Advertisement
jcunews

OnProcess.vbs

Aug 10th, 2021 (edited)
954
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 'OnProcess v1.0.1
  2. 'https://pastebin.com/u/jcunews
  3. 'https://www.reddit.com/user/jcunews1
  4. '
  5. 'Execute an application, display a message, or prompt to execute another
  6. 'application, when a specific process is started or stopped.
  7. '
  8. 'Usage: OnProcess [log file] [/q]
  9. '
  10. 'If log file is specified, process start and stop events will be added into
  11. 'the log file.
  12. '
  13. 'A "OnProcess.ini" configuration file in the same directory as this script
  14. 'file is required. If not found, a prompt will be presented for creating
  15. 'a sample configuration file in the same directory as this script file.
  16. '
  17. 'This script should be run with elevated privileges. Otherwise, it won't be
  18. 'able to check and match against processes which are elevated or were run
  19. 'using different user account.
  20. '
  21. 'Only one instance of the script will be run. Use the /q switch to stop the
  22. 'script.
  23.  
  24. set ws = createobject("wscript.shell")
  25. set fs = createobject("scripting.filesystemobject")
  26. sf = fs.getspecialfolder(2) & "\OnProcess."
  27. tf = sf & "stop"
  28. sf = sf & "run"
  29. if fs.fileexists(sf) then
  30.   on error resume next
  31.   fs.deletefile sf
  32.   if err.number <> 0 then wsh.quit
  33.   on error goto 0
  34. end if
  35. cf = left(wsh.scriptfullname, instrrev(wsh.scriptfullname, "\")) & _
  36.   "OnProcess.ini"
  37. if not fs.fileexists(cf) then
  38.   if msgbox("OnProcess.ini configuration file is not found." & _
  39.     vbcrlf & "Do you want to create a sample configuration file?", 36, _
  40.     "OnProcess") = 6 then
  41.     set f = fs.opentextfile(wsh.scriptfullname)
  42.     s = f.readall
  43.     f.close
  44.     on error resume next
  45.     set f = fs.createtextfile(cf, true)
  46.     if err.number = 0 then
  47.       f.write replace(mid(s, instr(s, "''" & vbcrlf) + 4), "'", "")
  48.       f.close
  49.       ws.run "notepad.exe """ & cf & """"
  50.     else
  51.       msgbox "Can not create sample configuration file." & vbcrlf & _
  52.         err.description, 16, "OnProcess"
  53.     end if
  54.   end if
  55.   wsh.quit 1
  56. end if
  57. pd = ""
  58. if wsh.arguments.count > 0 then
  59.   df = trim(wsh.arguments(0))
  60. else
  61.   df = ""
  62. end if
  63. set rf = fs.createtextfile(sf)
  64. set es = wsh.createobject("wbemscripting.swbemsink", "es_")
  65. set et = wsh.createobject("wbemscripting.swbemsink", "et_")
  66. set wm = getobject("winmgmts:")
  67. for each o in wm.execquery("select * from win32_process")
  68.   set ob = o
  69.   exit for
  70. next
  71. wm.execnotificationqueryasync es, "select * from __instancecreationevent " & _
  72.   "within 1 where targetinstance isa 'win32_process'"
  73. wm.execnotificationqueryasync et, "select * from __instancedeletionevent " & _
  74.   "within 1 where targetinstance isa 'win32_process'"
  75. do while not fs.fileexists(tf)
  76.   wsh.sleep 1000
  77. loop
  78. fs.deletefile tf
  79. rf.close
  80. fs.deletefile sf
  81.  
  82. sub log(s)
  83.   if df = "" then exit sub
  84.   dim f
  85.   f = timer
  86.   s = now & "." & right("00000" & clng((f - int(f)) * 1000000), 6) & ": " & s
  87.   on error resume next
  88.   set f = fs.opentextfile(df, 8, true)
  89.   if err.number = 0 then
  90.     f.writeline s
  91.     f.close
  92.   end if
  93. end sub
  94.  
  95. function pstr(ob)
  96.   pstr = "PID=" & ob.processid & "/0x" & hex(ob.processid) & _
  97.     ", ParentPID=" & ob.parentprocessid & "/0x" & hex(ob.parentprocessid) & _
  98.     ", Name=" & ob.name & ", Path=" & ob.executablepath & _
  99.     ", Cmdline=" & ob.commandline
  100. end function
  101.  
  102. function repl(s)
  103.   dim x, i, m, a
  104.   set x = new regexp
  105.   x.global = true
  106.   x.pattern = "`[`n]"
  107.   i = 1
  108.   repl = ""
  109.   set m = x.execute(s)
  110.   for each a in m
  111.     if a.firstindex > i then repl = repl & mid(s, i, a.firstindex - i + 1)
  112.     select case ucase(a.value)
  113.       case "``" repl = repl & "`"
  114.       case "`N" repl = repl & vbcrlf
  115.     end select
  116.     i = a.firstindex + a.length + 1
  117.   next
  118.   if i <= len(s) then repl = repl & mid(s, i)
  119. end function
  120.  
  121. sub doconfig(ob, start, t, n, p, r, s, c, a, y, o)
  122.   if (start <> t) or ((n = "") and (p = "")) then _
  123.     exit sub 'mismatched event type
  124.  if ((n = "") or (n = ucase(ob.name))) and _
  125.     ((p = "") or (p = ucase(ob.executablepath))) then
  126.     if r <> "" then 'execute application
  127.      ws.run r, s
  128.     else 'execute internal command
  129.      select case c
  130.         case "MESSAGE"
  131.           msgbox a, 64, "OnProcess"
  132.         case "CONFIRM"
  133.           select case msgbox(a, 35, "OnProcess")
  134.             case 6 'execute application for "yes" answer
  135.              if y <> "" then ws.run y, s
  136.             case 7 'execute application for "no" answer
  137.              if o <> "" then ws.run o, s
  138.           end select 'else: cancel. do nothing
  139.      end select 'else: ignore unsupported internal command
  140.    end if
  141.   end if 'else: mismatched
  142. end sub
  143.  
  144. sub chkconfig(ob, start)
  145.   dim f, d, l, m, i, t, n, p, r, s, c, a, y, o
  146.   on error resume next
  147.   set f = fs.opentextfile(cf)
  148.   if err.number = 0 then
  149.     err.clear
  150.     d = f.readall
  151.     if err.number = 0 then
  152.       pd = d
  153.     else
  154.       d = pd
  155.     end if
  156.   else
  157.     d = pd
  158.   end if
  159.   on error goto 0
  160.   t = true
  161.   n = ""
  162.   p = ""
  163.   r = ""
  164.   s = 1
  165.   c = ""
  166.   a = ""
  167.   y = ""
  168.   o = ""
  169.   for each l in split(d, vbcrlf)
  170.     l = trim(l)
  171.     if l <> "" then
  172.       if left(l, 1) <> ";" then
  173.         if left(l, 1) = "[" then 'start of event handler
  174.          doconfig ob, start, t, n, p, r, s, c, a, y, o
  175.           t = true
  176.           n = ""
  177.           p = ""
  178.           r = ""
  179.           s = 1
  180.           c = ""
  181.           a = ""
  182.           y = ""
  183.           o = ""
  184.         else 'event handler settings
  185.          i = instr(l, "=")
  186.           if i > 0 then
  187.             m = ucase(trim(left(l, i - 1)))
  188.             l = trim(mid(l, i + 1))
  189.             select case m
  190.               case "TYPE"
  191.                 select case ucase(l)
  192.                   case "START" t = true
  193.                   case "STOP"  t = false
  194.                 end select
  195.               case "NAME" n = ucase(l)
  196.               case "PATH" p = ucase(l)
  197.               case "RUN"
  198.                 if l <> "" then
  199.                   if left(l, 1) = "*" then 'internal command
  200.                    i = instr(l, ":")
  201.                     if i > 0 then
  202.                       c = ucase(trim(mid(l, 2, i - 2)))
  203.                       select case c
  204.                         case "MESSAGE" rem
  205.                         case "CONFIRM" rem
  206.                         case else c = ""
  207.                       end select
  208.                       a = repl(mid(l, i + 1))
  209.                     end if 'else: ignore invalid internal command syntax
  210.                  else 'application command line
  211.                    r = l
  212.                   end if
  213.                 end if 'else: ignore empty "run" setting
  214.              case "SHOW"
  215.                 l = ucase(l)
  216.                 select case l
  217.                   case "NORMAL"    s = 1
  218.                   case "MAXIMIZED" s = 3
  219.                   case "MINIMIZED" s = 2
  220.                   case "HIDDEN"    s = 0
  221.                 end select 'else: ignore invalid show mode
  222.              case "ONYES" y = l
  223.               case "ONNO"  o = l
  224.             end select
  225.           end if 'else: ignore invalid setting
  226.        end if
  227.       end if
  228.     end if
  229.   next
  230.   doconfig ob, start, t, n, p, r, s, c, a, y, o
  231.   f.close
  232. end sub
  233.  
  234. sub es_onobjectready(ob, ct)
  235.   set ob = ob.targetinstance
  236.   log "STARTED: " & pstr(ob)
  237.   chkconfig ob, true
  238. end sub
  239.  
  240. sub et_onobjectready(ob, ct)
  241.   set ob = ob.targetinstance
  242.   log "STOPPED: " & pstr(ob)
  243.   chkconfig ob, false
  244. end sub
  245.  
  246. ''Do not delete below lone "''" line, since it's used as a marker for the
  247. ''start of the sample OnProcess.ini file.
  248. ''
  249. ';Lines which starts with semicolon or empty/blank lines, are ignored.
  250. ';
  251. ';Lines which starts with "[" followed by optional label and followed by "]",
  252. ';are used as the start of an event handler's settings. Any text
  253. ';following the "]" is ignored.
  254. ';
  255. ';Each event handler setting is a pair of a name and a value separated by "=".
  256. ';Settings:
  257. ';  type  Optional type of process event: start (default), or stop.
  258. ';  name  Process file name without any path.
  259. ';  path  Process file path including the file name.
  260. ';  run   Application command line to execute, or an internal command.
  261. ';  show  Application UI mode: normal (default), maximized, minimized, hidden.
  262. ';        This does not apply if "run" specifies an internal command.
  263. ';
  264. ';"name"/"path" and "run" settings must be present, otherwise the event
  265. ';handler is ignored. Any unsupported setting name is ignored.
  266. ';
  267. ';Internal command has this format: *command:parameters
  268. ';Commands:
  269. ';  message  Display a message box. Parameter is the message text. New lines
  270. ';           are specified using "`" and to specify literal "`", use "``".
  271. ';  confirm  Display a confirmation box. Parameter is same as above.
  272. ';           Optional "onyes" and "onno" settings contains an application
  273. ';           command line to execute.
  274. ';
  275. ';Any changes made to this file is immediately effective as long as it's not
  276. ';locked by the text editor application. There is no need to restart the script
  277. ';If the script fails to read the configuration file for any reason, it will
  278. ';use the cached version of the configuration file data.
  279. '
  280. '[notepad32]
  281. 'path=c:\windows\syswow64\notepad.exe
  282. 'run=*message:32-bit Notepad is executed.
  283. '
  284. '[wordpad]
  285. 'type=stop
  286. 'name=wordpad.exe
  287. 'run=winver.exe
  288. '
  289. '[calc]
  290. 'name=calc.exe
  291. 'run=*confirm:Is it`nthe ``correct```napplication?
  292. 'onno=winver.exe
  293.  
Advertisement
RAW Paste Data Copied
Advertisement