Skip to content

Instantly share code, notes, and snippets.

@raystyle
Forked from mattifestation/SimpleTCGLogParser.ps1
Created March 15, 2019 05:05
Show Gist options
  • Save raystyle/4faf2d474006285dd3f325171976f250 to your computer and use it in GitHub Desktop.
Save raystyle/4faf2d474006285dd3f325171976f250 to your computer and use it in GitHub Desktop.
If you have the HgsDiagnostics PowerShell module, then you can parse TCG logs.
Import-Module HgsDiagnostics
$GetHgsTrace = Get-Command Get-HgsTrace
$RemoteAttestationCoreReference = $GetHgsTrace.ImplementingType.Assembly.GetReferencedAssemblies() | Where-Object { $_.Name -eq 'Microsoft.Windows.RemoteAttestation.Core' }
Add-Type -AssemblyName $RemoteAttestationCoreReference.FullName
$MostRecentTCGLog = Get-ChildItem C:\Windows\Logs\MeasuredBoot | Sort-Object -Property LastWriteTime -Descending | Select-Object -First 1 | Select-Object -ExpandProperty FullName
$LogBytes = [IO.File]::ReadAllBytes($MostRecentTCGLog)
$ParsedTCGLog = [Microsoft.Windows.RemoteAttestation.Core.TcgEventLog]::Parse($LogBytes)
$ParsedTCGLog.TcgData.Children | Sort-Object -Property PcrIndex | Group-Object -Property PcrIndex
$XmlWriterSettings = New-Object -TypeName System.Xml.XmlWriterSettings
$XmlWriterSettings.Indent = $True
$TcgContentSettings = New-Object -TypeName Microsoft.Windows.RemoteAttestation.Core.TcgContentSettings
$XmlWriter = [Xml.XmlWriter]::Create("$PWD\parsed_tcg_log.xml", $XmlWriterSettings)
$ParsedTCGLog.ToXml($XmlWriter, $TcgContentSettings)
$XmlWriter.Close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment