Profiles | Internet Forensics

PowerShell uses profiles to help customize the shell environment. There are a few files which customize the profile:

%windir%\system32\WindowsPowerShell\v1.0\profile.ps1 This profile is loaded for all users.
%windir%\system32\WindowsPowerShell\v1.0\ Microsoft.PowerShell_profile.ps1 This profile is loaded for all users, and only for the default instance of PowerShell.
%UserProfile%\My Documents\WindowsPowerShell\profile.ps1 This profile is loaded per-user, and affects all versions of PowerShell which are installed.
%UserProfile%\\My Documents\WindowsPowerShell\ Microsoft.PowerShell_profile.ps1 This profile is loaded per-user, but only affects the default instance of PowerShell.

Note that none of these profiles exist by default, but you can create any ones that you need to use. If these files exist, they are read in this order - conflicts are "won" by whichever file is read last. If none of these files exist, PowerShell will use its built-in default settings. So what's in a profile? Listed below is an example profile that installs with PowerShell (note that this example isn't actually run by PowerShell; all of the things within the sample are actually defines as part of PowerShell's core, built-in settings).

 #  Copyright (c) 2005 Microsoft Corporation. All rights reserved. # #  THIS CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY #  OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED #  TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A #  PARTICULAR PURPOSE set-alias cat        get-content set-alias cd         set-location set-alias clear      clear-host set-alias cp         copy-item set-alias h          get-history set-alias history    get-history set-alias kill       stop-process set-alias lp         out-printer set-alias ls         get-childitem set-alias mount      new-drive set-alias mv         move-item set-alias popd       pop-location set-alias ps         get-process set-alias pushd      push-location set-alias pwd        get-location set-alias r          invoke-history set-alias rm         remove-item set-alias rmdir      remove-item set-alias echo       write-object set-alias cls        clear-host set-alias chdir      set-location set-alias copy       copy-item set-alias del        remove-item set-alias dir        get-childitem set-alias erase      remove-item set-alias move       move-item set-alias rd         remove-item set-alias ren        rename-item set-alias set        set-variable set-alias type       get-content function help {     get-help $args[0] | out-host -paging } function man {     get-help $args[0] | out-host -paging } function mkdir {     new-item -type directory -path $args } function md {     new-item -type directory -path $args } function prompt {     "PS " + $(get-location) + "> " } & {     for ($i = 0; $i -lt 26; $i++)     {         $funcname = ([System.Char]($i+65)) + ':'         $str = "function global:$funcname { set-location $funcname } "         invoke-command $str     } }

This example profile is really little more than a "startup script." It starts by setting several cmdlet aliases so that familiar commands like Cd (the MS-DOS "change directory" command) are aliased to an equivalent PowerShell cmdlet (Set-Location in this case). It then declares several functions. For example, the Get-Help cmdlet exists to access PowerShell's built-in help files. The Help function defined by this profile calls Get-Help, passes the name of the help file you asked for (that's the $args[0] part), and then pipes the output to the Out-Host cmdlet that has the -paging parameter. This means your help will appear on one screen at a time instead of scrolling by too quickly to read.

The coolest part of this sample profile is the last bit, which takes some careful decoding:

 & {     for ($i = 0; $i -lt 26; $i++)     {         $funcname = ([System.Char]($i+65)) + ':'         $str = "function global:$funcname { set-location $funcname } "         invoke-command $str     } }

The & operator means invoke or, "Please run the following code." So everything within the outer set of curly braces will execute. In other words, it's a code block that will run each time you start PowerShell with this profile. So what does it do?

A for loop (which we'll cover in Chapter 8) is set to count from zero to 25. That is, the for loop starts at zero, continues while it's less than 26, and increments by 1 each time through the loop. Within the loop a variable named $funcname is created. The loop's current value (0 to 25) is added to 65, and an ASCII character of that value is selected. For example, 65 is the letter "A" and 66 is the letter "B". A colon character is appended, making the value of $funcname something like "A:" or "B:" all the way to "Z:". All of these look like drive letters, right?

A variable named $str is then created. The first time through the loop, it contains the string "function global:A: {set-location A: }". You can see where "A:" (and then "B:", then "C:", and so forth) are inserted at the location of $funcname. The Invoke-Command cmdlet then executes whatever code is inside $str. Essentially, this loop is declaring 26 new functions named A:, B:, etc. that execute the Set-Location cmdlet.

What's the point of all this? In the old Cmd.exe shell, you could type a drive letter like C: to "change" to that drive. Since by default PowerShell doesn't support that functionality, these 26 dynamically-declared functions provide that capability, making PowerShell work a bit more like the old, familiar Cmd.exe shell. This is the power of a profile -Setting up PowerShell to work the way you want.

All of these aliases and functions become available right within the PowerShell environment. You can modify this example to create your own profile or create your own profile entirely from scratch. Simply use the same script editor or development environment such as SAPIEN PrimalScript that you use to write PowerShell scripts.