PSHELL and NTFS File Streams

     _x64: 1
   _admin: 1
_elevated: 1

TCC  26.01.40 x64   Windows 10 [Version 10.0.18363.900]

I have a .PS1 file as a stream name, however, PSHELL does not seem to recognize it;
e:\utils>type cmenu.btm:cmenu.ps1
$o = new-object -com "Shell.Application"
$folder = $o.NameSpace("C:\PROGRA~1\JPSoft\TCMD26\")
$file = $folder.ParseName("tcc.exe")

e:\utils>pshell cmenu.btm:cmenu.ps1

e:\utils>dir /: cmenu.btm

Volume in drive E is New Volume   Serial number is 2c1e:6e61
Directory of  E:\Utils\cmenu.btm

2020-07-22   9:04             296  cmenu.btm
                              166    cmenu.ps1:$DATA
                 462 bytes in 1 file and 0 dirs    8,192 bytes allocated
   1,458,335,899,648 bytes free


If I use a non-stream file,
PSHELL cmenu.ps1
it works as it should.

Is this WAD, that is, PSHELL does not recognize stream files?

That's odd since you can execute the stream directly in Powershell. Below, this is Powershell and the second command works.


Similar threads