From d789458a22e12246b7436bd03d5fb641bcc94871 Mon Sep 17 00:00:00 2001 From: Brian Warren Date: Sun, 29 Mar 2026 12:23:52 -0500 Subject: [PATCH] added scripts --- 4n/registry/reg-util-4n.cmd | 69 +++++++++++++++++++++++++++++++++++++ show-tcp.cmd | 19 ++++++++++ ua/show-ua-apps.ps1 | 48 ++++++++++++++++++++++++++ ua/show-uagrdev.cmd | 7 ++++ 4 files changed, 143 insertions(+) create mode 100644 4n/registry/reg-util-4n.cmd create mode 100644 show-tcp.cmd create mode 100644 ua/show-ua-apps.ps1 create mode 100644 ua/show-uagrdev.cmd diff --git a/4n/registry/reg-util-4n.cmd b/4n/registry/reg-util-4n.cmd new file mode 100644 index 0000000..e5ee3f2 --- /dev/null +++ b/4n/registry/reg-util-4n.cmd @@ -0,0 +1,69 @@ +@echo off +setlocal + +:ValidateArgs +if [%1] == [] goto Usage + +:LocalConfig +set RegRoot=HKCU +set DeleteKeys=0 +if /i [%1] == [delete] ( + set DeleteKeys=1 +) else ( + if /i [%1] == [hklm] set RegRoot=HKLM +) +if /i [%2] == [delete] ( + set DeleteKeys=1 +) + +@REM CLSID 65A... +@REM +:Execute +set DeviceAppName=4ndeva32.exe +set CLSID=65A59365-B7AF-460a-A733-9DB503B16EAF +set InterfaceId=D51A9C23-3C57-4cdf-B419-FB662276870A +set EventInterfaceId=37CFDA83-14C3-475E-91C4-93EB05C658B9 +set LibId=3794F27B-F75E-4565-ABCB-5D57E48BF50C +set ClassName=ANDevice.ANDev + +call :RegQuery "%RegRoot%\Software\Classes\CLSID\{%CLSID%}" +call :RegQuery "%RegRoot%\Software\Classes\Interface\{%InterfaceId%}" +call :RegQuery "%RegRoot%\Software\Classes\Interface\{%EventInterfaceId%}" +call :RegQuery "%RegRoot%\Software\Classes\%ClassName%" +call :RegQuery "%RegRoot%\Software\Classes\%ClassName%.1" +call :RegQuery "%RegRoot%\Software\Classes\TypeLib\{%LibId%}" +goto Cleanup + + +:RegQuery +@REM Technique 1: Use appropriate reg.exe for 32-bit context +set RegCmd=%SYSTEMROOT%\system32\reg.exe +if exist %SYSTEMROOT%\syswow64 set RegCmd=%SYSTEMROOT%\syswow64\reg.exe +if %DeleteKeys% == 1 ( +@REM %RegCmd% delete %1 /f + %RegCmd% delete %1 /f +) else ( + %RegCmd% query %1 /s || echo Missing key: %1 +) + +@REM @REM Technique 2: Use /reg:32 argument to force 32-bit registry access +@REM if %DeleteKeys% == 1 ( +@REM reg delete %1 /reg:32 /f +@REM ) else ( +@REM reg query %1 /reg:32 /s || echo Missing key: %1 +@REM ) + +goto Cleanup + + +:Usage +echo %~n0 HIVE_ABBREVIATION [delete] +echo Examples: +echo %~n0 hkcu +echo %~n0 hkcu delete +echo %~n0 hklm +echo %~n0 hklm delete + + +:Cleanup +endlocal diff --git a/show-tcp.cmd b/show-tcp.cmd new file mode 100644 index 0000000..4d7c93e --- /dev/null +++ b/show-tcp.cmd @@ -0,0 +1,19 @@ +@echo off + +if [%1] == [] goto :Usage + +:Loop +cls +@REM tasklist /fi "imagename eq %~1" +tasklist |findstr /i %~1 +netstat -anp tcp | findstr /i %~1 +netstat -anp tcpv6 | findstr /i %~1 +ping -n 6 127.0.0.1 >NUL +goto Loop + +goto Cleanup + +:Usage +echo %~n0 port + +:Cleanup diff --git a/ua/show-ua-apps.ps1 b/ua/show-ua-apps.ps1 new file mode 100644 index 0000000..25187a4 --- /dev/null +++ b/ua/show-ua-apps.ps1 @@ -0,0 +1,48 @@ +$UaAppProcessNames = @( + "AirportPortalAPM", + "GateReader", + "GoUAL", + "Jet", + "PassportReaderCommonUse", + "PRSAttachmateHelper", + "StationManager", + "QSS", + "UAGRDEV", + "UASRDEV" +) +$UaUtilProcessNames = @( + "accmgr32", + "accsmngr", + "co-msr", + "cokeys", + "cokeys2", + "goual", + "guarddog", + "hllwatch", + "pt32", + "passport", + "ptrstray", + "spltsrvc" +) +$UaProcessNames = $UaAppProcessNames += $UaUtilProcessNames +$MySessionId = (Get-Process -PID $PID).SessionId + +Measure-Command { + do + { + Clear-Host + Write-Host "Session ID: $MySessionId" + $MySessionProcesses = Get-Process | Where-Object {$_.SessionId -eq $MySessionId} + $UaProcesses = $MySessionProcesses | Where-Object {$UaProcessNames -contains $_.ProcessName} + if ($UaProcesses.Count -eq 0) { + Write-Host "No UA applications are running in this session." + break + } + $UaProcesses | ForEach-Object { + Write-Host "Process ID: $($_.Id), Process Name: $($_.ProcessName)" + } + Write-Host + Write-Host "(refresh interval: 3 seconds)" + Start-Sleep -Seconds 3 + } until ([System.Console]::KeyAvailable) +} diff --git a/ua/show-uagrdev.cmd b/ua/show-uagrdev.cmd new file mode 100644 index 0000000..b33848d --- /dev/null +++ b/ua/show-uagrdev.cmd @@ -0,0 +1,7 @@ +@echo off +:loop +cls +echo Monitoring UAGRDEV* - Last updated: %TIME% +tasklist /FI "IMAGENAME eq UAGRDEV*" +timeout /t 3 > nul +goto loop \ No newline at end of file