是否可以使用 wmi 查询文件或进程哈希？

Question

我搜索了任何查询进程哈希的方法。 假设我能够使用 Win32_Process 检索 ExecutablePath， 我想查询文件的哈希。

我试图避免使用 powershell，但要实现与“Get-FileHash”相同的功能。

谢谢！

编辑： 我尝试使用提供 md5checksum 的 win32_filespecification，问题是我找不到相关文件（例如 notepad.exe）。

Answer 1

这是一个要测试的批处理文件：

@echo off
Title Get Notepad Hash
Set "App_Path=%windir%\system32\notepad.exe"
echo "%App_Path%"
@for /f "tokens=2 skip=3 delims= " %%a in ('Powershell Get-FileHash "%App_Path%"') do echo SHA256=%%a
Pause & Exit

编辑： 在命令行中使用 WMIC 和 Certutil 获取进程文件哈希

你可以试试第二个批处理文件：

@echo off
cls & color 9E & Mode 95,5
Title Get Process File Hash using WMIC and Certutil in command line 
Set "TmpFile=%~dpn0_Tmp.txt"
Set "LogPathExe=%~dpn0_PathExe.txt"
Set "Hashes=%~dpn0_Hashes.txt"

echo(
echo(                ===========================================================
echo(                    Please wait a while ... Working is in progress....
echo(                ===========================================================

Setlocal EnableDelayedExpansion
> "!TmpFile!" (
    @for /f "delims=" %%a in ('wmic process get ExecutablePath /format:list') do (
        @For /F "tokens=2 delims==" %%b in ("%%a") do (
            set "Exe=%%b"
                If not defined Exe Set !Exe! 
                    echo "!Exe!"
        )
    )
)

Call :RemoveDuplicateEntry "!TmpFile!" "!LogPathExe!"
Del "!TmpFile!" 

> "!Hashes!" (
    @for /f "delims=" %%a in ('Type "!LogPathExe!"') do (
        @for /f "skip=1 delims=" %%H in ('CertUtil -hashfile "%%~a" SHA256 ^| findstr /i /v "CertUtil"') do set "H=%%H"
            echo %%a=!H: =!
        )
    )
)

If Exist "!Hashes!"  Start "" "!Hashes!"  & Exit
::----------------------------------------------------
:RemoveDuplicateEntry <InputFile> <OutPutFile>
Powershell  ^
$Contents=Get-Content '%1';  ^
$LowerContents=$Contents.ToLower(^);  ^
$LowerContents ^| select -unique ^| Out-File '%2'
Exit /b
::----------------------------------------------------

检查 virustotal 哈希值的第三批脚本：

@echo off
cls & color 9E & Mode 95,5
Title Get Process File Hash using WMIC and Certutil in command line 
Set "TmpFile=%~dpn0_Tmp.txt"
Set "LogPathExe=%~dpn0_PathExe.txt"
Set "Hashes=%~dpn0_Hashes.txt"
Set "Hash2Check_VirusTotal=%~dpn0_Hash2Check_VirusTotal.txt"
If Exist "%Hash2Check_VirusTotal%" Del "%Hash2Check_VirusTotal%"

echo(
echo(                ===========================================================
echo(                    Please wait a while ... Working is in progress....
echo(                ===========================================================

Setlocal EnableDelayedExpansion
> "!TmpFile!" (
    @for /f "delims=" %%a in ('wmic process get ExecutablePath /format:list') do (
        @For /F "tokens=2 delims==" %%b in ("%%a") do (
            set "ExecutablePath=%%b"
                If not defined ExecutablePath Set !ExecutablePath! 
                    echo "!ExecutablePath!"
        )
    )
)

Call :RemoveDuplicateEntry "!TmpFile!" "!LogPathExe!"
Del "!TmpFile!" 

> "!Hashes!" (
    @for /f "delims=" %%a in ('Type "!LogPathExe!"') do (
        @for /f "skip=1 delims=" %%H in ('CertUtil -hashfile "%%~a" SHA256 ^| findstr /i /v "CertUtil"') do set "H=%%H"
            echo %%a=!H: =!
            >> "!Hash2Check_VirusTotal!" echo https://www.virustotal.com/old-browsers/file/!H: =!
        )
    )
)

cls
Echo(
Echo( Did you want to check the executable on Virustotal ? Just Type "Y" Or any key to Quit !
Set /p "Check="
If /I [!check!] EQU [Y] (
    @for /f "delims=" %%a in ('Type "!Hash2Check_VirusTotal!"') do ( Start "Chek SHA256 on VIRUSTOTAL" %%a & Timeout /T 10 /nobreak>nul)
) else (
    If Exist "!Hashes!"  Start "" "!Hashes!"  & Exit
)
Exit
::----------------------------------------------------
:RemoveDuplicateEntry <InputFile> <OutPutFile>
Powershell  ^
$Contents=Get-Content '%1';  ^
$LowerContents=$Contents.ToLower(^);  ^
$LowerContents ^| select -unique ^| Out-File '%2'
Exit /b
::----------------------------------------------------