如何使用Powershell解析.etl文件并获取有效负载，而无需转换为其他文件类型

我试过：

$path = "xxx/xxx.etl"
Get-WinEvent -path $path -Oldest

---

但它只显示事件，而不显示负载。

我认为Microsoft.Diagnostics.Tracing.TraceeEvent库是您所需要的：

下面是一个如何在PowerShell中使用它的示例，在5.1和7.1中进行了测试

using namespace Microsoft.Diagnostics.Tracing.Etlx
using namespace System.Security.Principal

# Check if Microsoft.Diagnostics.Tracing.TraceEvent is installed, else install before continuing
if (-not (Get-Package -Name Microsoft.Diagnostics.Tracing.TraceEvent -ErrorAction SilentlyContinue)) {
    "TraceEvent package not foumd, trying to install. This may take a few minutes..."
    # Veryify the current user is part of the administrators group before trying to install package
    if ([WindowsPrincipal]::new([WindowsIdentity]::GetCurrent()).IsinRole([WindowsBuiltInRole]::Administrator)) {
        [void](Install-Package -Name Microsoft.Diagnostics.Tracing.TraceEvent -Force -ForceBootstrap)
    }
    else {
        Write-Warning "Administrator privileges required to install TraceEvent package, re-run script as administrator."
        exit
    }
}
$PackagePath = Get-Package -Name Microsoft.Diagnostics.Tracing.TraceEvent | Select-Object -ExpandProperty Source
$AssemblyPath =  Join-Path (Split-Path $PackagePath) '\lib\net45\Microsoft.Diagnostics.Tracing.TraceEvent.dll'
try {
    "Loading assembly."
    Add-Type -Path $AssemblyPath
}
catch {
    'Add-Type failed, using [System.Reflection.Assembly]::LoadFrom'
    [void]([System.Reflection.Assembly]::LoadFrom($AssemblyPath))
}
$EtlFile = 'C:\script\lab\Tests\ETL\NtKernel.etl'
$TraceLog = [TraceLog]::OpenOrConvert($EtlFile) 

当然，您需要更改$ETL文件的路径

运行后，所有事件都应包含在

$TraceLog.events

中，包括有效负载。如果运行例如

@（$TraceLog.Events）[0]| Get Member*payload*

，您将获得与有效负载相关的方法列表：

Name                MemberType Definition
----                ---------- ----------
PayloadByName       Method     System.Object PayloadByName(string propertyName)
PayloadIndex        Method     int PayloadIndex(string propertyName)
PayloadString       Method     string PayloadString(int index, System.IFormatProvider formatProvider)
PayloadStringByName Method     string PayloadStringByName(string propertyName, System.IFormatProvider formatProvider)
PayloadValue        Method     System.Object PayloadValue(int index)
PayloadNames        Property   string[] PayloadNames {get;}

可以在使用运行脚本之前安装库

Install-Package -Name Microsoft.Diagnostics.Tracing.TraceEvent

或者第一次以管理员身份运行脚本。请注意，安装该软件包可能需要一段时间，因此只需让它运行即可

如果您的软件包安装遇到问题，请确保您的PackageManager模块是最新的，例如：

Update-Module -Name PackageManagement -Verbose