VBS列出进程加载的DLL的完整路径

powerbat

VBScript调用WMI列出进程加载的所有DLL的完整路径。
如需转载请注明出处。
http://www.bathome.net/thread-15724-1-1.html

1. 'By powerbat @ www.bathome.net
   
2. 'listdll.vbs ver 1.0 - List DLLs loaded in process.
   
3. set args = WScript.Arguments
   
4. if args.length=0 then show_usage(0)
   
5. s = "Name='"
   
6. for each arg in args
   
7.   s = s & arg & "' OR Name='"
   
8. next
   
9. s = s & "'"
   
10. s = Replace(s, "OR Name=''", "", 1, 1, 1)
    
11. Set objWMIServices = GetObject("winmgmts:\\.\root\cimv2")
    
12. Set colProcs = objWMIServices.ExecQuery(_
    
13.     "select * from Win32_Process where (" & s & ")")
    
14. for each objProc in colProcs
    
15.   WScript.Echo "pid="& objProc.ProcessId, objProc.Name
    
16.   WScript.Echo objProc.CommandLine
    
17.   WScript.Echo String(79, "-")
    
18.   Set colFiles = objWMIServices.ExecQuery("ASSOCIATORS OF {CIM_Process='"_
    
19.     & objProc.Handle & "'} where "_
    
20.     & "AssocClass = CIM_ProcessExecutable ResultClass = CIM_DataFile")
    
21.   For Each objFile In colFiles
    
22.     WScript.Echo objFile.Name
    
23.   Next
    
24.   WScript.Echo String(79, "=")
    
25. next
    
26. 
    
27. sub show_usage(flag)
    
28.   WScript.Echo "usage: cscript " & WScript.ScriptName & " ProcessName[ ProcessName]..."
    
29.   if flag=0 then WScript.Quit
    
30. end sub

复制代码

powerbat

还有两个WMI类可以获取DLL的完整路径：
Win32_PerfRawData_PerfProc_FullImage_Costly
Win32_PerfFormattedData_PerfProc_FullImage_Costly