VBS列出进程加载的DLL的完整路径

标签: , , ,

VBScript调用WMI列出进程加载的所有DLL的完整路径。

'By powerbat @ www.bathome.net
'listdll.vbs ver 1.0 - List DLLs loaded in process.
set args = WScript.Arguments
if args.length=0 then show_usage(0)
s = "Name='"
for each arg in args
  s = s & arg & "' OR Name='"
next
s = s & "'"
s = Replace(s, "OR Name=''", "", 1, 1, 1)
Set objWMIServices = GetObject("winmgmts:\\.\root\cimv2")
Set colProcs = objWMIServices.ExecQuery(_
    "select * from Win32_Process where (" & s & ")")
for each objProc in colProcs
  WScript.Echo "pid="& objProc.ProcessId, objProc.Name
  WScript.Echo objProc.CommandLine
  WScript.Echo String(79, "-")
  Set colFiles = objWMIServices.ExecQuery("ASSOCIATORS OF {CIM_Process='"_
    & objProc.Handle & "'} where "_
    & "AssocClass = CIM_ProcessExecutable ResultClass = CIM_DataFile")
  For Each objFile In colFiles
    WScript.Echo objFile.Name
  Next
  WScript.Echo String(79, "=")
next

sub show_usage(flag)
  WScript.Echo "usage: cscript " & WScript.ScriptName & " ProcessName[ ProcessName]..."
  if flag=0 then WScript.Quit
end sub

原文链接:http://bbs.bathome.net/viewthread.php?tid=15724

赞赏

微信赞赏支付宝赞赏

随机文章:

  1. 48行计算24点C语言代码
  2. 利用WMI打造完美“三无”后门-Downloader and Uploader
  3. Asc/AscB/AscW和Chr/ChrB/ChrW函数之间的区别
  4. bb_register_plugin_activation_hook函数——bbPress的BUG
  5. PowerISO 5.7 注册码

留下回复