使用 VBScript 合並所有打開的 Notepad.exe 實例並保存到 txt 文件

Question

我正在 vbscript 中尋找一種方法來查找 notepad.exe 的任何打開實例，從中復制文本並創建一個包含所有這些內容的新文件並保存它。

我已經制定了代碼來實際找到正在運行的實例，只是無法找到一種方法來從中復制文本！

Dim objWMIService, objProcess, colProcess,WshShell
Dim strComputer, strList
strComputer = "."
Set WshShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") 
Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process")
For Each objProcess in colProcess
    if objProcess.Name = "notepad.exe" then
        msgbox objProcess.processID
        WshShell.AppActivate (objProcess.processID)
        'copy the text from notepad into a new file....
    end if
Next

Answer 1

試一試並告訴我結果：

Option Explicit
Dim Title,colItems,objItem,FilePath,ws
Dim MyProcess,LogFile,fso,Contents
MyProcess = "Notepad.exe"
Title = "Merge all open instances of "& DblQuote(MyProcess) &" and save it to a text file"
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject("WScript.Shell")
LogFile = Left(Wscript.ScriptFullName, InstrRev(Wscript.ScriptFullName, ".")) & "txt"
If fso.FileExists(LogFile) Then
    fso.DeleteFile(LogFile)
End If
Set colItems = GetObject("winmgmts:").ExecQuery("Select * from Win32_Process " _
& "Where Name like '%"& MyProcess &"%' AND NOT commandline like '%" & wsh.scriptname & "%'",,48)
For Each objItem in colItems
    FilePath = Mid(objItem.CommandLine,InStr(objItem.CommandLine,chr(34)) + 33) 
    FilePath = Replace(FilePath,chr(34),"")
    FilePath = Trim(FilePath)
    If Len(FilePath) > 0 Then   
        Contents = ReadFile(FilePath,"all")
        Call WriteLog(Contents,LogFile)
    End If  
Next
If fso.FileExists(LogFile) Then
    ws.run DblQuote(LogFile)
Else
    MsgBox "No running instances found for this process " &_
    DblQuote(MyProcess),vbExclamation,Title
End If  
'**************************************************
Function DblQuote(Str)
    DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************
Function ReadFile(path,mode)
    Const ForReading = 1
    Dim objFSO,objFile,i,strLine
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.OpenTextFile(path,ForReading)
    If mode = "byline" then
        Dim arrFileLines()
        i = 0
        Do Until objFile.AtEndOfStream
            Redim Preserve arrFileLines(i)
            strLine = objFile.ReadLine
            strLine = Trim(strLine)
            If Len(strLine) > 0 Then
                arrFileLines(i) = strLine
                i = i + 1
                ReadFile = arrFileLines
            End If  
        Loop
        objFile.Close
    End If
    If mode = "all" then
        ReadFile = objFile.ReadAll
        objFile.Close
    End If
End Function
'***************************************************
Sub WriteLog(strText,LogFile)
    Dim fso,ts 
    Const ForAppending = 8
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set ts = fso.OpenTextFile(LogFile,ForAppending,True,-1)
    ts.WriteLine strText
    ts.Close
End Sub
'***************************************************

編輯於 31/03/2016 @10:45

我認為第二個代碼可用於檢測和編輯在后台運行的任何類型的 vbscript！

假設后台運行的vbscript是病毒，那么，我們可以定位到它的路徑，編輯並復制它的來源（-_°）

Option Explicit
Dim Title,colItems,objItem,FilePath,ws
Dim MyProcess,LogFile,fso,Contents
MyProcess = "wscript.exe"
Title = "Search for all instances of "& DblQuote(MyProcess) &" and save it to a text file"
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject("WScript.Shell")
LogFile = Left(Wscript.ScriptFullName, InstrRev(Wscript.ScriptFullName, ".")) & "txt"
If fso.FileExists(LogFile) Then
    fso.DeleteFile(LogFile)
End If
Set colItems = GetObject("winmgmts:").ExecQuery("Select * from Win32_Process " _
& "Where Name like '%"& MyProcess &"%' AND NOT commandline like '%" & wsh.scriptname & "%'",,48)
For Each objItem in colItems
    FilePath = Mid(objItem.CommandLine,InStr(objItem.CommandLine,chr(34)) + 33) 
    FilePath = Replace(FilePath,chr(34),"")
    FilePath = Trim(FilePath)
    If Len(FilePath) > 0 Then   
        Contents = ReadFile(FilePath,"all")
        Call WriteLog(DblQuote(FilePath) & vbCrlf & String(100,"*") & vbCrlf &_
        Contents & vbCrlf & String(100,"*") & vbCrlf,LogFile)
    End If  
Next
If fso.FileExists(LogFile) Then
    ws.run DblQuote(LogFile)
Else
    MsgBox "No running instances found for this process " &_
    DblQuote(MyProcess),vbExclamation,Title
End If  
'**************************************************
Function DblQuote(Str)
    DblQuote = Chr(34) & Str & Chr(34)
End Function
'**************************************************
Function ReadFile(path,mode)
    Const ForReading = 1
    Dim objFSO,objFile,i,strLine
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.OpenTextFile(path,ForReading)
    If mode = "byline" then
        Dim arrFileLines()
        i = 0
        Do Until objFile.AtEndOfStream
            Redim Preserve arrFileLines(i)
            strLine = objFile.ReadLine
            strLine = Trim(strLine)
            If Len(strLine) > 0 Then
                arrFileLines(i) = strLine
                i = i + 1
                ReadFile = arrFileLines
            End If  
        Loop
        objFile.Close
    End If
    If mode = "all" then
        ReadFile = objFile.ReadAll
        objFile.Close
    End If
End Function
'***************************************************
Sub WriteLog(strText,LogFile)
    Dim fso,ts 
    Const ForAppending = 8
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set ts = fso.OpenTextFile(LogFile,ForAppending,True,-1)
    ts.WriteLine strText
    ts.Close
End Sub
'***************************************************

Answer 2

我創造了一些有用的東西 - 它有點粗糙，但可以完成工作！ 它本質上使用發送鍵依次恢復每個記事本，復制文本，關閉文件而不保存，然后將內容粘貼到新創建的“主”文本文件中。 不過一定有更好的方法！

Dim objWMIService, objProcess, colProcess,WshShell
Dim strComputer, strList
strComputer = "."
Set WshShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") 
Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process")
dim counter
counter=0
dim newid
For Each objProcess in colProcess

    if objProcess.Name = "notepad.exe" and objProcess.processID<>newid then
        counter=counter+1
        if counter=1 then
            Dim fso, MyFile
            Set fso = CreateObject("Scripting.FileSystemObject")
            strPath = WshShell.SpecialFolders("Desktop")&"\"&serial&".txt"
            Set MyFile = fso.CreateTextFile(strPath, True)
            MyFile.Close    
            Set EngineRun = WshShell.exec("notepad.exe " & strPath)
            newid=EngineRun.ProcessID 
            WshShell.AppActivate(newid)
        end if
        'msgbox objProcess.processID
        WshShell.AppActivate (objProcess.processID)
        WScript.Sleep 500
        WshShell.sendkeys "% r"  

        WScript.Sleep 500
        WshShell.sendkeys "%E"                   ' edit
        WScript.sleep 500
        WshShell.sendkeys "a"
        WScript.sleep 500
        WshShell.sendkeys "%E"                   ' edit
        WScript.sleep 500
        WshShell.sendkeys "c"
        WScript.sleep 500

        WScript.sleep 500
        WshShell.sendkeys "%F"                   ' edit
        WScript.sleep 500
        WshShell.sendkeys "x"
        WScript.sleep 500
        WshShell.sendkeys "n"
        WScript.sleep 500

        WshShell.AppActivate (newid)

        WScript.sleep 500
        WshShell.sendkeys vbNewLine & " --- " & objProcess.CommandLine & " --- " & vbNewLine

        WScript.sleep 500
        WshShell.sendkeys "%E"                   ' edit
        WScript.sleep 500
        WshShell.sendkeys "p"
    end if
Next
WshShell.AppActivate (newid)

WScript.sleep 500
WshShell.sendkeys "%F"                   ' edit
WScript.sleep 500
WshShell.sendkeys "s"
WScript.sleep 500
WScript.sleep 500
WshShell.sendkeys "%F"                   ' edit
WScript.sleep 500
WshShell.sendkeys "x"
WScript.sleep 500


function serial()
    strSafeDate = DatePart("yyyy",Date) & Right("0" & DatePart("m",Date), 2) & Right("0" & DatePart("d",Date), 2)
    strSafeTime = Right("0" & Hour(Now), 2) & Right("0" & Minute(Now), 2) & Right("0" & Second(Now), 2)
    strDateTime = strSafeDate & strSafeTime
    serial=strDateTime
end function