获取DLL详细路径 - 中国DOS联盟论坛 - 中国DOS联盟之联合DOS论坛

收集自网络。保存为 .vbs 文件。



' FileName: ProcessMagnifier.vbs 
' Function: Capture information about the running processes in detail 
' code by somebody 
' QQ: 240460440 
' LastModified:2007-11-16 18:25 
' 仅供学习 
Const HKEY_CURRENT_USER = &H80000001 
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv") 
strKeyPath = "Console\%SystemRoot%_system32_cmd.exe" 
oReg.CreateKey HKEY_CURRENT_USER, strKeyPath
strValueName1 = "CodePage" 
dwValue1 = 936 
strValueName2 = "ScreenBufferSize" 
dwValue2 = 98304200 
strValueName3 = "WindowSize" 
dwValue3 = 2818173 
strValueName4 = "HistoryNoDup" 
dwValue4 = 0 
strValueName5 = "WindowPosition" 
dwValue5 = 131068 
strValueName6 = "QuickEdit" 
dwValue6 = 2048 
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName1, dwValue1
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName2, dwValue2 
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName3, dwValue3 
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName4, dwValue4 
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName5, dwValue5 
oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName6, dwValue6 

Dim objWSH, FinalPath 
Set objWSH = WScript.CreateObject("WScript.Shell") 
If (LCase(Right(WScript.Fullname, 11)) = "wscript.exe") Then 
FinalPath = "'" & WScript.ScriptFullName & "'" 
objWSH.Run("cmd.exe /k cscript //nologo " & Replace(FinalPath, "'", """")) 
WScript.Quit() 
End If 
oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath 
Set oReg = Nothing 
WScript.Echo() 
WScript.Sleep(1000) 
WScript.Echo("当前正在运行的进程简要信息列表如下:") 
WScript.Echo(vbCrLf) 
WScript.Sleep(2000) 
Dim MyOBJProcessName 
Set OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process") 
WScript.Echo "Name: Priority: PID: Owner:" &vbTab&vbTab&"ExecutablePath: " 
WScript.Echo("---------------------------------------------------------------------------------------") 
For Each OBJProcess In OBJWMIProcess 
MyOBJProcessName=OBJProcess.Name&" " 
colProperties = OBJProcess.GetOwner(strNameOfUser, strUserDomain) 
WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.Priority &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath 
Next 
WScript.Sleep(5000) 
WScript.Echo(vbCrLf) 
WScript.Echo("当前正在运行的进程以及其加载的模块详细信息树状结构如下:") 
WScript.Echo(vbCrLf) 
WScript.Sleep(3000) 
WScript.Echo vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab& vbTab&"创建时间 文件制造商" 
Set OBJWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") 
Set OBJRefresher = CreateObject("WbemScripting.SWbemRefresher") 
Set colItems = OBJRefresher.AddEnum(OBJWMIService, "Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSet 
OBJRefresher.Refresh() 
For Each OBJItem In colItems 
Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath 
Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath 
originalPath = OBJItem.Name 
ModulePath = Split(originalPath, "/") 
WMIPathMode = Replace(ModulePath(1), "\", "\\") 
Set OBJWMI = GetObject("winmgmts:\\.\root\CIMV2") 
Set colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='" & WMIPathMode & "'") 
For Each OBJManufacturer In colManufacturer 
FileManufacturer = Trim(OBJManufacturer.Manufacturer) 
LCaseModulePath = LCase(Trim(OBJManufacturer.Name)) 
FileExtension = Right(LCaseModulePath, 3) 
MyLCaseModulePath = LCaseModulePath & " " 
Set FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath) 
If FileExtension = "exe" Then 
mark = "├—" 
FinalModulePath = Mid(MyLCaseModulePath, 1, 118) 
WScript.Echo("│") 
WScript.Echo("│") 
Else 
mark = "│  ├─" 
FinalModulePath = Mid(MyLCaseModulePath, 1, 116) 
End If 
WScript.Echo mark & FinalModulePath & FSO.DateCreated &vbTab& FileManufacturer 
Next 
Next

第1楼　luckboy45	发表于 2009-10-12 20:50
中级用户　发帖 212　积分 487
获取DLL详细路径思路是先用TASKLIST /M列出所有进程调用的DLL，接着，用命令获取DLL的详细路径，并赋予给%%A 希望各位帮忙写出来，本人能力有限。

第2楼　luckboy45	发表于 2009-10-17 17:29
中级用户　发帖 212　积分 487
我希望能用系统自带命令实现，不依靠外部工具，希望各位帮忙实现！

第3楼　qinchun36	发表于 2009-10-17 17:55
高级用户　发帖 400　积分 609
收集自网络。保存为 .vbs 文件。 ' FileName: ProcessMagnifier.vbs ' Function: Capture information about the running processes in detail ' code by somebody ' QQ: 240460440 ' LastModified:2007-11-16 18:25 ' 仅供学习 Const HKEY_CURRENT_USER = &H80000001 Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv") strKeyPath = "Console\%SystemRoot%_system32_cmd.exe" oReg.CreateKey HKEY_CURRENT_USER, strKeyPath strValueName1 = "CodePage" dwValue1 = 936 strValueName2 = "ScreenBufferSize" dwValue2 = 98304200 strValueName3 = "WindowSize" dwValue3 = 2818173 strValueName4 = "HistoryNoDup" dwValue4 = 0 strValueName5 = "WindowPosition" dwValue5 = 131068 strValueName6 = "QuickEdit" dwValue6 = 2048 oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName1, dwValue1 oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName2, dwValue2 oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName3, dwValue3 oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName4, dwValue4 oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName5, dwValue5 oReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, strValueName6, dwValue6 Dim objWSH, FinalPath Set objWSH = WScript.CreateObject("WScript.Shell") If (LCase(Right(WScript.Fullname, 11)) = "wscript.exe") Then FinalPath = "'" & WScript.ScriptFullName & "'" objWSH.Run("cmd.exe /k cscript //nologo " & Replace(FinalPath, "'", """")) WScript.Quit() End If oReg.DeleteKey HKEY_CURRENT_USER, strKeyPath Set oReg = Nothing WScript.Echo() WScript.Sleep(1000) WScript.Echo("当前正在运行的进程简要信息列表如下:") WScript.Echo(vbCrLf) WScript.Sleep(2000) Dim MyOBJProcessName Set OBJWMIProcess = GetObject("winmgmts:\\.\root\cimv2").ExecQuery("Select * From Win32_Process") WScript.Echo "Name: Priority: PID: Owner:" &vbTab&vbTab&"ExecutablePath: " WScript.Echo("---------------------------------------------------------------------------------------") For Each OBJProcess In OBJWMIProcess MyOBJProcessName=OBJProcess.Name&" " colProperties = OBJProcess.GetOwner(strNameOfUser, strUserDomain) WScript.Echo Mid(MyOBJProcessName,1,20) &vbTab& OBJProcess.Priority &vbTab& OBJProcess.ProcessID &vbTab& strNameOfUser &vbTab&vbTab& OBJProcess.ExecutablePath Next WScript.Sleep(5000) WScript.Echo(vbCrLf) WScript.Echo("当前正在运行的进程以及其加载的模块详细信息树状结构如下:") WScript.Echo(vbCrLf) WScript.Sleep(3000) WScript.Echo vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab&vbTab& vbTab&"创建时间文件制造商" Set OBJWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") Set OBJRefresher = CreateObject("WbemScripting.SWbemRefresher") Set colItems = OBJRefresher.AddEnum(OBJWMIService, "Win32_PerfFormattedData_PerfProc_FullImage_Costly").ObjectSet OBJRefresher.Refresh() For Each OBJItem In colItems Dim originalPath, ModulePath, WMIPathMode, FileManufacturer, LCaseModulePath Dim FileExtension, mark, MyLCaseModulePath, FinalModulePath originalPath = OBJItem.Name ModulePath = Split(originalPath, "/") WMIPathMode = Replace(ModulePath(1), "\", "\\") Set OBJWMI = GetObject("winmgmts:\\.\root\CIMV2") Set colManufacturer = OBJWMI.ExecQuery("SELECT * FROM CIM_DataFile Where Name='" & WMIPathMode & "'") For Each OBJManufacturer In colManufacturer FileManufacturer = Trim(OBJManufacturer.Manufacturer) LCaseModulePath = LCase(Trim(OBJManufacturer.Name)) FileExtension = Right(LCaseModulePath, 3) MyLCaseModulePath = LCaseModulePath & " " Set FSO = CreateObject("Scripting.FileSystemObject").GetFile(LCaseModulePath) If FileExtension = "exe" Then mark = "├—" FinalModulePath = Mid(MyLCaseModulePath, 1, 118) WScript.Echo("│") WScript.Echo("│") Else mark = "│ ├─" FinalModulePath = Mid(MyLCaseModulePath, 1, 116) End If WScript.Echo mark & FinalModulePath & FSO.DateCreated &vbTab& FileManufacturer Next Next 附件 ProcessMagnifier.zip (1.6 KiB)

第4楼　luckboy45	发表于 2009-10-17 18:10
中级用户　发帖 212　积分 487
呵呵，感谢兄弟，用的WMIC哈，呵呵，学习了！感谢分享！~ 期待有P处理调用WMIC实现的版本出现。

第5楼　qinchun36	发表于 2009-10-17 18:28
高级用户　发帖 400　积分 609
http://www.cn-dos.net/forum/blog.php?tid=38897&uid=114210

第6楼　mountvol	发表于 2009-10-17 21:28
初级用户　发帖 117　积分 186
Originally posted by luckboy45 at 2009-10-17 18:10: 呵呵，感谢兄弟，用的WMIC哈，呵呵，学习了！感谢分享！~ 期待有P处理调用WMIC实现的版本出现。试试wmic path Win32_PerfFormattedData_PerfProc_FullImage_Costly 或 wmic class Win32_PerfFormattedData_PerfProc_FullImage_Costly能得到什么结果。我这里装的GHOST版的XP没用，包括以前用vbs写的都执行错误。