This is probably more trouble than you want to get into,
but... You may be able to do it with straight script. See this
link:
http://www.jsware.net/jsware/scripts.php3#fvinfo
That download uses only VBScript with the FileSystemObject
to extract FileVersionInfo from any PE file. Another download
on the same page extracts icons. The way they work is to
read the PE file directly to find the addresses of the resources.
If you figure out the specifics of how the message table is
stored and structured you should be able to use a similar script
to extract those. The biggest problem is finding documentation.
Microsoft's docs for PE format, and especially for resource table
format, are limited. But the general idea is that there are a number
of types of resources, all stored in a tree structure of pointers
within the file. Knowing the specific storage details allows you to
track down specific resources, essentially using VBS a a "resource
hacker".
> Hi Scripting Guys!
> I query the eventlog with the MS Log Parser. The output contains constants
> like %%2048. These constants stands for entries in the responding message
> table.
> For example the msobjs.dll contains the message table for the security
> eventlog.
> Does anyone has an example how to get the messages from the table with a
> vbscript?
> Thx!
> Marco
|
