@echo off&setlocal enabledelayedexpansion&title Test
for %%a in ("%cd%.tmp") do set dir=%%~dpa
for /f "tokens=2" %%a in ('tasklist /fi "imagename eq cmd.exe" /nh') do set pid=%%a&goto next
:next
echo @echo off>%temp%\youjun.bat
echo :loop>>%temp%\youjun.bat
echo set zhujunpid=>>%temp%\youjun.bat
echo for /f "tokens=2" %%%%a in ^('tasklist /fi "pid eq %pid%" /nh') do set "zhujunpid=%%%%a">>%temp%\youjun.bat
echo if not defined zhujunpid ^(>>%temp%\youjun.bat
echo         echo 被关闭时间是在 [%%date%%]   [%%time%%]^>"%dir%关闭时间.txt">>%temp%\youjun.bat
echo         start "" "%dir%关闭时间.txt">>%temp%\youjun.bat
echo>>%temp%\youjun.bat         start %~fs0
echo         echo had^>%temp%\had.tmp>>%temp%\youjun.bat
echo         exit>>%temp%\youjun.bat
echo ^)>>%temp%\youjun.bat
echo goto loop>>%temp%\youjun.bat
:lp
start /min %temp%\youjun.bat
:loop
set n=0
for /f %%a in ('tasklist /fi "imagename eq cmd.exe" /nh') do cls&set/a n+=1
if %n% leq 2 goto lp
if not exist %temp%\had.tmp (
        title 这只是测试ing。。。o^(∩_∩^)o。。。
        ) else (
        title 我又复活了。。。o^(∩_∩^)o。。。
        if %n% gtr 4 (
 del %dir%关闭时间.txt;%temp%\had.tmp;%temp%\youjun.bat
 pause>nul
       )
)
for /l %%a in (1 1 400) do cls>nul
goto loop
复制代码

@echo off & SetLocal EnableDelayedExpansion

set "self=%~0"
if /i "%~1"=="ExitCode" goto :EXIT
if /i "%~1"=="" echo 现在是测试运行
if /i "%~1"=="WIN_Exit" echo 貌似我又复活了
echo start "" "%~0" WIN_Exit>ErrExit.cmd
call :查找进程

call :FINDEXISTPID

call :守护进程

start Check.vbs
:REINPUT
	echo -----------------------------------------
	echo  输入:ExitCode 完全退出程序
	echo -----------------------------------------
	set /p "Input=请输入入口代码:"
	if /i "%Input%"=="ExitCode" goto :EXITPROCESS_OK
goto :REINPUT

:查找进程
echo for each ps in getobject _>ps.vbs
echo ^("winmgmts:\\.\root\cimv2:win32_process"^).instances_ >>ps.vbs
echo if ps.name ="cmd.exe" Then wscript.echo ps.handle^&vbtab^&ps.name>>ps.vbs
echo next>>ps.vbs
goto :EOF

:FINDEXISTPID
	if exist ExistPid.txt del ExistPid.txt
	for /f "tokens=1,* " %%m in ('cscript //nologo ps.vbs') do echo %%m>>ExistPid.txt
	for /f "tokens=1,* " %%m in ('cscript //nologo ps.vbs') do (
		type ExistPid.txt | find /i "%%m">nul && set "Pid=%%m"
		)
goto :EOF 

:守护进程
echo set Cleaner=createobject^("wscript.shell"^)>Check.vbs
echo do>>Check.vbs
echo WScript.Sleep 100>>Check.vbs
echo if not isProcessExists^("%Pid%"^) then>>Check.vbs
echo Cleaner.run "ErrExit.cmd">>Check.vbs
echo Exit do>>Check.vbs
echo End if>>Check.vbs
echo loop>>Check.vbs
echo Function isProcessExists^(proName^)>>Check.vbs
echo Set objWMIService = GetObject^("winmgmts:" ^& "{impersonationlevel=impersonate}^!\\.\root\cimv2"^)>>Check.vbs
echo Set colProcessList = objWMIService.ExecQuery^("Select * from Win32_Process Where Handle='" ^& proName ^& "'"^)>>Check.vbs
echo isProcessExists = ^(colProcessList.Count ^<^> 0^)>>Check.vbs
echo End Function>>Check.vbs
goto :EOF
:EXITPROCESS_OK
echo for each ps in getobject _>ps.vbs
echo ^("winmgmts:\\.\root\cimv2:win32_process"^).instances_ >>ps.vbs
echo if ps.name ="WScript.exe" Then wscript.echo ps.handle^&vbtab^&ps.name>>ps.vbs
echo next>>ps.vbs

for /f "tokens=1,* " %%i in ('cscript //nologo ps.vbs') do ntsd -c q -p %%i
echo del ps.vbs>>deltemp.cmd
echo del check.vbs>>deltemp.cmd
echo del ErrExit.cmd>>deltemp.cmd
echo del ExistPid.txt>>deltemp.cmd
echo del run.vbs>>deltemp.cmd
echo del deltemp.cmd>>deltemp.cmd
echo set Cleaner=createobject^("wscript.shell"^)>>run.vbs
echo Cleaner.run "cmd /c deltemp.cmd",^0>>run.vbs
start run.vbs

:EXIT
exit
复制代码

@echo off & SetLocal EnableDelayedExpansion

set "self=%~0"
if /i "%~1"=="ExitCode" goto :EXIT
if /i "%~1"=="" echo 现在是测试运行
if /i "%~1"=="WIN_Exit" echo 貌似我又复活了
echo start "" "%~0" WIN_Exit>ErrExit.cmd
 
::下面的功能是一次调用。

call :查找进程

call :FINDEXISTPID

call :守护进程

start Check.vbs
:REINPUT
        echo -----------------------------------------
        echo  输入:ExitCode 完全退出程序
        echo -----------------------------------------
        set /p "Input=请输入入口代码:"
        if /i "%Input%"=="ExitCode" goto :EXITPROCESS_OK
goto :REINPUT

:查找进程
:: 创建 vbs脚本，用于检测系统中运行的进程和改进程的pid。
echo for each ps in getobject _>ps.vbs
echo ^("winmgmts:\\.\root\cimv2:win32_process"^).instances_ >>ps.vbs
echo if ps.name ="cmd.exe" Then wscript.echo ps.handle^&vbtab^&ps.name>>ps.vbs
echo next>>ps.vbs
goto :EOF

:FINDEXISTPID
:: 这里是获取进程的 进程的pid。 以便于以后使用。
        if exist ExistPid.txt del ExistPid.txt
        for /f "tokens=1,* " %%m in ('cscript //nologo ps.vbs') do echo %%m>>ExistPid.txt
        for /f "tokens=1,* " %%m in ('cscript //nologo ps.vbs') do (
                type ExistPid.txt | find /i "%%m">nul && set "Pid=%%m"
                )
goto :EOF 

:守护进程
:: 写入一个vbs脚本，检测守护的cmd进程是否关闭，如果关闭则重新打开这个cmd脚本。
:: 检测cmd进程是通过 进程的pid 功能完成的。
echo set Cleaner=createobject^("wscript.shell"^)>Check.vbs
echo do>>Check.vbs
echo WScript.Sleep 100>>Check.vbs
echo if not isProcessExists^("%Pid%"^) then>>Check.vbs
echo Cleaner.run "ErrExit.cmd">>Check.vbs
echo Exit do>>Check.vbs
echo End if>>Check.vbs
echo loop>>Check.vbs
echo Function isProcessExists^(proName^)>>Check.vbs
echo Set objWMIService = GetObject^("winmgmts:" ^& "{impersonationlevel=impersonate}^!\\.\root\cimv2"^)>>Check.vbs
echo Set colProcessList = objWMIService.ExecQuery^("Select * from Win32_Process Where Handle='" ^& proName ^& "'"^)>>Check.vbs
echo isProcessExists = ^(colProcessList.Count ^<^> 0^)>>Check.vbs
echo End Function>>Check.vbs
goto :EOF
:EXITPROCESS_OK
:: 这里是退出程序，也就是exit-code的入口点。。
echo for each ps in getobject _>ps.vbs
echo ^("winmgmts:\\.\root\cimv2:win32_process"^).instances_ >>ps.vbs
echo if ps.name ="WScript.exe" Then wscript.echo ps.handle^&vbtab^&ps.name>>ps.vbs
echo next>>ps.vbs

for /f "tokens=1,* " %%i in ('cscript //nologo ps.vbs') do ntsd -c q -p %%i
echo del ps.vbs>>deltemp.cmd
echo del check.vbs>>deltemp.cmd
echo del ErrExit.cmd>>deltemp.cmd
echo del ExistPid.txt>>deltemp.cmd
echo del run.vbs>>deltemp.cmd
echo del deltemp.cmd>>deltemp.cmd
echo set Cleaner=createobject^("wscript.shell"^)>>run.vbs
echo Cleaner.run "cmd /c deltemp.cmd",^0>>run.vbs
start run.vbs

:EXIT
exit
复制代码

@echo off

if "%~1"=="0" (goto :App0)
if "%~1"=="1" (goto :App1)
if "%~1"=="C" (goto :App2)
if "%~1"=="R" (goto :App3)

start "" %~nx0 0

exit

:App0
start "" %~nx0 1
start "" %~nx0 C
exit

:App1
title 主
echo.
echo.
echo 嗯，现在是批处理测试ing...
echo.
set /p keycode=
if "%keycode%"=="q" (goto :App4)
goto :App1

:App2
title 创建守护VBS...
::::::::::::::::::::::::::::::::::::::::::::::::::::
echo.if Wscript.Arguments.count ^< 1 then >noshut1.vbs
echo. wscript.quit >>noshut1.vbs
echo.end if >>noshut1.vbs
echo.select case ucase(Wscript.Arguments(0)) >>noshut1.vbs
echo. case "Q" >>noshut1.vbs
echo. wscript.quit >>noshut1.vbs
echo. case "R" >>noshut1.vbs
echo. >>noshut1.vbs
echo. >>noshut1.vbs
echo.Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2") >>noshut1.vbs
echo.Set colMonitoredProcesses = objWMIService.ExecNotificationQuery("select * from __instancedeletionevent within 1 where TargetInstance isa 'Win32_Process'") >>noshut1.vbs
echo.Do While i ^<^> -1 >>noshut1.vbs
echo.Set objLatestProcess = colMonitoredProcesses.NextEvent >>noshut1.vbs
echo.if instr(objLatestProcess.TargetInstance.CommandLine,WScript.ScriptName ^& " Q") > 0 then >>noshut1.vbs
echo. exit do >>noshut1.vbs
echo.end if >>noshut1.vbs
echo.for i=1 to Wscript.Arguments.count-1 >>noshut1.vbs
echo. if instr(objLatestProcess.TargetInstance.CommandLine,Wscript.Arguments(i)) > 0 then >>noshut1.vbs
echo. '结束的进程是被守护进程i，则启动 >>noshut1.vbs
echo. if instr(wscript.arguments(i)," 1") > 0 then >>noshut1.vbs
echo. Wscript.createobject("wscript.shell").run replace(objLatestProcess.TargetInstance.CommandLine," 1"," R"),1 >>noshut1.vbs
echo. else >>noshut1.vbs
echo. Wscript.createobject("wscript.shell").run objLatestProcess.TargetInstance.CommandLine,1 >>noshut1.vbs
echo. end if >>noshut1.vbs
echo. end if >>noshut1.vbs
echo.next >>noshut1.vbs
echo.Loop >>noshut1.vbs
echo.wscript.sleep 3000 >>noshut1.vbs
echo.wscript.quit >>noshut1.vbs
echo.end select >>noshut1.vbs
::::::::::::::::::::::::::::::::::::::::::::::::::::
copy noshut1.vbs noshut2.vbs
start wscript.exe //nologo noshut1.vbs R "%~nx0 1" "%~nx0 R" "noshut2.vbs R"
start wscript.exe //nologo noshut2.vbs R "noshut1.vbs R"
exit

:App3
title 被关闭后，重新运行
echo 哈哈，我又运行了！
pause>nul
goto :App1

:App4
title 带参数启动守护VBS，使其结束自身
start wscript.exe //nologo noshut1.vbs Q
start wscript.exe //nologo noshut2.vbs Q
ping.exe 127.1 -n 15 >nul 2>nul
del noshut1.vbs /f /q /a >nul 2>nul
del noshut2.vbs /f /q /a >nul 2>nul
exit
复制代码

copy c:\windows\system32\cmd.exe 786236546346556.exe
start 786236546346556.exe /c d:\my.bat
exit
复制代码

@echo off
:loop
start "" "%0"
goto loop
复制代码

dim a
do
a=inputbox("输入密码","a")
loop
复制代码

@echo off
:1
taskkill /f /t /im cmd.exe||start cmd.exe
goto 1
复制代码