Skip to content

Commit cf60b2c

Browse files
KarneadesKarneades
committed
Add ConvertFrom-EpocTime with pipeline support
* Rename Get-EpocTimeFromUtc to ConvertFrom-EpocTime * Export ConvertFrom-EpocTime * Update Pester tests * Add markdown help file * Update external help file * Update tags * Update CHANGELOG
1 parent 95a6de4 commit cf60b2c

File tree

7 files changed

+196
-16
lines changed

7 files changed

+196
-16
lines changed

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
1515
files like registry files.
1616
### Changed
1717
* Update PowerShell help file with further examples.
18+
* Rename `Get-EpocTimeFromUtc` to `ConvertFrom-EpocTime`, add pipeline support
19+
and export the function. Use `ConvertFrom-EpocTime` to convert unix
20+
timestamps to UTC, e.g. in a registry flow, convert the st_mtime value
21+
within PowerShell.
1822
<!--
1923
### Fixed
2024
### Deprecated

‎PowerGRR.psd1

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,8 @@ FunctionsToExport = @(
9898
'ConvertTo-Hex',
9999
'Wait-GRRHuntApproval',
100100
'Wait-GRRClientApproval',
101-
'Get-GRRClientInfo'
101+
'Get-GRRClientInfo',
102+
'ConvertFrom-EpocTime'
102103
)
103104

104105
# Cmdlets to export from this module

‎PowerGRR.psm1

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ Function Get-GRRComputerNameFromClientId()
160160
$info=[ordered]@{
161161
ComputerName=$item.os_info.node
162162
ClientId=$item.urn.substring(6)
163-
LastSeenAt=$(Get-EpocTimeFromUtc ($item.last_seen_at).toString().Insert(10,"."))
163+
LastSeenAt=$(ConvertFrom-EpocTime ($item.last_seen_at).toString().Insert(10,"."))
164164
OSVersion=$item.os_info.kernel
165165
}
166166

@@ -256,8 +256,8 @@ function Get-GRRClientInfo()
256256
$info=[ordered]@{
257257
ComputerName=$( if($item.os_info) { $item.os_info.node } )
258258
ClientId=$item.urn.substring(6)
259-
InstallationDate=$(Get-EpocTimeFromUtc ($item.os_info.install_date).toString().Insert(10,"."))
260-
LastSeenAt=$(Get-EpocTimeFromUtc ($item.last_seen_at).toString().Insert(10,"."))
259+
InstallationDate=$(ConvertFrom-EpocTime ($item.os_info.install_date).toString().Insert(10,"."))
260+
LastSeenAt=$(ConvertFrom-EpocTime ($item.last_seen_at).toString().Insert(10,"."))
261261
OSVersion=$( if($item.os_info) { $item.os_info.kernel } )
262262
GRRClientVersion=$item.agent_info.client_version
263263
UserNames=$( if($item.users) { $item.users.username } )
@@ -348,7 +348,7 @@ Function Get-GRRClientIdFromComputerName()
348348
$info=[ordered]@{
349349
ComputerName=$item.os_info.node
350350
ClientId=$item.urn.substring(6)
351-
LastSeenAt=$(Get-EpocTimeFromUtc ($item.last_seen_at).toString().Insert(10,"."))
351+
LastSeenAt=$(ConvertFrom-EpocTime ($item.last_seen_at).toString().Insert(10,"."))
352352
OSVersion=$item.os_info.kernel
353353
}
354354

@@ -2017,7 +2017,7 @@ Function Get-GRRHunt()
20172017
foreach ($r in $ret.items)
20182018
{
20192019
$info=[ordered]@{
2020-
Created=$(Get-EpocTimeFromUtc ($r.created).toString().Insert(10,"."))
2020+
Created=$(ConvertFrom-EpocTime ($r.created).toString().Insert(10,"."))
20212021
HuntId=$r.urn
20222022
Description=$r.description
20232023
Creator=$r.Creator
@@ -2347,11 +2347,22 @@ Function Get-ClientCertificate()
23472347
} # Get-ClientCertificate
23482348

23492349

2350-
function Get-EpocTimeFromUtc ([long]$UnixTime)
2350+
Function ConvertFrom-EpocTime()
23512351
{
2352-
$epoch = New-Object System.DateTime (1970, 1, 1, 0, 0, 0, [System.DateTimeKind]::Utc);
2353-
$epoch.AddSeconds($UnixTime)
2354-
} # FromUtcEpocTime
2352+
[CmdletBinding()]
2353+
param (
2354+
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
2355+
[long[]]$UnixTime
2356+
)
2357+
2358+
Process
2359+
{
2360+
$UnixTime | ForEach-Object {
2361+
$epoch = New-Object System.DateTime (1970, 1, 1, 0, 0, 0, [System.DateTimeKind]::Utc)
2362+
$epoch.AddSeconds($_)
2363+
}
2364+
}
2365+
} # ConvertFrom-EpocTime
23552366

23562367

23572368
function Get-GRRSession ()
@@ -2668,7 +2679,7 @@ function Invoke-GRRRequest ()
26682679
} # Invoke-GRRRequest
26692680

26702681

2671-
function ConvertTo-Base64 ()
2682+
function ConvertTo-Base64()
26722683
{
26732684
[CmdletBinding()]
26742685
param(
@@ -2697,7 +2708,7 @@ function ConvertTo-Base64 ()
26972708
}
26982709

26992710

2700-
function ConvertFrom-Base64()
2711+
Function ConvertFrom-Base64()
27012712
{
27022713
param(
27032714
[Parameter(ValueFromPipeline=$True, Mandatory=$true)]
@@ -3032,7 +3043,8 @@ Export-ModuleMember @(
30323043
'ConvertTo-Hex',
30333044
'Wait-GRRHuntApproval',
30343045
'Wait-GRRClientApproval',
3035-
'Get-GRRClientInfo'
3046+
'Get-GRRClientInfo',
3047+
'ConvertFrom-EpocTime'
30363048
)
30373049

30383050
#endregion

‎docs/ConvertFrom-EpocTime.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
external help file: PowerGRR-help.xml
3+
online version: https://github.com/swisscom/powergrr/blob/master/docs/ConvertFrom-EpocTime.md
4+
schema: 2.0.0
5+
---
6+
7+
# ConvertFrom-EpocTime
8+
9+
## SYNOPSIS
10+
Convert a unix timestamp into UTC.
11+
12+
## SYNTAX
13+
14+
```
15+
ConvertFrom-EpocTime [-UnixTime] <Int64[]> [<CommonParameters>]
16+
```
17+
18+
## DESCRIPTION
19+
Convert a unix timestamp into UTC.
20+
21+
## EXAMPLES
22+
23+
### Example 1
24+
```
25+
PS C:\> ConvertFrom-EpocTime 1514997715
26+
27+
Mittwoch, 3. Januar 2018 16:41:55
28+
29+
PS C:\> 1514997715 | ConvertFrom-EpocTime
30+
31+
Mittwoch, 3. Januar 2018 16:41:55
32+
```
33+
34+
Convert the specified unix timestamp into UTC. Use pipeline if needed.
35+
36+
## PARAMETERS
37+
38+
### -UnixTime
39+
Unix timestamp to convert.
40+
41+
```yaml
42+
Type: Int64[]
43+
Parameter Sets: (All)
44+
Aliases:
45+
46+
Required: True
47+
Position: 0
48+
Default value: None
49+
Accept pipeline input: True (ByValue)
50+
Accept wildcard characters: False
51+
```
52+
53+
### CommonParameters
54+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).
55+
56+
## INPUTS
57+
58+
### System.Int64[]
59+
60+
## OUTPUTS
61+
62+
### System.Object
63+
64+
## NOTES
65+
66+
## RELATED LINKS
67+

‎en-us/PowerGRR-help.xml

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,96 @@
306306
</maml:navigationLink>
307307
</command:relatedLinks>
308308
</command:command>
309+
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
310+
<command:details>
311+
<command:name>ConvertFrom-EpocTime</command:name>
312+
<command:verb>ConvertFrom</command:verb>
313+
<command:noun>EpocTime</command:noun>
314+
<maml:description>
315+
<maml:para>Convert a unix timestamp into UTC.</maml:para>
316+
</maml:description>
317+
</command:details>
318+
<maml:description>
319+
<maml:para>Convert a unix timestamp into UTC.</maml:para>
320+
</maml:description>
321+
<command:syntax>
322+
<command:syntaxItem>
323+
<maml:name>ConvertFrom-EpocTime</maml:name>
324+
<command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none">
325+
<maml:name>UnixTime</maml:name>
326+
<maml:Description>
327+
<maml:para>Unix timestamp to convert.</maml:para>
328+
</maml:Description>
329+
<command:parameterValue required="true" variableLength="false">Int64[]</command:parameterValue>
330+
<dev:type>
331+
<maml:name>Int64[]</maml:name>
332+
<maml:uri />
333+
</dev:type>
334+
<dev:defaultValue>None</dev:defaultValue>
335+
</command:parameter>
336+
</command:syntaxItem>
337+
</command:syntax>
338+
<command:parameters>
339+
<command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="0" aliases="none">
340+
<maml:name>UnixTime</maml:name>
341+
<maml:Description>
342+
<maml:para>Unix timestamp to convert.</maml:para>
343+
</maml:Description>
344+
<command:parameterValue required="true" variableLength="false">Int64[]</command:parameterValue>
345+
<dev:type>
346+
<maml:name>Int64[]</maml:name>
347+
<maml:uri />
348+
</dev:type>
349+
<dev:defaultValue>None</dev:defaultValue>
350+
</command:parameter>
351+
</command:parameters>
352+
<command:inputTypes>
353+
<command:inputType>
354+
<dev:type>
355+
<maml:name>System.Int64[]</maml:name>
356+
</dev:type>
357+
<maml:description>
358+
<maml:para></maml:para>
359+
</maml:description>
360+
</command:inputType>
361+
</command:inputTypes>
362+
<command:returnValues>
363+
<command:returnValue>
364+
<dev:type>
365+
<maml:name>System.Object</maml:name>
366+
</dev:type>
367+
<maml:description>
368+
<maml:para></maml:para>
369+
</maml:description>
370+
</command:returnValue>
371+
</command:returnValues>
372+
<maml:alertSet>
373+
<maml:alert>
374+
<maml:para></maml:para>
375+
</maml:alert>
376+
</maml:alertSet>
377+
<command:examples>
378+
<command:example>
379+
<maml:title>Example 1</maml:title>
380+
<dev:code>PS C:\&gt; ConvertFrom-EpocTime 1514997715
381+
382+
Mittwoch, 3. Januar 2018 16:41:55
383+
384+
PS C:\&gt; 1514997715 | ConvertFrom-EpocTime
385+
386+
Mittwoch, 3. Januar 2018 16:41:55</dev:code>
387+
<dev:remarks>
388+
<maml:para>Convert the specified unix timestamp into UTC. Use pipeline if needed.</maml:para>
389+
</dev:remarks>
390+
</command:example>
391+
</command:examples>
392+
<command:relatedLinks>
393+
<maml:navigationLink>
394+
<maml:linkText>Online Version:</maml:linkText>
395+
<maml:uri>https://github.com/swisscom/powergrr/blob/master/docs/ConvertFrom-EpocTime.md</maml:uri>
396+
</maml:navigationLink>
397+
</command:relatedLinks>
398+
</command:command>
309399
<command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
310400
<command:details>
311401
<command:name>ConvertTo-Base64</command:name>

‎tags

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,22 @@
55
!_TAG_PROGRAM_URL http://ctags.sourceforge.net /official site/
66
!_TAG_PROGRAM_VERSION 5.8 //
77
Add-GRRArtifact .\PowerGRR.psm1 /^function Add-GRRArtifact()$/;" m
8+
ConvertFrom-Base64 .\PowerGRR.psm1 /^Function ConvertFrom-Base64()$/;" m
9+
ConvertFrom-EpocTime .\PowerGRR.psm1 /^Function ConvertFrom-EpocTime()$/;" m
10+
ConvertTo-Base64 .\PowerGRR.psm1 /^function ConvertTo-Base64()$/;" m
811
ConvertTo-Hex .\PowerGRR.psm1 /^function ConvertTo-Hex()$/;" m
912
Find-GRRClient .\PowerGRR.psm1 /^Function Find-GRRClient()$/;" m
1013
Find-GRRClientByLabel .\PowerGRR.psm1 /^Function Find-GRRClientByLabel()$/;" m
1114
Get-ClientCertificate .\PowerGRR.psm1 /^Function Get-ClientCertificate()$/;" m
1215
Get-DynamicFlowParam .\PowerGRR.psm1 /^function Get-DynamicFlowParam()$/;" m
13-
Get-EpocTimeFromUtc .\PowerGRR.psm1 /^function Get-EpocTimeFromUtc ([long]$UnixTime)$/;" m
1416
Get-FlowArgs .\PowerGRR.psm1 /^function Get-FlowArgs()$/;" m
1517
Get-GRRArtifact .\PowerGRR.psm1 /^function Get-GRRArtifact()$/;" m
1618
Get-GRRClientApproval .\PowerGRR.psm1 /^function Get-GRRClientApproval()$/;" m
1719
Get-GRRClientIdFromComputerName .\PowerGRR.psm1 /^Function Get-GRRClientIdFromComputerName()$/;" m
1820
Get-GRRClientInfo .\PowerGRR.psm1 /^function Get-GRRClientInfo()$/;" m
1921
Get-GRRComputerNameFromClientId .\PowerGRR.psm1 /^Function Get-GRRComputerNameFromClientId()$/;" m
2022
Get-GRRConfig .\PowerGRR.psm1 /^Function Get-GRRConfig()$/;" m
23+
Get-GRRCredential .\PowerGRR.psm1 /^function Get-GRRCredential()$/;" m
2124
Get-GRRFlowDescriptor .\PowerGRR.psm1 /^function Get-GRRFlowDescriptor()$/;" m
2225
Get-GRRFlowResult .\PowerGRR.psm1 /^function Get-GRRFlowResult()$/;" m
2326
Get-GRRHunt .\PowerGRR.psm1 /^Function Get-GRRHunt()$/;" m

‎test/Pester/PowerGRR.Tests.ps1

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1088,9 +1088,12 @@ Describe "internal functions" {
10881088
}
10891089
}
10901090

1091-
Context 'Testing Get-EpocTimeFromUtc' {
1091+
Context 'Testing ConvertFrom-EpocTime' {
10921092
It 'convert unix timestamp to utc' {
1093-
$ret = Get-EpocTimeFromUtc 1496907016
1093+
$ret = ConvertFrom-EpocTime 1496907016
1094+
$ret | should be "06/08/2017 07:30:16"
1095+
1096+
$ret = 1496907016 | ConvertFrom-EpocTime
10941097
$ret | should be "06/08/2017 07:30:16"
10951098
}
10961099
}

0 commit comments

Comments
 (0)