PSHELL and NTFS File Streams

[Joe Caverly]

     _x64: 1
   _admin: 1
_elevated: 1

TCC  26.01.40 x64   Windows 10 [Version 10.0.18363.900]

I have a .PS1 file as a stream name, however, PSHELL does not seem to recognize it;

e:\utils>type cmenu.btm:cmenu.ps1
$o = new-object -com "Shell.Application"
$folder = $o.NameSpace("C:\PROGRA~1\JPSoft\TCMD26\")
$file = $folder.ParseName("tcc.exe")
$file.InvokeVerb("Properties")

e:\utils>pshell cmenu.btm:cmenu.ps1

e:\utils>dir /: cmenu.btm

Volume in drive E is New Volume   Serial number is 2c1e:6e61
Directory of  E:\Utils\cmenu.btm

2020-07-22   9:04             296  cmenu.btm
                              166    cmenu.ps1:$DATA
                 462 bytes in 1 file and 0 dirs    8,192 bytes allocated
   1,458,335,899,648 bytes free

e:\utils>

If I use a non-stream file,

PSHELL cmenu.ps1

it works as it should.

Is this WAD, that is, PSHELL does not recognize stream files?

Joe

 

[vefatica]

That's odd since you can execute the stream directly in Powershell. Below, this is Powershell and the second command works.

 

[rconn]

TCC / PSHELL simply passes that name ("cmenu.btm:cmenu.ps1") on to the Powershell interpreter (through the COM
interface). Powershell promptly crashes, and control returns to TCC (with no output).

You might want to direct this query to Microsoft.