AutoIt Français

Code : Tout sélectionner

#include <Array.au3>
#include <File.au3>
Global $avRET = _ProcessListProperties()

Local $sFile = @Tempdir & "\Test.txt"
_FileWriteFromArray($sFile, $avRET, 1)
Local $hFile = FileOpen($sFile, 1)
_FileWriteFromArray($hFile, 1)
FileClose($hFile)
Run("notepad.exe " & $sFile)

Func _ProcessListProperties($Process = "", $sComputer = ".")
    Local $sUserName, $sMsg, $sUserDomain, $avProcs, $dtmDate
    Local $avProcs[1][2] = [[0, ""]], $n = 1
    If StringIsInt($Process) Then $Process = Int($Process)
    $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy, (Debug)}!\\" & $sComputer & "\root\cimv2")
    If IsObj($oWMI) Then
        If $Process == "" Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process")
        ElseIf IsInt($Process) Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process where ProcessId = " & $Process)
        Else
            $colProcs = $oWMI.ExecQuery("select * from win32_process where Name = '" & $Process & "'")
        EndIf
        If IsObj($colProcs) Then
            If $colProcs.count = 0 Then Return $avProcs
            ReDim $avProcs[$colProcs.count + 1][10]
            $avProcs[0][0] = UBound($avProcs) - 1
            For $oProc In $colProcs
                $avProcs[$n][1] = " - " & $oProc.name
                $avProcs[$n][0] = " . " & $oProc.ProcessId
                $avProcs[$n][2] = " - " & $oProc.CommandLine & ' - MD5 - ' ; ?
                $n += 1
            Next
        Else
            SetError(2); Error getting process collection from WMI
        EndIf
    EndIf
    Return $avProcs
EndFunc  ;==>_ProcessListProperties

Code : Tout sélectionner

; #FUNCTION# ;===============================================================================
; Name...........: _MD5ForFile
; Description ...: Calculates MD5 value for the specific file.
; Syntax.........: _MD5ForFile ($sFile)
; Parameters ....: $sFile - Full path to the file to process.
; Return values .: Success - Returns MD5 value in form of hex string
;                          - Sets @error to 0
;                  Failure - Returns empty string and sets @error:
;                  |1 - CreateFile function or call to it failed.
;                  |2 - CreateFileMapping function or call to it failed.
;                  |3 - MapViewOfFile function or call to it failed.
;                  |4 - MD5Init function or call to it failed.
;                  |5 - MD5Update function or call to it failed.
;                  |6 - MD5Final function or call to it failed.
; Author ........: trancexx
;==========================================================================================
Func _MD5ForFile($sFile)

    Local $a_hCall = DllCall("kernel32.dll", "hwnd", "CreateFileW", _
            "wstr", $sFile, _
            "dword", 0x80000000, _ ; GENERIC_READ
            "dword", 1, _ ; FILE_SHARE_READ
            "ptr", 0, _
            "dword", 3, _ ; OPEN_EXISTING
            "dword", 0, _ ; SECURITY_ANONYMOUS
            "ptr", 0)

    If @error Or $a_hCall[0] = -1 Then
        Return SetError(1, 0, "")
    EndIf

    Local $hFile = $a_hCall[0]

    $a_hCall = DllCall("kernel32.dll", "ptr", "CreateFileMappingW", _
            "hwnd", $hFile, _
            "dword", 0, _ ; default security descriptor
            "dword", 2, _ ; PAGE_READONLY
            "dword", 0, _
            "dword", 0, _
            "ptr", 0)

    If @error Or Not $a_hCall[0] Then
        DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFile)
        Return SetError(2, 0, "")
    EndIf

    DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFile)

    Local $hFileMappingObject = $a_hCall[0]

    $a_hCall = DllCall("kernel32.dll", "ptr", "MapViewOfFile", _
            "hwnd", $hFileMappingObject, _
            "dword", 4, _ ; FILE_MAP_READ
            "dword", 0, _
            "dword", 0, _
            "dword", 0)

    If @error Or Not $a_hCall[0] Then
        DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFileMappingObject)
        Return SetError(3, 0, "")
    EndIf

    Local $pFile = $a_hCall[0]
    Local $iBufferSize = FileGetSize($sFile)

    Local $tMD5_CTX = DllStructCreate("dword i[2];" & _
            "dword buf[4];" & _
            "ubyte in[64];" & _
            "ubyte digest[16]")

    DllCall("advapi32.dll", "none", "MD5Init", "ptr", DllStructGetPtr($tMD5_CTX))

    If @error Then
        DllCall("kernel32.dll", "int", "UnmapViewOfFile", "ptr", $pFile)
        DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFileMappingObject)
        Return SetError(4, 0, "")
    EndIf

    DllCall("advapi32.dll", "none", "MD5Update", _
            "ptr", DllStructGetPtr($tMD5_CTX), _
            "ptr", $pFile, _
            "dword", $iBufferSize)

    If @error Then
        DllCall("kernel32.dll", "int", "UnmapViewOfFile", "ptr", $pFile)
        DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFileMappingObject)
        Return SetError(5, 0, "")
    EndIf

    DllCall("advapi32.dll", "none", "MD5Final", "ptr", DllStructGetPtr($tMD5_CTX))

    If @error Then
        DllCall("kernel32.dll", "int", "UnmapViewOfFile", "ptr", $pFile)
        DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFileMappingObject)
        Return SetError(6, 0, "")
    EndIf

    DllCall("kernel32.dll", "int", "UnmapViewOfFile", "ptr", $pFile)
    DllCall("kernel32.dll", "int", "CloseHandle", "hwnd", $hFileMappingObject)

    Local $sMD5 = Hex(DllStructGetData($tMD5_CTX, "digest"))

    Return SetError(0, 0, $sMD5)

EndFunc   ;==>_MD5ForFile 

Code : Tout sélectionner

[color=#FF0000]#RequireAdmin[/color]

#include <Array.au3>
[color=#FF0000]#include <Crypt.au3>[/color]
#include <File.au3>
[color=#FF0000]#include <String.au3>[/color]
Global $avRET = _ProcessListProperties()

Local $sFile = @Tempdir & "\Test.txt"
_FileWriteFromArray($sFile, $avRET, 1)
Local $hFile = FileOpen($sFile, 1)
_FileWriteFromArray($hFile, 1)
FileClose($hFile)
Run("notepad.exe " & $sFile)

Func _ProcessListProperties($Process = "", $sComputer = ".")
    Local $sUserName, $sMsg, $sUserDomain, $avProcs, $dtmDate
    Local $avProcs[1][2] = [[0, ""]], $n = 1
    If StringIsInt($Process) Then $Process = Int($Process)
    $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy, (Debug)}!\\" & $sComputer & "\root\cimv2")
    If IsObj($oWMI) Then
        If $Process == "" Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process")
        ElseIf IsInt($Process) Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process where ProcessId = " & $Process)
        Else
            $colProcs = $oWMI.ExecQuery("select * from win32_process where Name = '" & $Process & "'")
        EndIf
        If IsObj($colProcs) Then
            If $colProcs.count = 0 Then Return $avProcs
            ReDim $avProcs[$colProcs.count + 1][10]
            $avProcs[0][0] = UBound($avProcs) - 1
            For $oProc In $colProcs
                $avProcs[$n][1] = " - " & $oProc.name
                $avProcs[$n][0] = " . " & $oProc.ProcessId
                $avProcs[$n][2] = " - " & $oProc.CommandLine[color=#FF0000] & " - " & ( (StringLeft($oProc.CommandLine,1) = '"') ? _Crypt_HashFile(_GetFileName($oProc.CommandLine),$CALG_MD5) : _Crypt_HashFile($oProc.CommandLine,$CALG_MD5) )[/color]
                $n += 1
            Next
        Else
            SetError(2); Error getting process collection from WMI
        EndIf
    EndIf
    Return $avProcs
EndFunc  ;==>_ProcessListProperties

[color=#FF0000]Func _GetFileName ( $String)
    If StringLeft($String,1) <> '"' Then Return $String
    $Between = _StringBetween($String, '"', '"')
    If Not UBound($Between) Then Return SetError(1,0,$String)
    Return $Between[0]
EndFunc[/color]

Code : Tout sélectionner

#RequireAdmin
#pragma

#include <Array.au3>
#include <Crypt.au3>
#include <File.au3>
#include <String.au3>
Global $avRET = _ProcessListProperties()

Local $sFile = @Tempdir & "\Test.txt"
_FileWriteFromArray($sFile, $avRET, 1)
Local $hFile = FileOpen($sFile, 1)
_FileWriteFromArray($hFile, 1)
FileClose($hFile)
Run("notepad.exe " & $sFile)

Func _ProcessListProperties($Process = "", $sComputer = ".")
    Local $sUserName, $sMsg, $sUserDomain, $avProcs, $dtmDate
    Local $avProcs[1][2] = [[0, ""]], $n = 1
    If StringIsInt($Process) Then $Process = Int($Process)
    $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy, (Debug)}!\\" & $sComputer & "\root\cimv2")
    If IsObj($oWMI) Then
        If $Process == "" Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process")
        ElseIf IsInt($Process) Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process where ProcessId = " & $Process)
        Else
            $colProcs = $oWMI.ExecQuery("select * from win32_process where Name = '" & $Process & "'")
        EndIf
        If IsObj($colProcs) Then
            If $colProcs.count = 0 Then Return $avProcs
            ReDim $avProcs[$colProcs.count + 1][10]
            $avProcs[0][0] = UBound($avProcs) - 1
            For $oProc In $colProcs
                $avProcs[$n][1] = " - " & $oProc.name
                $avProcs[$n][0] = " . " & $oProc.ProcessId
                ;$avProcs[$n][2] = " - " & $oProc.CommandLine & " - " & ( (StringLeft($oProc.CommandLine,1) = '"') ? _Crypt_HashFile(_GetFileName($oProc.CommandLine),$CALG_MD5) : _Crypt_HashFile($oProc.CommandLine,$CALG_MD5) )

                If StringLeft($oProc.CommandLine,1) = '"' Then
                    $avProcs[$n][2] = " - " & $oProc.CommandLine & " - " & _Crypt_HashFile(_GetFileName($oProc.CommandLine),$CALG_MD5)
                Else
                    $avProcs[$n][2] = " - " & $oProc.CommandLine & " - " & _Crypt_HashFile($oProc.CommandLine,$CALG_MD5)
                EndIf

                $n += 1
            Next
        Else
            SetError(2); Error getting process collection from WMI
        EndIf
    EndIf
    Return $avProcs
EndFunc  ;==>_ProcessListProperties

Func _GetFileName ( $String)
    If StringLeft($String,1) <> '"' Then Return $String
    $Between = _StringBetween($String, '"', '"')
    If Not UBound($Between) Then Return SetError(1,0,$String)
    Return $Between[0]
EndFunc

Code : Tout sélectionner

Func _ProcessListProperties($Process = "", $sComputer = ".")
    Local $sUserName, $sMsg, $sUserDomain, $avProcs, $dtmDate
    Local $avProcs[1][2] = [[0, ""]], $n = 1
    If StringIsInt($Process) Then $Process = Int($Process)
    $oWMI = ObjGet("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy, (Debug)}!\\" & $sComputer & "\root\cimv2")
    If IsObj($oWMI) Then
        If $Process == "" Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process")
        ElseIf IsInt($Process) Then
            $colProcs = $oWMI.ExecQuery("select * from win32_process where ProcessId = " & $Process)
        Else
            $colProcs = $oWMI.ExecQuery("select * from win32_process where Name = '" & $Process & "'")
        EndIf
        If IsObj($colProcs) Then
            If $colProcs.count = 0 Then Return $avProcs
            ReDim $avProcs[$colProcs.count + 1][10]
            $avProcs[0][0] = UBound($avProcs) - 1
            For $oProc In $colProcs
                $avProcs[$n][1] = " - " & $oProc.name
                $avProcs[$n][0] = " . " & $oProc.ProcessId
                $avProcs[$n][2] = " - " & $oProc.CommandLine & " - " & ( _Crypt_HashFile(_GetFileName($oProc.CommandLine),$CALG_MD5))
        Else
            SetError(2); Error getting process collection from WMI
        EndIf
    EndIf
    Return $avProcs
EndFunc  ;==>_ProcessListProperties

Code : Tout sélectionner

. 0| - System Idle Process| -  - -1
 . 4| - System| -  - -1
 . 324| - smss.exe| - \SystemRoot\System32\smss.exe - -1
 . 484| - csrss.exe| - %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 - -1
 . 556| - wininit.exe| - wininit.exe - -1
 . 572| - csrss.exe| - %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 - -1
 . 620| - services.exe| - C:\Windows\system32\services.exe - 0x24ACB7E5BE595468E3B9AA488B9B4FCB
 . 640| - lsass.exe| - C:\Windows\system32\lsass.exe - 0x4D71227301DD8D09097B9E4CC6527E5A
 . 648| - lsm.exe| - C:\Windows\system32\lsm.exe - 0x9662EE182644511439F1C53745DC1C88
 . 744| - svchost.exe| - C:\Windows\system32\svchost.exe -k DcomLaunch - -1
 . 840| - svchost.exe| - C:\Windows\system32\svchost.exe -k RPCSS - -1
 . 904| - atiesrxx.exe| - C:\Windows\system32\atiesrxx.exe - 0x310F86335B0505DDC6D2DD48E66EF06B