{"id":10351,"date":"2006-05-07T18:35:00","date_gmt":"2006-05-07T18:35:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/powershell\/2006\/05\/07\/invoking-powershell-with-complex-expressions-using-scriptblocks\/"},"modified":"2019-02-18T13:21:44","modified_gmt":"2019-02-18T20:21:44","slug":"invoking-powershell-with-complex-expressions-using-scriptblocks","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/invoking-powershell-with-complex-expressions-using-scriptblocks\/","title":{"rendered":"Invoking PowerShell with complex expressions using Scriptblocks"},"content":{"rendered":"

<WIZARD WARNING><\/p>\n

First a reminder:  when you are in PowerShell (formerly knows as Monad), you can run anything you want out-of-process using the construct:<\/p>\n

PowerShell {Scriptblock}<\/strong><\/font><\/p>\n

The great example of this is <\/p>\n

PS> #RUN EVERYTHING IN PROCESS
PS> get-process |where {$_.handles -ge 900} |sort handles<\/strong><\/font><\/p>\n

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
——-  ——    —–      —– —–   ——     — ———–
   1369      45    55328      16880   469    81.67   3056 OUTLOOK
   1575      48    84616     116200   450   103.52   3212 iexplore
   2367     190    31192      40676   152   179.70   1768 svchost<\/font><\/p>\n

PS> #RUN EVERYTHING OUT OF PROCESS
PS> PowerShell {<\/font>get-process |where {$_.handles -ge 900} |sort handles}<\/font><\/strong><\/font><\/p>\n

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
——-  ——    —–      —– —–   ——     — ———–
   1369      45    55328      16880   469    81.73   3056 OUTLOOK
   1575      48    84616     116200   450   103.56   3212 iexplore
   2369     190    31192      40676   152   179.73   1768 svchost<\/font><\/p>\n

PS> #RUN the first 2 elements of the pipeline in process and the last in-process
PS> PowerShell {<\/font>get-process |where {$_.handles -ge 900}}<\/font> |sort handles<\/strong><\/font><\/p>\n

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
——-  ——    —–      —– —–   ——     — ———–
   1369      45    55328      16880   469    81.75   3056 OUTLOOK
   1571      48    84768     116352   450   103.59   3212 iexplore
   2373     190    30716      40220   152   179.81   1768 svchost<\/font><\/p>\n

PS> #RUN the first element of the pipeline in process and the last 2 in-process
PS> PowerShell {<\/font>get-process}<\/font> |where {$_.handles -ge 900} |sort handles<\/strong><\/font><\/p>\n

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
——-  ——    —–      —– —–   ——     — ———–
   1369      45    55328      16948   469    81.80   3056 OUTLOOK
   1567      48    84252     115892   449   103.63   3212 iexplore
   2398     190    31292      40724   153   180.02   1768 svchost
<\/font><\/p>\n

Now – have you ever tried to do that from CMD.EXE?<\/p>\n

C:\\>powershell {get-process |where {$_.handles -ge 900} | Sort Handles }
‘where’ is not recognized as an internal or external command,
operable program or batch file.<\/font><\/p>\n

That doesn’t work so well.  You try a number of things and depending upon what you are trying to do, that will work better or worse.  If you want to execute script blocks with single and double quotes, this becomes incomprehensible pretty quickly.  <\/p>\n

The problem is that there are various components which try to “help” you by processing the arguments (e.g. stripping off quotes).  The reason this ALWAYS works when you invoke it from Powershell is … we cheat.   Well, we cheat in a Kabayashi Maru sort of way (See Kirk’s solution http:\/\/en.wikipedia.org\/wiki\/Kobayashi_Maru<\/a>).  <\/p>\n

Here is a trick that you can use to see what is going on.  The system type [ENVIRONMENT] has lots of great static properties:<\/p>\n

PS> [Environment] |gm -static -membertype property<\/font><\/p>\n

<\/p>\n

   TypeName: System.Environment<\/p>\n

Name               MemberType Definition
—-               ———- ———-
CommandLine        Property   static System.String CommandLine {get;}
CurrentDirectory   Property   static System.String CurrentDirectory {get…
ExitCode           Property   static System.Int32 ExitCode {get;set;}
HasShutdownStarted Property   static System.Boolean HasShutdownStarted {…
MachineName        Property   static System.String MachineName {get;}
NewLine            Property   static System.String NewLine {get;}
OSVersion          Property   static System.OperatingSystem OSVersion {g…
ProcessorCount     Property   static System.Int32 ProcessorCount {get;}
StackTrace         Property   static System.String StackTrace {get;}
SystemDirectory    Property   static System.String SystemDirectory {get;}
TickCount          Property   static System.Int32 TickCount {get;}
UserDomainName     Property   static System.String UserDomainName {get;}
UserInteractive    Property   static System.Boolean UserInteractive {get;}
UserName           Property   static System.String UserName {get;}
Version            Property   static System.Version Version {get;}
WorkingSet         Property   static System.Int64 WorkingSet {get;}<\/font><\/p>\n

Including the commandline used to execute the current process.<\/p>\n

PS> [Environment]::commandline
“C:\\Program Files\\Windows PowerShell\\v1.0\\powershell.exe”<\/font><\/p>\n

From there, you can do the following to see our cheat:<\/p>\n

PS> PowerShell {[Environment]::CommandLine}
“C:\\Program Files\\Windows PowerShell\\v1.0\\powershell.exe” -encodedCommand WwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAQwBvAG0AbQBhAG4AZABMAGkAbgBlAA== -inputFormat xml -outputFormat xml<\/font><\/p>\n

When we launch an external process which has a parameter with {}’s we say that that is a subshell and we TWEAK the command invocation by Base64 encoding the scriptblock and by telling the command to consume and produce XML.<\/p>\n

If you ever need to invoke a complex piece of code directly from CMD.exe you can run PowerShell and do the following to get the string to pass to -EncodedCommand :<\/p>\n

PS> $script = {gps |where {$_.handles -ge 900}|sort handles}.ToString()
PS> [System.Convert]::ToBase64String([System.Text.Encoding]::UNICODE.GetByte
s($script))
ZwBwAHMAIAB8AHcAaABlAHIAZQAgAHsAJABfAC4AaABhAG4AZABsAGUAcwAgAC0AZwBlACAAOQA
wADAAfQB8AHMAbwByAHQAIABoAGEAbgBkAGwAZQBzAA==<\/font><\/p>\n

You can then use that string from CMD.EXE:<\/p>\n

C:\\>PowerShell -EncodedCommand ZwBwAHMAIAB8AHcAaABlAHIAZQAgAHsAJABfAC4AaABhAG4AZ
ABsAGUAcwAgAC0AZwBlACAAOQAwADAAfQB8AHMAbwByAHQAIABoAGEAbgBkAGwAZQBzAA==<\/font><\/p>\n

Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName
——-  ——    —–      —– —–   ——     — ———–
   1366      45    55328      21552   469    83.50   3056 OUTLOOK
   1665      48    90164     122736   466   276.13   3212 iexplore
   2396     202    31036      40664   153   192.08   1768 svchost
<\/font><\/p>\n

Enjoy!
Jeffrey Snover [MSFT]
Windows PowerShell Architect<\/p>\n

<\/font> <\/p>\n

PSMDTAG:FAQ: What is the -EncodedCommand parameter on PowerShell.Exe for?
PSMDTAG:FAQ: How can I see the command line that started the PowerShell process?
PSMDTAG:FAQ: How do I run a scriptblock in a seperate process?
PSMDTAG:INTERNAL: avoiding funky syntax across process invocations, Base64 encoding of ENCODEDCOMMAND
<\/font><\/p>\n

<\/font><\/p>\n","protected":false},"excerpt":{"rendered":"

<WIZARD WARNING> First a reminder:  when you are in PowerShell (formerly knows as Monad), you can run anything you want out-of-process using the construct: PowerShell {Scriptblock} The great example of this is PS> #RUN EVERYTHING IN PROCESSPS> get-process |where {$_.handles -ge 900} |sort handles Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName——-  ——    —–      —– […]<\/p>\n","protected":false},"author":600,"featured_media":13641,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[10,19],"class_list":["post-10351","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-powershell","tag-faq","tag-internal"],"acf":[],"blog_post_summary":"

<WIZARD WARNING> First a reminder:  when you are in PowerShell (formerly knows as Monad), you can run anything you want out-of-process using the construct: PowerShell {Scriptblock} The great example of this is PS> #RUN EVERYTHING IN PROCESSPS> get-process |where {$_.handles -ge 900} |sort handles Handles  NPM(K)    PM(K)      WS(K) VM(M)   CPU(s)     Id ProcessName——-  ——    —–      —– […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/10351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/users\/600"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/comments?post=10351"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/posts\/10351\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media\/13641"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/media?parent=10351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/categories?post=10351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/powershell\/wp-json\/wp\/v2\/tags?post=10351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}