categories
  iRules
Image Galleries
Current Reading
 


1-425-654-0324



My status
Buy from SnowCovered!

Internet Security Blog Directory