Leaderboard

JohnOne, no: it appears the csrss / session 1 correlates ONLY to mouse & keyboard actions. Just startup task manager and watch that process IO Reads without touching the mouse or keyboard. While csrss may have other responsibilities, it seems to correlate almost entirely with keyboard and mouse activity. As an example, I logged into a remote PC I work with and took a snapshot of the IO Reads; 20-minutes later it's exactly the same value. Edit: After ~2-hours the IO Reads remain the same on the PC referenced above.

View the Project at GitHub: https://github.com/BetaLeaf/False-Positive-Reporter Download False Positive Reporter: https://github.com/BetaLeaf/False-Positive-Reporter/releases Wiki: https://github.com/BetaLeaf/False-Positive-Reporter/wiki Thanks Jos for your Example Script involving Emailing attachments. Thanks JohnOne for helping me figure out the Run as Non-Admin Issue. Thanks Chiron at http://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors.htm for your wonderful post. Disclaimer: This script is meant for submitting false positives to AntiVirus Vendors so you can deploy your scripts faster. I am not responsible for your misuse of this script.

That say's isn't a array, this happens when_StringBetween has nostring found => @error =1. So insert If @error then exitloop after _StringBetween, so the script not crashes.

in this following line you have redundant closing paranthesis: ControlSetText("NOTES", "", "[CLASS:IRIS.tedit; INSTANCE:1])", "Some email adress.....") Try like that: #include <Constants.au3> Local $hWnd_Notes = WinWaitActive("[CLASS:NOTES]") ; this works Send("^m") ; this works ControlSetText($hWnd_Notes, "", "[CLASS:IRIS.tedit; INSTANCE:1]", "Some email adress.....") ;this should write an email adress ControlClick($hWnd_Notes, "", "[CLASS:IRIS.bmpbutton; INSTANCE:4]") ;this should press the button send

Ah, great thanx. I am trying to interact with openssl $SSL_Exe_loc ="C:\OpenSSL-Win32\bin\" Local $iPID = Run($SSL_Exe_loc & "openssl.exe s_client -connect pop.gmail.com:995", @SystemDir, @SW_SHOW, $STDIN_CHILD + $STDOUT_CHILD) Local $sOutput = "" ; Store the output of StdoutRead to a variable. While 1 $sOutput &= StdoutRead($iPID) ; Read the Stdout stream of the PID returned by Run. if StringInStr ($sOutput, "OK") then ; StdinWrite ($iPID, "USER ASD") endif If @error Then ; Exit the loop if the process closes or StdoutRead returns an error. ExitLoop EndIf WEnd ConsoleWrite ($sOutput) I get the first stdout, "OK" then I am trying to send USER comand- but I get no response. It looks like Openssl doesnt receive Stdin?

just link inserted, here again:

@AutoBert I figured creation time would probably be in there and causing (part of) it. @BetaLeaf It's not for security purposes, just for validating I had the right script so it could be modified but keep the other stuff the same. @JohnOne That sounds fantastic but I have no idea how to do that

That's no random data, creation time is changed, may be File Version also (when autoincrement is enabled). So there is no way you must compile every script and document its hash. Once a script is recompiled you have to update your documentation.

A blank Item means that the path behind this "slot" was not found. You can simply fix it in the settings -> General -> Advanced. Use the button "Reset recently opened items". This will clear the list. As an alternative you can fix the path "manually" in the config.ini (section "history"). pj1path, pj2path .....

May it helps those who needed. #include <WinAPI.au3> ; #FUNCTION# ==================================================================================================================== ; Name ..........: _IsUEFIBoot ; Description ...: Detemine the Current OS is boot in UEFI mode or not ; Syntax ........: _IsUEFIBoot() ; Parameters ....: ; Return values .: True:OS is boot in UEFI ; False: OS is boot in Legacy BIOS ; Author ........: czyt ; Modified ......: ; Remarks .......: ; Related .......: http://techsupt.winbatch.com/webcgi/webbatch.exe?techsupt/nftechsupt.web+WinBatch/DllCall~Information+Booted~UEFI~or~BIOS.txt ; Link ..........: ; Example .......: MsgBox(0,'(*^__^*) The OS is in UEFI Boot mode?',_IsUEFIBoot()) ; =============================================================================================================================== #include <WinAPI.au3> Func _IsUEFIBoot() Local Const $ERROR_INVALID_FUNCTION = 0x1 Local $hDLL = DllOpen("Kernel32.dll") If @OSBuild > 8000 Then Local $aCall = DllCall($hDLL, "int", "GetFirmwareType", "int*", 0) DllClose($hDLL) If Not @error And $aCall[0] Then Switch $aCall[1] ; 1 - bios 2- uefi 3-unknown Case 2 Return True Case Else Return False EndSwitch EndIf Return False Else DllCall($hDLL, "dword", "GetFirmwareEnvironmentVariableW", "wstr", "", "wstr", '{00000000-0000-0000-0000-000000000000}', "wstr", Null, "dword", 0) DllClose($hDLL) If _WinAPI_GetLastError() = $ERROR_INVALID_FUNCTION Then Return False Else Return True EndIf EndIf EndFunc ;==>IsUEFIBoot updated at 2021-08-13: fixed check err on windows 8 above OS

and here's a solution with a func i written 2009: #include <Array.au3> #include <File.au3> $txt = "" For $i=0 to 100 $txt &= Random(1,30,1)&@CRLF Next ;$txt = FileRead('test.txt') ;if txt is ia in a file ;startpoint ;ConsoleWrite($txt & @CRLF) _ArrayDisplay(_countUniqueNumbers($txt), '_countUniqueNumbers') Func _countUniqueNumbers($sText='Test', $sDelim=@CRLF) ;ConsoleWrite($sText & @CRLF) ;returns the count of each unique number in a String ;autor: autobert (autoit.de) 11/2009 $sText = @CRLF&StringReplace($sText, ' ', '') $sText = StringReplace($sText, $sDelim, $sDelim & ' ') $aSource = StringSplit($sText, $sDelim, 3) _ArrayDelete($aSource, 0) ;_ArrayDisplay($aSource,'Original') $aUnique = _ArrayUnique($aSource) _ArrayDelete($aUnique, 0) Dim $aUnique2D[UBound($aUnique)][2] For $x = UBound($aUnique) - 1 To 0 Step -1 $aUnique2D[$x][0] = $aUnique[$x] StringReplace($sText, $aUnique[$x] & $sDelim, 'a') $aUnique2D[$x][1] = @extended If StringStripWS($aUnique2D[$x][0],8)='' Then _ArrayDelete($aUnique2D,$x) Next Return $aUnique2D EndFunc ;==>_countUniqueNumbers

Threads merged. @Yeezus please do not double post in the future. Forum etiquette would be to wait 24 hours to allow people time to answer your question.

This thread is a bit dated, but I thought I'd add in case anyone needs to find out whether the system is idle. Essentially, you can check the IO Reads from the process csrss.exe, session 1. Global $lastIOReads, $currentIOReads Global $MINUTES = 1000*60 Global $sleepTime = Round(1*$MINUTES,0) pauseIfNotIdle() Func pauseIfNotIdle() if $lastIOReads='' Then ; checks to see if this is the first call of this function $lastIOReads = _getIOReads() ; sets initial value Sleep($sleepTime) ; sleep, to look for idle $currentIOReads = _getIOReads() ; wake & check whether there has been any user input Else $lastIOReads = $currentIOReads ; not the first call, set last IO reads = the most recent $currentIOReads = _getIOReads() ; set IO reads to current EndIf While $lastIOReads<>$currentIOReads ; if there has been a change in the IO reads, do the loop Sleep($sleepTime) $lastIOReads = $currentIOReads ; set last IO reads = the most recent $currentIOReads = _getIOReads() ; set IO reads to current WEnd EndFunc ; pauseIfNotIdle() Func _getIOReads() Local $objWMIService = ObjGet("winmgmts:\root\CIMV2") Local $colItems = $objWMIService.ExecQuery('SELECT * FROM Win32_process where name="csrss.exe" and sessionId=1') ; csrss is the Windows input exe; session 1 is console, which is the active session If IsObj($colItems) then ; csrss will change its IO Reads with input to the keyboard or mouse For $objItem In $colItems Return $objItem.ReadOperationCount ; get IO reads Next Else Return False Endif EndFunc ; getIOReads()

dynamitemedia, Perhaps something like this: #include <GUIConstantsEx.au3> #include <ButtonConstants.au3> #include <WinAPI.au3> #include "GUIScrollbars_Ex.au3" ; Put your image paths in this array - sized to match required number of buttons Global $aImage[12]; = ["Image_Path_1", "Image_Path_2", "Image_Path_3", "Image_Path_4", "Image_Path_5", "Image_Path_6", "Image_Path_7", "Image_Path_8"] $iCount = UBound($aImage) ; Create array to hold button and label ControlIDs Global $aButton[$iCount], $aLabel[$iCount] ; Max buttons per row Global $iCol_Count = 5 ; Determine rows required $iRow_Count = Ceiling($iCount / $iCol_Count) Mainscript() Func Mainscript() ; Set max dialog size $iDialog_Width = 1265 $iDialog_Depth = 525 ; Determine button width $iButton_Dim = Floor(($iDialog_Width - 10 - _WinAPI_GetSystemMetrics(2)) / $iCol_Count) ; Determine required depth $iMax_Depth = ($iButton_Dim * $iRow_Count) If $iMax_Depth < $iDialog_Depth Then $iDialog_Depth = $iMax_Depth EndIf ; Create dialog $hDialog = GUICreate("", $iDialog_Width, $iDialog_Depth) ; will create a dialog box that when displayed is centered] GUISetBkColor(0xFFFFFF) If $iMax_Depth > $iDialog_Depth Then _GUIScrollbars_Generate($hDialog, 0, $iMax_Depth) EndIf ; Create labels For $i = 0 To $iRow_Count - 1 For $j = 0 To $iCol_Count - 1 $iIndex = $j + ($i * $iCol_Count) If $iIndex > $iCount - 1 Then ExitLoop $aLabel[$iIndex] = GUICtrlCreateLabel("", 10 + ($iButton_Dim * $j), 10 + ($iButton_Dim * $i), $iButton_Dim - 10, $iButton_Dim - 10) GUICtrlSetBkColor($aLabel[$iIndex], 0xFFFFFF) GUICtrlSetState($aLabel[$iIndex], $GUI_DISABLE) GUICtrlSetResizing($aLabel[$iIndex], $GUI_DOCKALL) Next Next ; Create buttons For $i = 0 To $iRow_Count - 1 For $j = 0 To $iCol_Count - 1 $iIndex = $j + ($i * $iCol_Count) If $iIndex > $iCount - 1 Then ExitLoop $aButton[$iIndex] = GUICtrlCreateButton("Button " & ($iIndex + 1), 15 + ($iButton_Dim * $j), 15 + ($iButton_Dim * $i), $iButton_Dim - 20, $iButton_Dim - 20, $BS_BITMAP) GUICtrlSetImage($aButton[$iIndex], $aImage[$iIndex]) GUICtrlSetResizing($aButton[$iIndex], $GUI_DOCKALL) Next Next ; Set default button GUICtrlSetState($aButton[0], $GUI_FOCUS) GUICtrlSetBkColor($aLabel[0], 0x00FF00) $hActive = GUICtrlGetHandle($aButton[0]) ; Create dummy controls $cDummy_Up = GUICtrlCreateDummy() $cDummy_Dn = GUICtrlCreateDummy() GUISetState() ; Set the Up/Down keys as accelerators - they will only act like this when your GUI is active Local $aAccelKeys[2][2] = [["{UP}", $cDummy_Up], ["{DOWN}", $cDummy_Dn]] GUISetAccelerators($aAccelKeys) While 1 $iMsg = GUIGetMsg() Switch $iMsg Case $GUI_EVENT_CLOSE ExitLoop Case $cDummy_Up _Vertical_TabStop() Case $cDummy_Dn _Vertical_TabStop(True) Case Else For $i = 0 To $iCount - 1 If $iMsg = $aButton[$i] Then MsgBox($MB_SYSTEMMODAL, "Pressed", "Button " & $i + 1) ExitLoop EndIf Next EndSwitch ; Get focused control $hCurrFocus = _WinAPI_GetFocus() ; If it has changed If $hCurrFocus <> $hActive Then ; See if it is a button For $i = 0 To $iCount - 1 If $hCurrFocus = GUICtrlGetHandle($aButton[$i]) Then ; Reset all the labels For $j = 0 To $iCount - 1 GUICtrlSetBkColor($aLabel[$j], 0xFFFFFF) Next ; Highlight the correct label GUICtrlSetBkColor($aLabel[$i], 0x00FF00) ExitLoop EndIf Next $hActive = $hCurrFocus EndIf WEnd EndFunc ;==>Mainscript Func _Vertical_TabStop($bDown = False) Local $iNext_Row, $iNext_Button Local $iRow_Count = Ceiling($iCount / $iCol_Count) ; Get active control $hActive = _WinAPI_GetFocus() For $i = 0 To $iCount - 1 ; If it is a button If $hActive = GUICtrlGetHandle($aButton[$i]) Then ; Determine row $iRow = Int($i / $iCol_Count) ; Set default value for next button $iNext_Button = $i If $bDown Then ; Not if in bottom row or there no button below If ($iRow < $iRow_Count - 1) And ($i + $iCol_Count < $iCount) Then $iNext_Button += $iCol_Count EndIf Else ; Not if in top row If $iRow Then $iNext_Button -= $iCol_Count EndIf EndIf ; Set focus to new button GUICtrlSetState($aButton[$iNext_Button], $GUI_FOCUS) ; No point in looking further ExitLoop EndIf Next EndFunc M23

@‌Martineau, you are completely right about this thing. Your code is broken with the new release. Unfortunately you can't do anything about it but try to adjust. The change was made by someone who doesn't fully understand internal working and the idea behind the Automation and COM in general. Dispatch interface in it's essence, was made up to avoid unexpected terminations and situations you face here. Any attempt of users to point to the mistake made in recent development of AutoIt where shut down, and users were hounded, like they are some enemies of AutoIt. Probably every user that used objects in AutoIt share your thoughts, and few of them have said almost the same thing as you. All ignored, some punished. Start COM error handler before you use COM in AutoIt, and you will be fine. Look for ObjEvent function.

@JohnOne - Good attempt, but it could be improved greatly (quite simply), by adding in elements that work with a drive serial number for instance or processor detail, username, etc. That way, the encrypted registry info couldn't just be swapped around from PC to PC.

Take a look on the devcon program from M$ http://www.osronline.com/article.cfm?id=150 Best regards Veronesi