VBScript

[guinness]

I was updating the function I created called _SelfDelete the other day and a user posted that why not do this in VBScript rather than a batch file. So because I was curious I had a look at VBScript and to my surprise the syntax is very similar in certain parts to AutoIt, so for some scripts I use (Notepad2) that I've created in AutoIt I will probably migrate to VBScript. I love a challenge!

I was wondering does anyone have a good resource of examples or for learning VBScript? e.g.

>> http://ss64.com/vb/syntax.html
>> http://www.robvanderwoude.com/wshexamples.php

[guinness]

This VBScript function will return True/False if the OS Architecture is x64.

Code: Select all

MsgBox Is64Bit()

'~ By guinness (c) 2012.
Function Is64Bit()
	Dim oShell, sRegRead
	Set oShell = Wscript.CreateObject("Wscript.Shell")
	sRegRead = oShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE")
	Is64Bit = InStr(sRegRead, "64") > 0
End Function

[guinness]

Reading the resources above I came up with a different approach of hiding the cmd prompt window.

Save as 'RunHide.vbs'.

Code: Select all

Option Explicit
Private oShell, sCmdLineRaw

'~ The idea was derived from http://www.robvanderwoude.com
'~ How to run: RunHide.vbs "APP_NAME" "APP_COMMMANDARGS"
'~ By guinness (c) 2012.
If IsCmdLine Then
	sCmdLineRaw = CmdLineRaw()
	Set oShell = CreateObject("WScript.Shell")
	oShell.Run Trim(sCmdLineRaw), 0, False
	Set oShell = Nothing
	WScript.Quit 1
Else
	MsgBox "Not enough parameters were specified.", vbOKOnly, "RunHide - Error"
	WScript.Quit 0
End If

Function CmdLineRaw()
	Dim i, sCmdLine
	For i = 0 To WScript.Arguments.Count - 1
		sCmdLine = sCmdLine & " " & WScript.Arguments(i)
	Next
	CmdLineRaw = sCmdLine
End Function

Function IsCmdLine()
  IsCmdLine = WScript.Arguments.Count > 1
End Function

Please note I've never coded/scripted** in VBScript so there may be some mistakes when it comes to 'coding practice', though all examples I provide work.

** - I am Baas pointed out I should've put 'scripted' rather than 'coded'.

[guinness]

Temporarily replace Notepad.exe with Notepad2.exe. To add Notepad2 as a replacement run the following code below and to remove just run the code again. I also have an AutoIt version here >> http://www.portablefreeware.com/forums/ ... 074#p47074

Save as 'Notepad2 Takeover.vbs'.

Code: Select all

Option Explicit
Dim iError, oFileSystem, oShell, sFilePath, sRegRead, sString, sWow6432Node

'~ By guinness (c) 2012.
Set oFileSystem = CreateObject("Scripting.FileSystemObject")
sWow6432Node = ""

If Is64Bit() Then
	sWow6432Node = "Wow6432Node\"
End If
sRegRead = "HKEY_LOCAL_MACHINE\SOFTWARE\" & sWow6432Node & "Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger"

sRegRead = ReadRegKey(sRegRead)

If sRegRead = "[None]" Then
	iError = 0
	sFilePath = oFileSystem.GetParentFolderName(WScript.ScriptFullName) & "\Notepad2.exe"
Else
	iError = 1
	sRegRead = Replace(sRegRead, """", "")
	sFilePath = Trim(Replace(sRegRead, "/z", ""))
End If

Set oShell = Wscript.CreateObject("WScript.Shell")
If oFileSystem.FileExists(sFilePath) = False Then
	MsgBox "It appears Notepad2 is missing.", vbOKOnly + vbCritical, "Notepad2 Takeover - Error"
	WScript.Quit 1
End If
If iError = 1 Then
	oShell.RegDelete "HKEY_LOCAL_MACHINE\SOFTWARE\" & sWow6432Node & "Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\"
	sString = "Removed Notepad2 from the system."
Else
	oShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\" & sWow6432Node & "Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger", """" & sFilePath & """ /z", "REG_SZ"
	sString = "Add Notepad2 to the system."
End If
MsgBox sString, vbOKOnly + vbCritical, "Notepad2 Takeover - Complete"

Function Is64Bit()
	Dim oShell, sRegRead
	Set oShell = Wscript.CreateObject("Wscript.Shell")
	sRegRead = oShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE")
	Is64Bit = InStr(sRegRead, "64") > 0
End Function

'~ Taken From: http://www.visualbasicscript.com/Verify-registry-key-exists-m1432.aspx
Private Function ReadRegKey(ByVal pRegKey)
	On Error Resume Next
	Dim oWsShell, sReturn

	Set oWsShell = Wscript.CreateObject("WScript.Shell")
	sReturn = oWsShell.RegRead(pRegKey)

	If Err.Number <> 0 Then
		sReturn = "[None]"
	End If
	ReadRegKey = sReturn

	Set oShell = Nothing

	On Error GoTo 0
 End Function

I'm really getting into this VBScript

[I am Baas]

Please note I've never coded in VBScript so there may be some mistakes when it comes to 'coding practice', though all examples I provide work.

Is Scripting = Coding?

[guinness]

Please note I've never coded in VBScript so there may be some mistakes when it comes to 'coding practice', though all examples I provide work.

Is Scripting = Coding?

Well, no. But whatever the correct definition is, the fact remains I've created 4 VBS scripts today without prior knowledge. I did this to prove a point that with persistence you can achieve results.

[I am Baas]

Well, I just went ahead and read a few definitions online... All I could conclude is that if you can open it in notepad and it's readable, then it's a script. If you see weird characters, it's a code. Sums it up for me

[guinness]

OK, thanks.

Edit_1: I'm interested does I am Baas or anyone else here know VBScript (well I know at least one who kindly sent me a PM) or PowerShell?
Edit_2: I removed some wording.

[guinness]

I will be moving these scripts to a different location in the next couple of days.

[ZioZione]

Hi guiness,
nice to read that you are interested in VbScript. Your coding level is already very good!
If you are interested, you can find below a more compact version of "Notepad2 takeover" script:

Code: Select all

Option Explicit
Dim oFileSystem, oShell, sFilePath, sRegRead, sString, sWow6432Node

'~ By guinness (c) 2012.
Set oFileSystem = CreateObject("Scripting.FileSystemObject")
Set oShell = Wscript.CreateObject("WScript.Shell")
sWow6432Node = ""
   
If Is64Bit() Then
   sWow6432Node = "Wow6432Node\"
End If
sRegRead = "HKEY_LOCAL_MACHINE\SOFTWARE\" & sWow6432Node & "Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger"

sRegRead = ReadRegKey(sRegRead)

If sRegRead = "[None]" Then
   sFilePath = oFileSystem.GetParentFolderName(WScript.ScriptFullName) & "\Notepad2.exe"

   If oFileSystem.FileExists(sFilePath) = False Then
      MsgBox "It appears Notepad2 is missing.", vbOKOnly + vbCritical, "Notepad2 Takeover - Error"
      WScript.Quit 1
   End If
   
   oShell.RegWrite "HKEY_LOCAL_MACHINE\SOFTWARE\" & sWow6432Node & "Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger", """" & sFilePath & """ /z", "REG_SZ"
   sString = "Add Notepad2 to the system."
Else
   sRegRead = Replace(sRegRead, """", "")
   sFilePath = Trim(Replace(sRegRead, "/z", ""))
   oShell.RegDelete "HKEY_LOCAL_MACHINE\SOFTWARE\" & sWow6432Node & "Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\"
   sString = "Removed Notepad2 from the system."
End If
MsgBox sString, vbOKOnly + vbCritical, "Notepad2 Takeover - Complete"

Function Is64Bit()
   sRegRead = oShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE")
   Is64Bit = InStr(sRegRead, "64") > 0
End Function

'~ Taken From: http://www.visualbasicscript.com/Verify-registry-key-exists-m1432.aspx
Private Function ReadRegKey(ByVal pRegKey)
   On Error Resume Next
   Dim sReturn

   sReturn = oShell.RegRead(pRegKey)

   If Err.Number <> 0 Then
      sReturn = "[None]"
   End If
   ReadRegKey = sReturn
End Function

This code has been written in two minutes and I don't tried it myself, so forgive all errors...
Best Regards
ZioZione

[guinness]

ZioZione,

I can see now where it could've been improved, thanks for the optimisation tips. That's something that will come overtime

[SYSTEM]

This VBScript function will return True/False if the OS Architecture is x64.

Code: Select all

MsgBox Is64Bit()

'~ By guinness (c) 2012.
Function Is64Bit()
	Dim oShell, sIs64Bit
	Set oShell = Wscript.CreateObject("Wscript.Shell")
	sRegRead = oShell.RegRead("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE")
	Is64Bit = InStr(sRegRead, "64") > 0
End Function

Eh...

The registry key HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment contains environment variables.

Here you are querying the value of %PROCESSOR_ARCHITECTURE% via the registry.

[guinness]

Correct, but the registry value gave me better results when I tried it.

[guinness]

OK, so I was reading this section wrong >> http://ss64.com/vb/envexpand.html, the reason it didn't work before is PROCESSOR_ARCHITECTURE is not a PROCESS environment variable but instead SYSTEM. So here is the new code. Like I said this is still fresh to me so I'm bound to make obvious mistakes. Thanks SYSTEM.

Code: Select all

MsgBox Is64Bit()

Function Is64Bit()
   Dim oShell
   Set oShell = Wscript.CreateObject("Wscript.Shell")
   Is64Bit = InStr(oShell.Environment("SYSTEM").Item("PROCESSOR_ARCHITECTURE"), "64") > 0
End Function

Note: I amended the code above as I was declaring a variable not being used.

[guinness]

I was looking at the CCleaner documentation and came across a tip in the documentation for adding custom VBScripts that CCleaner executes when cleaning.

Though with the number of additions in winapp2 as well as the power of CCleaner, I can't think of anything else that would really need to be added.

Source: http://www.piriform.com/docs/ccleaner/a ... ng-process