Skip to content

Instantly share code, notes, and snippets.

@NullDev
Created January 18, 2025 20:23
Show Gist options
  • Save NullDev/6c60d83a938b27c7b809badbc4ece30f to your computer and use it in GitHub Desktop.
Save NullDev/6c60d83a938b27c7b809badbc4ece30f to your computer and use it in GitHub Desktop.
PS script to find files starting with certain Bytes
# Dir to search
$directory = "C:\Users\xxx\some_directory"
# Bytes to look for
$byteSequence = [byte[]](0xAF, 0x1B, 0xB1, 0xFA)
function Contains-ByteSequence {
param (
[string]$filePath,
[byte[]]$sequence
)
try {
$fileBytes = [System.IO.File]::ReadAllBytes($filePath)
for ($i = 0; $i -le $fileBytes.Length - $sequence.Length; $i++) {
if ($fileBytes[$i..($i + $sequence.Length - 1)] -eq $sequence) {
return $true
}
}
} catch {
Write-Warning "Unable to read file: $filePath"
}
return $false
}
Get-ChildItem -Path $directory -Recurse -File | ForEach-Object {
if (Contains-ByteSequence $_.FullName $byteSequence) {
Write-Output "Match found in: $($_.FullName)"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment