E:temp>npipe
Usage: npipe [OPTIONS] [INPUT] [OUTPUTS] [FILE FLAGS] [CONVERSIONS]
Input parameters can appear in any order, file flags affect only the next
file/flag/handle/section/object specified on the command line
-t, --tee
Copy INPUT to STDOUT
-s, --stderrtee
Copy INPUT to STDERR
-n handle-num, --handle handle-num
Copy INPUT to handle: handle-num
-e error-file, --error-file error-file
Send errors to file: error-file
-a append-file, --append-file append-file
Append INPUT to file: append-file
-i input-file, --input-file input-file
Read INPUT from file: input-file
-N handle-num, --input-handle handle-num
Read INPUT from handle: handle-num
-D ntapi-file, --device-input ntapi-file
Read INPUT from native api/kernel file: ntapi-file
-d ntapi-file, --device-output ntapi-file
Copy INPUT to native api/kernel file: ntapi-file
-V, -VV, -VVV, -VVVV
Increasing verbosity, by default only parameter error info
-b buffer-length, --buffer-length buffer-length
Set the IO buffer size (default is 64k, unless console handle IO
is taking place, in which case it is 256)
-w, --wait
Wait for all pipes to be connected to before starting transfer
-B, --block-read
Read an entire buffer before writing
Likely only affects pipes or other communication handles
-m max-bytes, --maximum max-bytes
Read a maximum of max-bytes from INPUT
-c conversion-function, --convert conversion-function
Converts the buffer using one of the following functions:
All output commands after this point will be processed after the
conversion, those before will be unaffected.
l ANSI To Lower Case
L Unicode To Lower Case
u ANSI To Upper Case
U Unicode To Upper Case
c Clean non-ASCII to space
c:l Clean non-ASCII to letter l
cnum Clean non-ASCII to ASCII char num
c- Delete non-ASCII
O ANSI to OEM
A OEM to ANSI
w ANSI to Unicode
W ANSI to Unicode, with BOM
a Unicode to ANSI
s[num] Swap order of every num bytes, default 2, where num is a power
of two
hb[+][-]Binary to Hex by byte [with text dump] [without address dump]
hw[+][-]Binary to Hex by word [with text dump] [without address dump]
hd[+][-]Binary to Hex by dword [with text dump] [without address dump]
hr[+] Binary to Hex by byte raw dump [with spaces]
-h, -?, --help
Display this help
-v, --version
Display version info
--credits
Display program credits
-P, --progress
Displays a progress bar on the active console screen buffer (not STDOUT
or STDERR)
-R, --report
Print a status report to the error handle (default STDERR, set with -e)
This is overriden by the progress-bar flag (-P).
-O [queue length], --overlapped [queue length]
Reads from the input file (not file mapping) using asynchronous
overlapped IO.
This will probably improve the overall read/process speed
This is incompatible with the block-read flag (-B), and file mapping
inputs (-F)
'Queue length' defaults to 16, and must be between 1 and 64.
-Q, --overlapped-output
Outputs to the last output handle in the chain using asynchronous
overlapped IO.
This is incompatible with file mapping outputs
This activates overlapped read IO (-O above)
-X, --always-read
Read input even if no output specified
Flags which affect the next file on the command line
-W, --file-share-write
Open with FILE_SHARE_WRITE
-F, --file-mapping
Treat as a named file mapping object (cannot be a pipe)
For best performance: ensure that the buffer size and the skip offset
are a multiple of the page size, usually 4k.
-p, --persistent
Continue writing to next handle, even if write errors occur
Read unmapable/unreadable sections as blank
-S skip-bytes, --skip skip-bytes
Skip the first skip-bytes bytes of the file, (not pipe)
Flags which affect the next file on the command line (pipe only)
-z Force connection to existing pipes rather than create a new pipe
-Z Force creation of new pipes rather than connection to existing pipe
Pipe names must be in the format: .pipe[[path]name]
INPUT defaults to STDIN
/ may be used instead of -
Number may be prefixed with 0x for hexadecimal, and postfixed with the following
SI prefixes: k,M,G,T,P,E
These stand for increasing powers of 2^10 (1024) and can be used to specify kilo
bytes, megabytes, etc.
One letter arguments may be clumped, however only the last argument in the clump
may have an argument.
eg. -V -V -t -s -b64k <--> -VVtsb64k
Example: npipe -tsVVVVwm64k -FpD DevicePhysicalMemory out -chr -a outputfile -
Z .pipepipe1
Outputs to STDOUT,STDERR. Very verbosely. Waits for all pipes. Read max 64kB (65
536 bytes). Opens DevicePhysicalMemory as a ntapi file mapping object and pers
istently reads from it. Outputs to file: 'out'. Converts output to a raw hexdump
, affects following two output commands. Appends to file: 'outputfile'. Always c
reates, and outputs on pipe: 'pipe1'.
E:temp>npipe -c hr+ -i writer.exe outputs
