2

I am trying to write a code to make my daily life easier :)

The code below works if I indicate the file path

$ stream_reader = New-Object System.IO.StreamReader {c:\test.txt} 

However it does not work when I use a variable like:

$ stream_reader = New-Object System.IO.StreamReader {$FileIOC}

How to use it:

  1. Create a file text containing md5 entries
  2. Run the script and specify the file.
  3. Normally, a file name like : "randomID.ioc" will be created

Code

  try {
      $FileIOC = read-host "Where is located the text file containing iOC"
      if (Test-Path $FileIOC) {
      write-host "File found at:" $FileIOC
      
      } else {
      write-host "Unable to file iOC file into: " $FileIOC
             }
         } 
    catch { 
        #Write-Warning $_.Exception.Message
        #Write-Host "Unable to find $hotfix"
        }


try {
    # GUI ID Generation
    $GUID = [System.Guid]::NewGuid()
    #[guid]::NewGuid()
    Write-Host "Generating ID: " $GUID
    }
    catch { 
        Write-Warning $_.Exception.Message
    }

# Variables
$gdate = Get-Date -format s
$Hostname = "$GUID.ioc"

# Where I am
$Locate = Get-Location
$Folder = "$Locate\"
#write-host "Path :" $Folder

# Create file format GUID.ioc (# create xml)
# `n <== Enter
   New-Item -path $Folder -name $Hostname -type "file" -value "<?xml version=""1.0"" encoding=""utf-8""?>" 
   Add-Content -path $Folder$Hostname -value "`n<ioc xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" id=""$GUID"" last-modified=""$gdate"" xmlns=""http://schemas.mandiant.com/2010/ioc"">"
   Add-Content -path $Folder$Hostname -value "  <short_description>Custom EDR-O iOC</short_description>"
   Add-Content -path $Folder$Hostname -value "  <short_description>Custom EDR-O iOC $Hostname $gdate</short_description>"
   Add-Content -path $Folder$Hostname -value "  <keywords />"
   Add-Content -path $Folder$Hostname -value "  <authored_by>LEFBE</authored_by>"
   Add-Content -path $Folder$Hostname -value "  <authored_date>$gdate</authored_date>"
   Add-Content -path $Folder$Hostname -value "  <links />"
   Add-Content -path $Folder$Hostname -value "  <definition>"
   
   # For each line in text files
   # Generate ID
   $GUID1 = [guid]::NewGuid()
   Add-Content -path $Folder$Hostname -value "    <Indicator operator=""OR"" id=""$GUID1"">"
   $stream_reader = New-Object System.IO.StreamReader{"$FileIOC"} #< Here a problem variable was note read by $stream_reader
   while (($current_line =$stream_reader.ReadLine()) -ne $null)
    {
    Write-Host "$current_line"
    $line_number++
         $GUID2 = [guid]::NewGuid()
         Add-Content -path $Folder$Hostname -value "      <IndicatorItem id=""$GUID2"" condition=""is"">"
         Add-Content -path $Folder$Hostname -value "        <Context document=""FileItem"" search=""FileItem/Md5sum"" type=""mir"" />"
         Add-Content -path $Folder$Hostname -value "        <Content type=""md5"">$current_line</Content>"
         Add-Content -path $Folder$Hostname -value "      </IndicatorItem>"
     }         
         Add-Content -path $Folder$Hostname -value "    </Indicator>"
         Add-Content -path $Folder$Hostname -value "  </definition>"     
         Add-Content -path $Folder$Hostname -value "</ioc>" 


Write-Host ""
Write-Host "iOC file can be found at this location:" "$Folder$Hostname"

Do you have any idea ?

4
  • 3
    The correct syntax is: New-Object -TypeName System.IO.StreamReader -ArgumentList $path or even better: [System.IO.StreamReader]::new($path) Commented Jul 28, 2021 at 16:51
  • 1
    Hello @iRon, With your solution I got the same error: ERROR: Exception when calling ".ctor" with "1" argument (s): "Illegal characters in path. " ERROR: Cannot call a method in a null expression. Using a file path and not the variable works Commented Jul 28, 2021 at 17:03
  • 1
    That is probably because you didn't close (and dispose) streamreader with previous attempts. Does this answer your question? Powershell StreamReader - how to wait for a new file to be readable Commented Jul 28, 2021 at 17:07
  • 1
    Thanks @iRon after adding $stream_reader.Close() and $stream_reader.Dispose() it works :) ! Thanks for all Commented Jul 28, 2021 at 17:21

1 Answer 1

2

Thanks to @iRon for his help.

Solution is :

$stream_reader = [System.IO.StreamReader]::new($FileIOC)
# Do some stuff

# Do not forget to close the file and dispose
$stream_reader.Close()
$stream_reader.Dispose() 
Sign up to request clarification or add additional context in comments.

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.