I'd like to find all the nodes/paths to a specific value, where the input is either XML or JSON.
Specifically, I'm using Get-ProcessMitigation -RegistryConfigFilePath ExploitProtection.xml to write a Windows 10 system's Exploit Protection config to an XML file.
I'm trying to get a listing of all mitigations that are set to "true". I thought it would be easier to work with JSON and get the JSON paths, so I used a web-based XML-to-JSON converter to convert to JSON. The conversion results look fine but I'm not sure how to do the next step and get JSON paths. (Most questions on here are the reverse, i.e., with a known path, get the value.)
Sample XML input:
<AppConfig Executable="PresentationHost.exe">
<DEP Enable="true" EmulateAtlThunks="false" />
<ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="true" />
<SEHOP Enable="true" TelemetryOnly="false" />
<Heap TerminateOnError="true" />
</AppConfig>
<AppConfig Executable="PrintDialog.exe">
<ExtensionPoints DisableExtensionPoints="true" />
</AppConfig>
Or equivalent JSON:
{
"DEP": {
"Enable": "true",
"EmulateAtlThunks": "false"
},
"ASLR": {
"ForceRelocateImages": "true",
"RequireInfo": "false",
"BottomUp": "true",
"HighEntropy": "true"
},
"SEHOP": {
"Enable": "true",
"TelemetryOnly": "false"
},
"Heap": {
"TerminateOnError": "true"
},
"Executable": "PresentationHost.exe"
},
{
"ExtensionPoints": {
"DisableExtensionPoints": "true"
},
"Executable": "PrintDialog.exe"
},
I just want something to tell me that the following are enabled. The formatting doesn't matter much, although ideally it would also be parseable.
- PresentationHost.exe -> DEP
- PresentationHost.exe -> ASLR ForceRelocateImages
- PresentationHost.exe -> ASLR BottomUp
- PresentationHost.exe -> ASLR HighEntropy
- PresentationHost.exe -> SEHOP
- PresentationHost.exe -> Heap TerminateOnError
- PrintDialog.exe -> ExtensionPoints DisableExtensionPoints
Doing the same without first converting to JSON, and just working with the XML result, would be fine as well.
Thanks!