[原创] VBS列出进程加载的DLL的完整路径

powerbat

VBScript调用WMI列出进程加载的所有DLL的完整路径。
如需转载请注明出处。
http://www.bathome.net/thread-15724-1-1.html

'By powerbat @ www.bathome.net
'listdll.vbs ver 1.0 - List DLLs loaded in process.
set args = WScript.Arguments
if args.length=0 then show_usage(0)
s = "Name='"
for each arg in args
  s = s & arg & "' OR Name='"
next
s = s & "'"
s = Replace(s, "OR Name=''", "", 1, 1, 1)
Set objWMIServices = GetObject("winmgmts:\\.\root\cimv2")
Set colProcs = objWMIServices.ExecQuery(_
    "select * from Win32_Process where (" & s & ")")
for each objProc in colProcs
  WScript.Echo "pid="& objProc.ProcessId, objProc.Name
  WScript.Echo objProc.CommandLine
  WScript.Echo String(79, "-")
  Set colFiles = objWMIServices.ExecQuery("ASSOCIATORS OF {CIM_Process='"_
    & objProc.Handle & "'} where "_
    & "AssocClass = CIM_ProcessExecutable ResultClass = CIM_DataFile")
  For Each objFile In colFiles
    WScript.Echo objFile.Name
  Next
  WScript.Echo String(79, "=")
next

sub show_usage(flag)
  WScript.Echo "usage: cscript " & WScript.ScriptName & " ProcessName[ ProcessName]..."
  if flag=0 then WScript.Quit
end sub
复制代码

powerbat

还有两个WMI类可以获取DLL的完整路径：
Win32_PerfRawData_PerfProc_FullImage_Costly
Win32_PerfFormattedData_PerfProc_FullImage_Costly