von NixVersteh » 20.12.2023, 15:57
Holgi hat geschrieben: 17.09.2021, 12:53
komplett sieht es so aus:
Code: Alles auswählen
Windows Registry Editor Version 5.00
;5th version adds support for swm files
;4th version uses dism and Get-WimInfo instead of Get-ImageInfo (for outdated win7); force entry to appear (7-zip shell issue)
;3rd version adds support for vhd images, and lists all existing indexes details (detecting them adds a bit of slow at start)
;2nd version adds support for msu, and blindly listed first 3 indexes details, fast, but could list 'error"
;1st version undo (HCU unreliable, more so if having 7-Zip shell extensions, hence switched to HKCR)
[-HKEY_CURRENT_USER\Software\Classes\.swm]
[-HKEY_CURRENT_USER\Software\Classes\.esd]
[-HKEY_CURRENT_USER\Software\Classes\.wim]
[-HKEY_CURRENT_USER\Software\Classes\.cab]
[-HKEY_CURRENT_USER\Software\Classes\CABFolder]
[-HKEY_CURRENT_USER\Software\Classes\Microsoft.System.Update.1]
;========================================================================================
[HKEY_CLASSES_ROOT\.swm]
@=-
[-HKEY_CLASSES_ROOT\.swm\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.swm\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.swm\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-ImageInfo /ImageFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-ImageInfo /ImageFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\.esd]
@=-
[-HKEY_CLASSES_ROOT\.esd\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.esd\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.esd\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-WimInfo /WimFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-WimInfo /WimFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\.wim]
@=-
[-HKEY_CLASSES_ROOT\.wim\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.wim\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.wim\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-WimInfo /WimFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-WimInfo /WimFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\Windows.VhdFile]
@=-
[-HKEY_CLASSES_ROOT\Windows.VhdFile\shell\DISMinfo]
[HKEY_CLASSES_ROOT\Windows.VhdFile\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\Windows.VhdFile\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-ImageInfo /ImageFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-ImageInfo /ImageFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\.cab]
@=-
[-HKEY_CLASSES_ROOT\.cab\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.cab\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.cab\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process cmd -ArgumentList '/c dism /Online /Get-PackageInfo /PackagePath:\\\"%1\\\" &timeout -1' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\CABFolder]
@=-
[-HKEY_CLASSES_ROOT\CABFolder\shell\DISMinfo]
[HKEY_CLASSES_ROOT\CABFolder\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\CABFolder\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process cmd -ArgumentList '/c dism /Online /Get-PackageInfo /PackagePath:\\\"%1\\\" &timeout -1' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\Microsoft.System.Update.1]
@=-
[-HKEY_CLASSES_ROOT\Microsoft.System.Update.1\shell\DISMinfo]
[HKEY_CLASSES_ROOT\Microsoft.System.Update.1\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\Microsoft.System.Update.1\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process cmd -ArgumentList '/c pushd \\\"%%temp%%\\\" &mkdir disminfo &Expand -F:*Properties.txt \\\"%1\\\" disminfo &pushd disminfo &type *.txt &del /f /q *.* &timeout -1'\""
Hallo ihr lieben Deskmodder,
sorry evtl. dumme Frage, aber ist der Code für die .reg Datei komplett?
Ich frage, weil auf dem Pastebin von Aveyo noch ein Codeschnipsel mit drin ist, der wie folgt aussieht:
Code: Alles auswählen
;========================================================================================
; WIMINFO powershell snippet not requiring admin rights
[HKEY_CLASSES_ROOT\WIMINFO]
"11"="function WIMINFO ($file = 'install.esd', $index = 0, $output = 0) { :info while ($true) {"
"12"=" #:: Quick ISO ESD WIM info by AveYo v1"
"13"=" #:: args = file, image index or 0 for all, output 0 for simple, 1 for xml text, 2 for xml object"
"14"=" #:: by default returns simple image index, version, arch, lang, edition - example: 6,19041.631,x64,en-US,Professional"
"15"=" $block = 2097152; $bytes = new-object 'Byte[]' ($block); $begin = [uint64]0; $final = [uint64]0; $limit = [uint64]0"
"16"=" $steps = [int]([uint64]([IO.FileInfo]$file).Length / $block - 1); $encoding = [Text.Encoding]::GetEncoding(28591)"
"17"=" $find1 = $encoding.GetString([Text.Encoding]::Unicode.GetBytes('</INSTALLATIONTYPE>'))"
"18"=" $find2 = $encoding.GetString([Text.Encoding]::Unicode.GetBytes('</WIM>'))"
"19"=" $f = new-object IO.FileStream ($file, 3, 1, 1); $p = 0; $p = $f.Seek(0, 2)"
"20"=" for ($o = 1; $o -le $steps; $o++) { "
"21"=" $p = $f.Seek(-$block, 1); $r = $f.Read($bytes, 0, $block); if ($r -ne $block) {write-host invalid block $r; break}"
"22"=" $u = [Text.Encoding]::GetEncoding(28591).GetString($bytes); $t = $u.LastIndexOf($find1, [StringComparison]::Ordinal) "
"23"=" if ($t -ge 0) {"
"24"=" $f.Seek(($t -$block), 1) >''"
"25"=" for ($o = 1; $o -le $block; $o++) { $f.Seek(-2, 1) >''; if ($f.ReadByte() -eq 0xfe) {$begin = $f.Position; break} }"
"26"=" $limit = $f.Length - $begin; if ($limit -lt $block) {$x = $limit} else {$x = $block}"
"27"=" $bytes = new-object 'Byte[]' ($x); $r = $f.Read($bytes, 0, $x); "
"28"=" $u = [Text.Encoding]::GetEncoding(28591).GetString($bytes); $t = $u.IndexOf($find2, [StringComparison]::Ordinal)"
"29"=" if ($t -ge 0) {$f.Seek(($t + 12 -$x), 1) >''; $final = $f.Position} ; break"
"30"=" } else { $p = $f.Seek(-$block, 1)} "
"31"=" }"
"32"=" if ($begin -gt 0 -and $final -gt $begin) {"
"33"=" $x = $final - $begin; $f.Seek(-$x, 1) >''; $bytes = new-object 'Byte[]' ($x); $r = $f.Read($bytes, 0, $x)"
"34"=" if ($r -ne $x) {break}"
"35"=" [xml]$xml = [Text.Encoding]::Unicode.GetString($bytes); $f.Dispose()"
"36"=" } else {$f.Dispose()}"
"37"=" break :info } "
"38"=" if ($output -eq 0) {$simple = ''; foreach ($i in $xml.WIM.IMAGE) {if ($index -gt 0 -and $($i.INDEX)-ne $index) {continue}"
"39"=" $simple += \"$($i.INDEX),$($I.WINDOWS.VERSION.BUILD).$($I.WINDOWS.VERSION.SPBUILD),\""
"40"=" $simple += \"$(('x64','x86')[$I.WINDOWS.ARCH-eq'0']),$($I.WINDOWS.LANGUAGES.LANGUAGE),$($I.WINDOWS.EDITIONID)`r`n\""
"41"=" } ; return $simple }"
"42"=" if ($output -eq 1) {[console]::OutputEncoding=[Text.Encoding]::UTF8; $xml.Save([Console]::Out); ''} "
"43"=" if ($output -eq 2) {return $xml}"
"44"="}"
"45"="$host.ui.rawui.windowtitle = 'DISM Info'"
Quelle:
https://pastebin.com/*****
Kennt sich jemand hier gut genug aus und kann bestätigen, dass dieser Code sauber bzw. sicher?
Ich traue mich nicht wirklich Skripte von Aveyo auszuführen, auch wenn ich gerne würde, weil ich den Code nicht verstehe?
Genauso bei dem RunAsTrustedInstaller Skript:
Code: Alles auswählen
@echo off& title RunAsTI - lean and mean snippet by AveYo, 2018-2022
goto :nfo
[FEATURES]
- innovative HKCU load, no need for reg load / unload ping-pong; programs get the user profile
- sets ownership privileges, high priority, and explorer support; get System if TI unavailable
- accepts special characters in paths for which default run as administrator fails
- adds Send to - RunAsTI right-click menu entry to launch files and folders as TI via explorer
[USAGE]
- First copy-paste RunAsTI snippet after .bat script content
- Then call it anywhere to launch programs with arguments as TI
call :RunAsTI regedit
call :RunAsTI powershell -noprofile -nologo -noexit -c [environment]::Commandline
call :RunAsTI cmd /k "whoami /all & color e0"
call :RunAsTI "C:\System Volume Information"
- Or just relaunch the script once if not already running as TI:
whoami /user | findstr /i /c:S-1-5-18 >nul || ( call :RunAsTI "%~f0" %* & exit /b )
2022.01.28: workaround for 11 release (22000) hindering explorer as TI; fix 7 args
:nfo
:::::::::::::::::::::::::
:: .bat script content ::
:::::::::::::::::::::::::
:: [optional] add Send to - RunAsTI right-click menu entry to launch files and folders as TI via explorer
set "0=%~f0"& powershell -nop -c iex(([io.file]::ReadAllText($env:0)-split':SendTo\:.*')[1])& goto :SendTo:
$SendTo=[Environment]::GetFolderPath('ApplicationData')+'\Microsoft\Windows\SendTo\RunAsTI.bat'; $enc=[Text.Encoding]::UTF8
if ($env:0 -ne $SendTo) {[IO.File]::WriteAllLines($SendTo, [io.file]::ReadAllLines($env:0,$enc))}
:SendTo:
:: call RunAsTI snippet with default commandline args - if none provided, defaults to opening This PC as TI
call :RunAsTI %*
echo args: %*
::whoami
::timeout /t 7
:: done
exit /b
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: .bat script content end - copy-paste RunAsTI snippet ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
#:RunAsTI snippet to run as TI/System, with innovative HKCU load, ownership privileges, high priority, and explorer support
set ^ #=& set "0=%~f0"& set 1=%*& powershell -c iex(([io.file]::ReadAllText($env:0)-split'#\:RunAsTI .*')[1])& exit /b
function RunAsTI ($cmd,$arg) { $id='RunAsTI'; $key="Registry::HKU\$(((whoami /user)-split' ')[-1])\Volatile Environment"; $code=@'
$I=[int32]; $M=$I.module.gettype("System.Runtime.Interop`Services.Mar`shal"); $P=$I.module.gettype("System.Int`Ptr"); $S=[string]
$D=@(); $T=@(); $DM=[AppDomain]::CurrentDomain."DefineDynami`cAssembly"(1,1)."DefineDynami`cModule"(1); $Z=[uintptr]::size
0..5|%!!()|% {$D += $D[$_]."MakeByR`efType"()}
$F='kernel','advapi','advapi', ($S,$S,$I,$I,$I,$I,$I,$S,$D[7],$D[8]), ([uintptr],$S,$I,$I,$D[9]),([uintptr],$S,$I,$I,[byte[]],$I)
0..2|% {$9=$D[0]."DefinePInvok`eMethod"(('CreateProcess','RegOpenKeyEx','RegSetValueEx')[$_],$F[$_]+'32',8214,1,$S,$F[$_+3],1,4)}
$DF=($P,$I,$P),($I,$I,$I,$I,$P,$D[1]),($I,$S,$S,$S,$I,$I,$I,$I,$I,$I,$I,$I,[int16],[int16],$P,$P,$P,$P),($D[3],$P),($P,$P,$I,$I)
1..5|%!!|% {$9=$D[$k]."Defin`eField"('f' + $n++, $_, 6)}}; 0..5|% {$T += $D[$_]."Creat`eType"()}
0..5|% {nv "A$_" ([Activator]::CreateInstance($T[$_])) -fo}; function F ($1,$2) {$T[0]."G`etMethod"($1).invoke(0,$2)}
$TI=(whoami /groups)-like'*1-16-16384*'; $As=0; if(!$cmd) {$cmd='control';$arg='admintools'}; if ($cmd-eq'This PC'){$cmd='file:'}
if (!$TI) {'TrustedInstaller','lsass','winlogon'|% {if (!$As) {$9=sc.exe start $_; $As=@(get-process -name $_ -ea 0|% {$_})[0]}}
function M ($1,$2,$3) {$M."G`etMethod"($1,[type[]]$2).invoke(0,$3)}; $H=@(); $Z,(4*$Z+16)|% {$H += M "AllocHG`lobal" $I $_}
M "WriteInt`Ptr" ($P,$P) ($H[0],$As.Handle); $A1.f1=131072; $A1.f2=$Z; $A1.f3=$H[0]; $A2.f1=1; $A2.f2=1; $A2.f3=1; $A2.f4=1
$A2.f6=$A1; $A3.f1=10*$Z+32; $A4.f1=$A3; $A4.f2=$H[1]; M "StructureTo`Ptr" ($D[2],$P,[boolean]) (($A2 -as $D[2]),$A4.f2,$false)
$Run=@($null, "powershell -win 1 -nop -c iex `$env:R; # $id", 0, 0, 0, 0x0E080600, 0, $null, ($A4 -as $T[4]), ($A5 -as $T[5]))
F 'CreateProcess' $Run; return}; $env:R=''; rp $key $id -force; $priv=[diagnostics.process]."GetM`ember"('SetPrivilege',42)[0]
'SeSecurityPrivilege','SeTakeOwnershipPrivilege','SeBackupPrivilege','SeRestorePrivilege' |% {$priv.Invoke($null, @("$_",2))}
$HKU=[uintptr][uint32]2147483651; $NT='S-1-5-18'; $reg=($HKU,$NT,8,2,($HKU -as $D[9])); F 'RegOpenKeyEx' $reg; $LNK=$reg[4]
function L ($1,$2,$3) {sp 'HKLM:\Software\Classes\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}' 'RunAs' $3 -force -ea 0
$b=[Text.Encoding]::Unicode.GetBytes("\Registry\User\$1"); F 'RegSetValueEx' @($2,'SymbolicLinkValue',0,6,[byte[]]$b,$b.Length)}
function Q {[int](gwmi win32_process -filter 'name="explorer.exe"'|?{$_.getownersid().sid-eq$NT}|select -last 1).ProcessId}
$11bug=($((gwmi Win32_OperatingSystem).BuildNumber)-eq'22000')-AND(($cmd-eq'file:')-OR(test-path -lit $cmd -PathType Container))
if ($11bug) {'System.Windows.Forms','Microsoft.VisualBasic' |% {[Reflection.Assembly]::LoadWithPartialName("'$_")}}
if ($11bug) {$path='^(l)'+$($cmd -replace '([\+\^\%\~\(\)\[\]])','{$1}')+'{ENTER}'; $cmd='control.exe'; $arg='admintools'}
L ($key-split'\\')[1] $LNK ''; $R=[diagnostics.process]::start($cmd,$arg); if ($R) {$R.PriorityClass='High'; $R.WaitForExit()}
if ($11bug) {$w=0; do {if($w-gt40){break}; sleep -mi 250;$w++} until (Q); [Microsoft.VisualBasic.Interaction]::AppActivate($(Q))}
if ($11bug) {[Windows.Forms.SendKeys]::SendWait($path)}; do {sleep 7} while(Q); L '.Default' $LNK 'Interactive User'
'@; $V='';'cmd','arg','id','key'|%{$V+="`n`$$_='$($(gv $_ -val)-replace"'","''")';"}; sp $key $id $($V,$code) -type 7 -force -ea 0
start powershell -args "-win 1 -nop -c `n$V `$env:R=(gi `$key -ea 0).getvalue(`$id)-join''; iex `$env:R" -verb runas
}; $A=$env:1-split'"([^"]+)"|([^ ]+)',2|%{$_.Trim(' "')}; RunAsTI $A[1] $A[2]; #:RunAsTI lean & mean snippet by AveYo, 2022.01.28
Quelle:
https://pastebin.com/AtejMKLj
Kann irgendjemad hier bitte erklären, warum das so komplex/kompliziert geschrieben ist und ob es sicher ist zu benutzen?
MfG
[quote=Holgi post_id=373828 time=1631875994 user_id=40152]
komplett sieht es so aus:
[code]Windows Registry Editor Version 5.00
;5th version adds support for swm files
;4th version uses dism and Get-WimInfo instead of Get-ImageInfo (for outdated win7); force entry to appear (7-zip shell issue)
;3rd version adds support for vhd images, and lists all existing indexes details (detecting them adds a bit of slow at start)
;2nd version adds support for msu, and blindly listed first 3 indexes details, fast, but could list 'error"
;1st version undo (HCU unreliable, more so if having 7-Zip shell extensions, hence switched to HKCR)
[-HKEY_CURRENT_USER\Software\Classes\.swm]
[-HKEY_CURRENT_USER\Software\Classes\.esd]
[-HKEY_CURRENT_USER\Software\Classes\.wim]
[-HKEY_CURRENT_USER\Software\Classes\.cab]
[-HKEY_CURRENT_USER\Software\Classes\CABFolder]
[-HKEY_CURRENT_USER\Software\Classes\Microsoft.System.Update.1]
;========================================================================================
[HKEY_CLASSES_ROOT\.swm]
@=-
[-HKEY_CLASSES_ROOT\.swm\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.swm\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.swm\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-ImageInfo /ImageFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-ImageInfo /ImageFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\.esd]
@=-
[-HKEY_CLASSES_ROOT\.esd\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.esd\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.esd\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-WimInfo /WimFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-WimInfo /WimFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\.wim]
@=-
[-HKEY_CLASSES_ROOT\.wim\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.wim\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.wim\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-WimInfo /WimFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-WimInfo /WimFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\Windows.VhdFile]
@=-
[-HKEY_CLASSES_ROOT\Windows.VhdFile\shell\DISMinfo]
[HKEY_CLASSES_ROOT\Windows.VhdFile\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\Windows.VhdFile\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process powershell -ArgumentList '-c \\\"$w=''%1'';$w;$c=(dism /Get-ImageInfo /ImageFile:$w) | sls ''Index'';for($i=1;$i -le $c.count;$i++){dism /Get-ImageInfo /ImageFile:$w /Index:$i;write-host (''=''*60)};timeout -1\\\"' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\.cab]
@=-
[-HKEY_CLASSES_ROOT\.cab\shell\DISMinfo]
[HKEY_CLASSES_ROOT\.cab\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\.cab\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process cmd -ArgumentList '/c dism /Online /Get-PackageInfo /PackagePath:\\\"%1\\\" &timeout -1' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\CABFolder]
@=-
[-HKEY_CLASSES_ROOT\CABFolder\shell\DISMinfo]
[HKEY_CLASSES_ROOT\CABFolder\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\CABFolder\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process cmd -ArgumentList '/c dism /Online /Get-PackageInfo /PackagePath:\\\"%1\\\" &timeout -1' -verb RunAs\""
;========================================================================================
[HKEY_CLASSES_ROOT\Microsoft.System.Update.1]
@=-
[-HKEY_CLASSES_ROOT\Microsoft.System.Update.1\shell\DISMinfo]
[HKEY_CLASSES_ROOT\Microsoft.System.Update.1\shell\DISMinfo]
"MUIVerb"="DISM Info"
"Icon"="C:\\Windows\\HelpPane.exe"
"CommandFlags"=dword:00000010
[HKEY_CLASSES_ROOT\Microsoft.System.Update.1\shell\DISMinfo\command]
@="powershell -noprofile -w Hidden -c \"Start-Process cmd -ArgumentList '/c pushd \\\"%%temp%%\\\" &mkdir disminfo &Expand -F:*Properties.txt \\\"%1\\\" disminfo &pushd disminfo &type *.txt &del /f /q *.* &timeout -1'\""[/code]
[/quote]
Hallo ihr lieben Deskmodder,
sorry evtl. dumme Frage, aber ist der Code für die .reg Datei komplett?
Ich frage, weil auf dem Pastebin von Aveyo noch ein Codeschnipsel mit drin ist, der wie folgt aussieht:
[code]
;========================================================================================
; WIMINFO powershell snippet not requiring admin rights
[HKEY_CLASSES_ROOT\WIMINFO]
"11"="function WIMINFO ($file = 'install.esd', $index = 0, $output = 0) { :info while ($true) {"
"12"=" #:: Quick ISO ESD WIM info by AveYo v1"
"13"=" #:: args = file, image index or 0 for all, output 0 for simple, 1 for xml text, 2 for xml object"
"14"=" #:: by default returns simple image index, version, arch, lang, edition - example: 6,19041.631,x64,en-US,Professional"
"15"=" $block = 2097152; $bytes = new-object 'Byte[]' ($block); $begin = [uint64]0; $final = [uint64]0; $limit = [uint64]0"
"16"=" $steps = [int]([uint64]([IO.FileInfo]$file).Length / $block - 1); $encoding = [Text.Encoding]::GetEncoding(28591)"
"17"=" $find1 = $encoding.GetString([Text.Encoding]::Unicode.GetBytes('</INSTALLATIONTYPE>'))"
"18"=" $find2 = $encoding.GetString([Text.Encoding]::Unicode.GetBytes('</WIM>'))"
"19"=" $f = new-object IO.FileStream ($file, 3, 1, 1); $p = 0; $p = $f.Seek(0, 2)"
"20"=" for ($o = 1; $o -le $steps; $o++) { "
"21"=" $p = $f.Seek(-$block, 1); $r = $f.Read($bytes, 0, $block); if ($r -ne $block) {write-host invalid block $r; break}"
"22"=" $u = [Text.Encoding]::GetEncoding(28591).GetString($bytes); $t = $u.LastIndexOf($find1, [StringComparison]::Ordinal) "
"23"=" if ($t -ge 0) {"
"24"=" $f.Seek(($t -$block), 1) >''"
"25"=" for ($o = 1; $o -le $block; $o++) { $f.Seek(-2, 1) >''; if ($f.ReadByte() -eq 0xfe) {$begin = $f.Position; break} }"
"26"=" $limit = $f.Length - $begin; if ($limit -lt $block) {$x = $limit} else {$x = $block}"
"27"=" $bytes = new-object 'Byte[]' ($x); $r = $f.Read($bytes, 0, $x); "
"28"=" $u = [Text.Encoding]::GetEncoding(28591).GetString($bytes); $t = $u.IndexOf($find2, [StringComparison]::Ordinal)"
"29"=" if ($t -ge 0) {$f.Seek(($t + 12 -$x), 1) >''; $final = $f.Position} ; break"
"30"=" } else { $p = $f.Seek(-$block, 1)} "
"31"=" }"
"32"=" if ($begin -gt 0 -and $final -gt $begin) {"
"33"=" $x = $final - $begin; $f.Seek(-$x, 1) >''; $bytes = new-object 'Byte[]' ($x); $r = $f.Read($bytes, 0, $x)"
"34"=" if ($r -ne $x) {break}"
"35"=" [xml]$xml = [Text.Encoding]::Unicode.GetString($bytes); $f.Dispose()"
"36"=" } else {$f.Dispose()}"
"37"=" break :info } "
"38"=" if ($output -eq 0) {$simple = ''; foreach ($i in $xml.WIM.IMAGE) {if ($index -gt 0 -and $($i.INDEX)-ne $index) {continue}"
"39"=" $simple += \"$($i.INDEX),$($I.WINDOWS.VERSION.BUILD).$($I.WINDOWS.VERSION.SPBUILD),\""
"40"=" $simple += \"$(('x64','x86')[$I.WINDOWS.ARCH-eq'0']),$($I.WINDOWS.LANGUAGES.LANGUAGE),$($I.WINDOWS.EDITIONID)`r`n\""
"41"=" } ; return $simple }"
"42"=" if ($output -eq 1) {[console]::OutputEncoding=[Text.Encoding]::UTF8; $xml.Save([Console]::Out); ''} "
"43"=" if ($output -eq 2) {return $xml}"
"44"="}"
"45"="$host.ui.rawui.windowtitle = 'DISM Info'"
[/code]
Quelle:
[url]https://pastebin.com/*****[/url]
Kennt sich jemand hier gut genug aus und kann bestätigen, dass dieser Code sauber bzw. sicher?
Ich traue mich nicht wirklich Skripte von Aveyo auszuführen, auch wenn ich gerne würde, weil ich den Code nicht verstehe?
Genauso bei dem RunAsTrustedInstaller Skript:
[code]@echo off& title RunAsTI - lean and mean snippet by AveYo, 2018-2022
goto :nfo
[FEATURES]
- innovative HKCU load, no need for reg load / unload ping-pong; programs get the user profile
- sets ownership privileges, high priority, and explorer support; get System if TI unavailable
- accepts special characters in paths for which default run as administrator fails
- adds Send to - RunAsTI right-click menu entry to launch files and folders as TI via explorer
[USAGE]
- First copy-paste RunAsTI snippet after .bat script content
- Then call it anywhere to launch programs with arguments as TI
call :RunAsTI regedit
call :RunAsTI powershell -noprofile -nologo -noexit -c [environment]::Commandline
call :RunAsTI cmd /k "whoami /all & color e0"
call :RunAsTI "C:\System Volume Information"
- Or just relaunch the script once if not already running as TI:
whoami /user | findstr /i /c:S-1-5-18 >nul || ( call :RunAsTI "%~f0" %* & exit /b )
2022.01.28: workaround for 11 release (22000) hindering explorer as TI; fix 7 args
:nfo
:::::::::::::::::::::::::
:: .bat script content ::
:::::::::::::::::::::::::
:: [optional] add Send to - RunAsTI right-click menu entry to launch files and folders as TI via explorer
set "0=%~f0"& powershell -nop -c iex(([io.file]::ReadAllText($env:0)-split':SendTo\:.*')[1])& goto :SendTo:
$SendTo=[Environment]::GetFolderPath('ApplicationData')+'\Microsoft\Windows\SendTo\RunAsTI.bat'; $enc=[Text.Encoding]::UTF8
if ($env:0 -ne $SendTo) {[IO.File]::WriteAllLines($SendTo, [io.file]::ReadAllLines($env:0,$enc))}
:SendTo:
:: call RunAsTI snippet with default commandline args - if none provided, defaults to opening This PC as TI
call :RunAsTI %*
echo args: %*
::whoami
::timeout /t 7
:: done
exit /b
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: .bat script content end - copy-paste RunAsTI snippet ::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
#:RunAsTI snippet to run as TI/System, with innovative HKCU load, ownership privileges, high priority, and explorer support
set ^ #=& set "0=%~f0"& set 1=%*& powershell -c iex(([io.file]::ReadAllText($env:0)-split'#\:RunAsTI .*')[1])& exit /b
function RunAsTI ($cmd,$arg) { $id='RunAsTI'; $key="Registry::HKU\$(((whoami /user)-split' ')[-1])\Volatile Environment"; $code=@'
$I=[int32]; $M=$I.module.gettype("System.Runtime.Interop`Services.Mar`shal"); $P=$I.module.gettype("System.Int`Ptr"); $S=[string]
$D=@(); $T=@(); $DM=[AppDomain]::CurrentDomain."DefineDynami`cAssembly"(1,1)."DefineDynami`cModule"(1); $Z=[uintptr]::size
0..5|%!!()|% {$D += $D[$_]."MakeByR`efType"()}
$F='kernel','advapi','advapi', ($S,$S,$I,$I,$I,$I,$I,$S,$D[7],$D[8]), ([uintptr],$S,$I,$I,$D[9]),([uintptr],$S,$I,$I,[byte[]],$I)
0..2|% {$9=$D[0]."DefinePInvok`eMethod"(('CreateProcess','RegOpenKeyEx','RegSetValueEx')[$_],$F[$_]+'32',8214,1,$S,$F[$_+3],1,4)}
$DF=($P,$I,$P),($I,$I,$I,$I,$P,$D[1]),($I,$S,$S,$S,$I,$I,$I,$I,$I,$I,$I,$I,[int16],[int16],$P,$P,$P,$P),($D[3],$P),($P,$P,$I,$I)
1..5|%!!|% {$9=$D[$k]."Defin`eField"('f' + $n++, $_, 6)}}; 0..5|% {$T += $D[$_]."Creat`eType"()}
0..5|% {nv "A$_" ([Activator]::CreateInstance($T[$_])) -fo}; function F ($1,$2) {$T[0]."G`etMethod"($1).invoke(0,$2)}
$TI=(whoami /groups)-like'*1-16-16384*'; $As=0; if(!$cmd) {$cmd='control';$arg='admintools'}; if ($cmd-eq'This PC'){$cmd='file:'}
if (!$TI) {'TrustedInstaller','lsass','winlogon'|% {if (!$As) {$9=sc.exe start $_; $As=@(get-process -name $_ -ea 0|% {$_})[0]}}
function M ($1,$2,$3) {$M."G`etMethod"($1,[type[]]$2).invoke(0,$3)}; $H=@(); $Z,(4*$Z+16)|% {$H += M "AllocHG`lobal" $I $_}
M "WriteInt`Ptr" ($P,$P) ($H[0],$As.Handle); $A1.f1=131072; $A1.f2=$Z; $A1.f3=$H[0]; $A2.f1=1; $A2.f2=1; $A2.f3=1; $A2.f4=1
$A2.f6=$A1; $A3.f1=10*$Z+32; $A4.f1=$A3; $A4.f2=$H[1]; M "StructureTo`Ptr" ($D[2],$P,[boolean]) (($A2 -as $D[2]),$A4.f2,$false)
$Run=@($null, "powershell -win 1 -nop -c iex `$env:R; # $id", 0, 0, 0, 0x0E080600, 0, $null, ($A4 -as $T[4]), ($A5 -as $T[5]))
F 'CreateProcess' $Run; return}; $env:R=''; rp $key $id -force; $priv=[diagnostics.process]."GetM`ember"('SetPrivilege',42)[0]
'SeSecurityPrivilege','SeTakeOwnershipPrivilege','SeBackupPrivilege','SeRestorePrivilege' |% {$priv.Invoke($null, @("$_",2))}
$HKU=[uintptr][uint32]2147483651; $NT='S-1-5-18'; $reg=($HKU,$NT,8,2,($HKU -as $D[9])); F 'RegOpenKeyEx' $reg; $LNK=$reg[4]
function L ($1,$2,$3) {sp 'HKLM:\Software\Classes\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}' 'RunAs' $3 -force -ea 0
$b=[Text.Encoding]::Unicode.GetBytes("\Registry\User\$1"); F 'RegSetValueEx' @($2,'SymbolicLinkValue',0,6,[byte[]]$b,$b.Length)}
function Q {[int](gwmi win32_process -filter 'name="explorer.exe"'|?{$_.getownersid().sid-eq$NT}|select -last 1).ProcessId}
$11bug=($((gwmi Win32_OperatingSystem).BuildNumber)-eq'22000')-AND(($cmd-eq'file:')-OR(test-path -lit $cmd -PathType Container))
if ($11bug) {'System.Windows.Forms','Microsoft.VisualBasic' |% {[Reflection.Assembly]::LoadWithPartialName("'$_")}}
if ($11bug) {$path='^(l)'+$($cmd -replace '([\+\^\%\~\(\)\[\]])','{$1}')+'{ENTER}'; $cmd='control.exe'; $arg='admintools'}
L ($key-split'\\')[1] $LNK ''; $R=[diagnostics.process]::start($cmd,$arg); if ($R) {$R.PriorityClass='High'; $R.WaitForExit()}
if ($11bug) {$w=0; do {if($w-gt40){break}; sleep -mi 250;$w++} until (Q); [Microsoft.VisualBasic.Interaction]::AppActivate($(Q))}
if ($11bug) {[Windows.Forms.SendKeys]::SendWait($path)}; do {sleep 7} while(Q); L '.Default' $LNK 'Interactive User'
'@; $V='';'cmd','arg','id','key'|%{$V+="`n`$$_='$($(gv $_ -val)-replace"'","''")';"}; sp $key $id $($V,$code) -type 7 -force -ea 0
start powershell -args "-win 1 -nop -c `n$V `$env:R=(gi `$key -ea 0).getvalue(`$id)-join''; iex `$env:R" -verb runas
}; $A=$env:1-split'"([^"]+)"|([^ ]+)',2|%{$_.Trim(' "')}; RunAsTI $A[1] $A[2]; #:RunAsTI lean & mean snippet by AveYo, 2022.01.28
[/code]
Quelle:
[url]https://pastebin.com/AtejMKLj[/url]
Kann irgendjemad hier bitte erklären, warum das so komplex/kompliziert geschrieben ist und ob es sicher ist zu benutzen?
MfG