somebody

1. 走我的老路~~~~~想当初为这个问题浪费N 多精力，狂想突破批处理瓶脊，发现自己是傻瓜....VBS解救了我.
   tasklist 和 msinfo32
  tasklist 得到的信息不详细，比如DLL全路径,你用批处理很难得到（全面的）
至于msinfo32 ，运行完我都吃完一餐了。想以前我狂研究这个令人郁闷的东西
2. 一发出来马上高亮，厉害！"forJL出品，必属精品" 是不是这样吖 youxi01
3. 若你真正有兴趣研究安全问题....本论坛的关于进程的精华贴你看过后绝对有收获，就算看了没收获，用过后你也会有另翻想法...

[ 本帖最后由 somebody 于 2008-1-8 00:19 编辑 ]

somebody

我帮你测试一下...

  1.显示进程及所被调用的模块(简洁)

  2.通过进程查找并列出所调用的模块(包括模块详细信息)

  3.通过模块找到所调用它的进程

  4.结束进程

  请输入选项:1
复制代码

结果:

"System Idle Process","0","暂缺"
"System","4","暂缺"
"smss.exe","688","ntdll.dll"
"csrss.exe","756","ntdll.dll,CSRSRV.dll,basesrv.dll,winsrv.dll,USER32.dll,KERNEL
32.dll,GDI32.dll,LPK.DLL,USP10.dll,msvcrt.dll,ADVAPI32.dll,RPCRT4.dll,sxs.dll,Ap
phelp.dll,VERSION.dll"
"winlogon.exe","780","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,AUTHZ.dll,m
svcrt.dll,CRYPT32.dll,USER32.dll,GDI32.dll,MSASN1.dll,NDdeApi.dll,PROFMAP.dll,NE
TAPI32.dll,USERENV.dll,PSAPI.DLL,REGAPI.dll,Secur32.dll,SETUPAPI.dll,VERSION.dll
,WINSTA.dll,WINTRUST.dll,IMAGEHLP.dll,WS2_32.dll,WS2HELP.dll,IMM32.DLL,LPK.DLL,U
SP10.dll,MSGINA.dll,SHELL32.dll,SHLWAPI.dll,COMCTL32.dll,ODBC32.dll,comdlg32.dll
,comctl32.dll,odbcint.dll,SHSVCS.dll,sfc.dll,sfc_os.dll,ole32.dll,Apphelp.dll,ms
ctfime.ime,sxs.dll,WINSCARD.DLL,WTSAPI32.dll,uxtheme.dll,WINMM.dll,cscdll.dll,kl
ogon.dll,rsaenh.dll,WlNotify.dll,WINSPOOL.DRV,MPR.dll,SAMLIB.dll,msv1_0.dll,iphl
papi.dll,wldap32.dll,cscui.dll,xpsp2res.dll,NTMARTA.DLL,wdmaud.drv,msacm32.drv,M
SACM32.dll,midimap.dll,COMRes.dll,OLEAUT32.dll,CLBCATQ.DLL,wbemprox.dll,wbemcomn
.dll,wbemsvc.dll,fastprox.dll,MSVCP60.dll,NTDSAPI.dll,DNSAPI.dll"
"services.exe","824","ntdll.dll,kernel32.dll,msvcrt.dll,ADVAPI32.dll,RPCRT4.dll,
USER32.dll,GDI32.dll,USERENV.dll,SCESRV.dll,AUTHZ.dll,umpnpmgr.dll,WINSTA.dll,NE
TAPI32.dll,NCObjAPI.DLL,MSVCP60.dll,ShimEng.dll,AcGenral.DLL,WINMM.dll,ole32.dll
,OLEAUT32.dll,MSACM32.dll,VERSION.dll,SHELL32.dll,SHLWAPI.dll,UxTheme.dll,IMM32.
DLL,LPK.DLL,USP10.dll,comctl32.dll,comctl32.dll,secur32.dll,Apphelp.dll,eventlog
.dll,WS2_32.dll,WS2HELP.dll,PSAPI.DLL,wtsapi32.dll"
"lsass.exe","836","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,LSASRV.dll,msv
crt.dll,Secur32.dll,USER32.dll,GDI32.dll,SAMSRV.dll,cryptdll.dll,DNSAPI.dll,WS2_
32.dll,WS2HELP.dll,MSASN1.dll,NETAPI32.dll,SAMLIB.dll,MPR.dll,NTDSAPI.dll,WLDAP3
2.dll,ShimEng.dll,AcGenral.DLL,WINMM.dll,ole32.dll,OLEAUT32.dll,MSACM32.dll,VERS
ION.dll,SHELL32.dll,SHLWAPI.dll,USERENV.dll,UxTheme.dll,IMM32.DLL,LPK.DLL,USP10.
dll,comctl32.dll,comctl32.dll,msprivs.dll,kerberos.dll,msv1_0.dll,iphlpapi.dll,n
etlogon.dll,w32time.dll,MSVCP60.dll,schannel.dll,CRYPT32.dll,wdigest.dll,rsaenh.
dll,setupapi.dll,scecli.dll,ipsecsvc.dll,AUTHZ.dll,oakley.DLL,WINIPSEC.DLL,pstor
svc.dll,mswsock.dll,hnetcfg.dll,wshtcpip.dll,psbase.dll,dssenh.dll,iissuba.dll"
"svchost.exe","1000","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,ShimEng.dll
,AcGenral.DLL,USER32.dll,GDI32.dll,WINMM.dll,ole32.dll,msvcrt.dll,OLEAUT32.dll,M
SACM32.dll,VERSION.dll,SHELL32.dll,SHLWAPI.dll,USERENV.dll,UxTheme.dll,IMM32.DLL
,LPK.DLL,USP10.dll,comctl32.dll,comctl32.dll,NTMARTA.DLL,WLDAP32.dll,SAMLIB.dll,
rpcss.dll,WS2_32.dll,WS2HELP.dll,Secur32.dll,xpsp2res.dll,CLBCATQ.DLL,COMRes.dll
,termsrv.dll,ICAAPI.dll,SETUPAPI.dll,WINTRUST.dll,CRYPT32.dll,MSASN1.dll,IMAGEHL
P.dll,AUTHZ.dll,mstlsapi.dll,ACTIVEDS.dll,adsldpc.dll,NETAPI32.dll,ATL.DLL,REGAP
I.dll,rsaenh.dll,rdpwsx.dll,WINSPOOL.DRV,Apphelp.dll,WTSAPI32.dll,WINSTA.dll,msv
1_0.dll,iphlpapi.dll"
"svchost.exe","1060","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,ShimEng.dll
,AcGenral.DLL,USER32.dll,GDI32.dll,WINMM.dll,ole32.dll,msvcrt.dll,OLEAUT32.dll,M
SACM32.dll,VERSION.dll,SHELL32.dll,SHLWAPI.dll,USERENV.dll,UxTheme.dll,IMM32.DLL
,LPK.DLL,USP10.dll,comctl32.dll,comctl32.dll,rpcss.dll,WS2_32.dll,WS2HELP.dll,Se
cur32.dll,xpsp2res.dll,rsaenh.dll,mswsock.dll,hnetcfg.dll,wshtcpip.dll,DNSAPI.dl
l,iphlpapi.dll,winrnr.dll,WLDAP32.dll,rasadhlp.dll,CLBCATQ.DLL,COMRes.dll,msi.dl
l"
"svchost.exe","1388","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,ShimEng.dll
,AcGenral.DLL,USER32.dll,GDI32.dll,WINMM.dll,ole32.dll,msvcrt.dll,OLEAUT32.dll,M
SACM32.dll,VERSION.dll,SHELL32.dll,SHLWAPI.dll,USERENV.dll,UxTheme.dll,IMM32.DLL
,LPK.DLL,USP10.dll,comctl32.dll,comctl32.dll,NTMARTA.DLL,WLDAP32.dll,SAMLIB.dll,
xpsp2res.dll,shsvcs.dll,WINSTA.dll,NETAPI32.dll,dhcpcsvc.dll,DNSAPI.dll,WS2_32.d
ll,WS2HELP.dll,iphlpapi.dll,Secur32.dll,rsaenh.dll,wzcsvc.dll,rtutils.dll,WMI.dl
l,CRYPT32.dll,MSASN1.dll,WTSAPI32.dll,ESENT.dll,ATL.DLL,schedsvc.dll,NTDSAPI.dll
,IMAGEHLP.dll,rastls.dll,CRYPTUI.dll,WINTRUST.dll,WININET.dll,MPRAPI.dll,ACTIVED
S.dll,adsldpc.dll,SETUPAPI.dll,RASAPI32.dll,rasman.dll,TAPI32.dll,SCHANNEL.dll,W
inSCard.dll,raschap.dll,msv1_0.dll,MSIDLE.DLL,audiosrv.dll,wkssvc.dll,cryptsvc.d
ll,certcli.dll,pchsvc.dll,es.dll,COMRes.dll,CLBCATQ.DLL,ersvc.dll,dmserver.dll,s
rvsvc.dll,netman.dll,netshell.dll,credui.dll,WZCSAPI.DLL,trkwks.dll,srsvc.dll,PO
WRPROF.dll,sens.dll,seclogon.dll,HNETCFG.DLL,wmisvc.dll,VSSAPI.DLL,SXS.DLL,w32ti
me.dll,MSVCP60.dll,ipnathlp.dll,MSWSOCK.dll,AUTHZ.dll,wscsvc.dll,msi.dll,wshtcpi
p.dll,comsvcs.dll,MTXCLU.DLL,WSOCK32.dll,colbact.DLL,CLUSAPI.DLL,RESUTILS.DLL,br
owser.dll,wbemcomn.dll,wbemcore.dll,esscli.dll,FastProx.dll,upnp.dll,WINHTTP.dll
,SSDPAPI.dll,wmiutils.dll,rasadhlp.dll,repdrvfs.dll,wmiprvsd.dll,NCObjAPI.DLL,wb
emess.dll,netcfgx.dll,rasmans.dll,WINIPSEC.DLL,tapisrv.dll,PSAPI.DLL,rastapi.dll
,unimdm.tsp,uniplat.dll,ncprov.dll,kmddsp.tsp,ndptsp.tsp,ipconf.tsp,h323.tsp,hid
phone.tsp,HID.DLL,rasppp.dll,ntlsapi.dll,kerberos.dll,cryptdll.dll,RASDLG.dll,ms
xml3.dll,urlmon.dll,wbemsvc.dll"
"svchost.exe","1460","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,ShimEng.dll
,AcGenral.DLL,USER32.dll,GDI32.dll,WINMM.dll,ole32.dll,msvcrt.dll,OLEAUT32.dll,M
SACM32.dll,VERSION.dll,SHELL32.dll,SHLWAPI.dll,USERENV.dll,UxTheme.dll,IMM32.DLL
,LPK.DLL,USP10.dll,comctl32.dll,comctl32.dll,dnsrslvr.dll,DNSAPI.dll,WS2_32.dll,
WS2HELP.dll,iphlpapi.dll,mswsock.dll,hnetcfg.dll,wshtcpip.dll"
"svchost.exe","1620","ntdll.dll,kernel32.dll,ADVAPI32.dll,RPCRT4.dll,ShimEng.dll
,AcGenral.DLL,USER32.dll,GDI32.dll,WINMM.dll,ole32.dll,msvcrt.dll,OLEAUT32.dll,M
SACM32.dll,VERSION.dll,SHELL32.dll,SHLWAPI.dll,USERENV.dll,UxTheme.dll,IMM32.DLL
,LPK.DLL,USP10.dll,comctl32.dll,comctl32.dll,NTMARTA.DLL,WLDAP32.dll,SAMLIB.dll,
xpsp2res.dll,lmhsvc.dll,iphlpapi.dll,WS2_32.dll,WS2HELP.dll,webclnt.dll,WININET.
dll,CRYPT32.dll,MSASN1.dll,Secur32.dll,urlmon.dll,wsock32.dll,ssdpsrv.dll,hnetcf
g.dll,CLBCATQ.DLL,COMRes.dll,mswsock.dll,wshtcpip.dll,rsaenh.dll,httpapi.dll,WIN
HTTP.dll,DNSAPI.dll,rasadhlp.dll,RASAPI32.DLL,rasman.dll,NETAPI32.dll,TAPI32.dll
,rtutils.dll,msv1_0.dll,sensapi.dll"
"stormliv.exe","236","ntdll.dll,kernel32.dll,SHLWAPI.dll,msvcrt.dll,GDI32.dll,US
ER32.dll,ADVAPI32.dll,RPCRT4.dll,WS2_32.dll,WS2HELP.dll,MSVCP60.dll,MFC42.DLL,co
mdlg32.dll,COMCTL32.dll,SHELL32.dll,ole32.dll,OLEAUT32.dll,VERSION.dll,SETUPAPI.
dll,WININET.dll,CRYPT32.dll,MSASN1.dll,IMM32.DLL,LPK.DLL,USP10.dll,MFC42LOC.DLL,
uxtheme.dll,xpsp2res.dll,mswsock.dll,hnetcfg.dll,wshtcpip.dll,CLBCATQ.DLL,COMRes
.dll,DNSAPI.dll,msxml3.dll,winrnr.dll,WLDAP32.dll,rasadhlp.dll,urlmon.dll,mlang.
dll,Secur32.dll"
"explorer.exe","436","ntdll.dll,kernel32.dll,msvcrt.dll,ADVAPI32.dll,RPCRT4.dll,
GDI32.dll,USER32.dll,SHLWAPI.dll,SHELL32.dll,ole32.dll,OLEAUT32.dll,BROWSEUI.dll
,SHDOCVW.dll,CRYPT32.dll,MSASN1.dll,CRYPTUI.dll,WINTRUST.dll,IMAGEHLP.dll,NETAPI
32.dll,WININET.dll,WLDAP32.dll,VERSION.dll,UxTheme.dll,ShimEng.dll,AcGenral.DLL,
WINMM.dll,MSACM32.dll,USERENV.dll,IMM32.DLL,LPK.DLL,USP10.dll,comctl32.dll,comct
l32.dll,apphelp.dll,msctfime.ime,CLBCATQ.DLL,COMRes.dll,cscui.dll,CSCDLL.dll,the
meui.dll,Secur32.dll,MSIMG32.dll,xpsp2res.dll,scrchpg.dll,msutb.dll,MSCTF.dll,SA
MLIB.dll,SETUPAPI.dll,LINKINFO.dll,ntshrui.dll,ATL.DLL,urlmon.dll,NETSHELL.dll,r
tutils.dll,credui.dll,WS2_32.dll,WS2HELP.dll,iphlpapi.dll,msi.dll,WINSTA.dll,web
check.dll,WSOCK32.dll,safemon.dll,stobject.dll,BatMeter.dll,POWRPROF.dll,WTSAPI3
2.dll,wdmaud.drv,msacm32.drv,midimap.dll,nvcpl.dll,comdlg32.dll,WINSPOOL.DRV,OLE
ACC.dll,MSVCP60.dll,NTMARTA.DLL,nvshell.dll,rsaenh.dll,MPR.dll,drprov.dll,ntlanm
an.dll,NETUI0.dll,NETUI1.dll,NETRAP.dll,davclnt.dll,SXS.DLL,shdoclc.dll,Unlocker
COM.dll,rarext.dll,nppcm.dll,ShellEx.dll,MSVCR80.dll,MSVCP80.dll,browselc.dll,DU
SER.dll,MSGINA.dll,ODBC32.dll,odbcint.dll,MLANG.dll,winabc.ime,jscript.dll,klsca
v.dll,gdiplus.dll,mscms.dll,mydocs.dll,prremote.dll,prloader.dll,quartz.dll,msdm
o.dll,l3codeca.acm,RASAPI32.DLL,rasman.dll,TAPI32.dll,msv1_0.dll,sensapi.dll,MSV
FW32.dll,wmvcore.dll,wmidx.dll,WMASF.DLL,DRMClien.DLL,shimgvw.dll,actxprxy.dll,z
ipfldr.dll,sendmail.dll,shgina.dll"
"inetinfo.exe","504","ntdll.dll,kernel32.dll,msvcrt.dll,ADVAPI32.dll,RPCRT4.dll,
USER32.dll,GDI32.dll,ole32.dll,IisRTL.DLL,WS2_32.dll,WS2HELP.dll,IMM32.DLL,LPK.D
LL,USP10.dll,rpcref.dll,iisadmin.dll,VSSAPI.DLL,ATL.DLL,OLEAUT32.dll,NETAPI32.dl
l,COADMIN.dll,SHELL32.dll,SHLWAPI.dll,ADMWPROX.dll,comctl32.dll,comctl32.dll,uxt
heme.dll,xpsp2res.dll,CLBCATQ.DLL,COMRes.dll,VERSION.dll,metadata.dll,rsaenh.dll
,CRYPT32.dll,MSASN1.dll,nsepm.dll,IISMAP.dll,schannel.dll,Secur32.dll,USERENV.dl
l,wamreg.dll,admexs.dll,svcext.dll,Security.dll,SAMLIB.dll,SMTPSVC.dll,INFOCOMM.
dll,ISATQ.dll,IISFECNV.dll,WSOCK32.dll,DNSAPI.dll,FCACHDLL.dll,RWNH.dll,exstrace
.dll,STAXMEM.dll,NTDSAPI.dll,WLDAP32.dll,w3svc.dll,lonsint.dll,mswsock.dll,hnetc
fg.dll,wshtcpip.dll,wintrust.dll,IMAGEHLP.dll,iscomlog.dll,sspifilt.dll,seo.dll,
iphlpapi.dll,compfilt.dll,aqueue.dll,gzip.dll,pwsdata.dll,md5filt.dll,wdigest.dl
l,httpext.dll,iislog.dll"

所有进程及所被调用的模块显示完毕.按任意键返回.
复制代码

这样子看毛.....我宁愿去看小说..

somebody

原帖由 随风 于 2008-1-8 00:24 发表
原来纯批也可以做到这么厉害，佩服！！！

厉个鬼~~~
几百年前我somebody不是在狂跟你研究这个问题吖，普通人，你就忘了....

somebody

原帖由 foxJL 于 2008-1-8 01:17 发表
因为网页不能处理tab,都用了空格代替
下面代码红色部分应该是TAB:
for /f "delims=tab  tokens=1,6" %%j in ('type particular.txt ^| find /i "%%i"') d ...

---------------------------------------------------------------------------------------------------------------------
哈，不是网页不能处理tab，是CMD里你用不了tab,制表符你得用VBS操作
可不就是了，用批处理来处理msinfo32导出来的文本，那个结果我想连你自己都看不下去....
虽然你把CMD窗口调大了...
执行效率也是个大问题..

以下是测试时出错截图...查的是调用指定DLL的所有进程，出来的却是DLL。这东西不就是用tasklist，真正用到的技术含量不怎么有.
有的是你在处理过程中用到的批处理语法功底..

somebody

开玩笑，比我的VBS快！
你获取的是单个进程调用的模块
我获取的是所有进程调用的模块````这什么概念来的
而且我整个过程是动态的，而你调用msinfo32时等个半天，人家以为没响应会关掉。
----------------------------------------------------------------
功能3是列出进程
你列出DLL做什么..!
------------------------------------------------------------------
我图都截出来了，你还能怎么说，你那些代码是文本来的，你截图出来看看吖
别乱说什么代码编辑器
我直接用记事本保存你的代码，双击自然用CMD解析
不要说什么代码编辑器问题...排版就是这样乱，你那个好看的，除非是你改过代码..
----------------------------------------------------------------------------------------------------
你说做美观就是搞无谓的细节，你这不是在讽刺我..你做不了美化就别说别人...
人家做美化还不是为了别人用着舒服，这是搞安全批处理，你做出来不美观，不方便人家分析，你懂不！搞出来若跟垃圾一样难看，谁还想用....
-----------------------------------------------------------------------------------------
贴子不是发出来给我somebody和你foxJL两个人看的...不是你不理会人家其他人就不会判断..

[ 本帖最后由 somebody 于 2008-1-8 18:43 编辑 ]