Category: Windows

Posted on

Windows Executable PE file sections

.text
Section containing executable code.

.rdata
Globally accessible within the program for read-only data.

.data
Stores globally accessible data within the program.

.idata
Stores import function data, where relevant.

.edata
Stores export function data, where relevant.

.pdata
Stores exception handling data for x64 executables.

.rsrc
Stores program resources.

.reloc
Library file relocation information.

Posted on

Using PowerShell to create a list of your installed programs on Windows

Open PowerShell terminal from ‘Start > Run’.

Paste the following command in to the terminal to gather the list of installed programs on Windows:

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize

This will display the output within your PowerShell terminal.

To output the information to a file, you can use the following command (amend as appropriate for your username and output location):

Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table –AutoSize > "file_output_location_and_file_format".

For the file output location, you can use the path, e.g. C:\Users\Kevin\Documents\PSAppOutput.txt.