ANALYZE_CRASH_MINIDUMPS

:: Analyze local crash minidumps by aveyo v1.1
:: You need to install Standalone Debugging Tools for Windows (WinDbg) before using this script!
:: http://msdn.microsoft.com/library/windows/hardware/ff551063%28v=vs.85%29.aspx
:: In the installation wizard, select Debugging Tools for Windows, and clear all other components
:: and override the default install path to C:\ instead (it will use C:\Debuggers)
:: Includes dxdiag report and installed and running programs
@ECHO off

CALL :CHECK_OS

:: Check for Debugging Tools for Windows installation
:: If script can't find them it means MS changed paths again

SET "TOOLS_FOUND="
SET "DEBUG_TOOLS=%PFVAR%\Debugging Tools for Windows (x86)"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
IF NOT DEFINED TOOLS_FOUND SET "DEBUG_TOOLS=C:\Program Files\Debugging Tools for Windows (x64)"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
SET "DEBUG_TOOLS=%PFVAR%\Windows Kits\8.1\Debuggers\x86"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
SET "DEBUG_TOOLS=%PFVAR%\Windows Kits\8.1\Debuggers\x64"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
SET "DEBUG_TOOLS=C:\Debuggers\x86"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
SET "DEBUG_TOOLS=C:\Debuggers\x64"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
:: edit
IF NOT DEFINED TOOLS_FOUND SET "DEBUG_TOOLS=C:\Program Files (x86)\Windows Kits\10\Debuggers\x64"
IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
::

IF NOT DEFINED TOOLS_FOUND ECHO. & ECHO    You need to install Standalone Debugging Tools for Windows (WinDbg) before using this script!
IF NOT DEFINED TOOLS_FOUND ECHO   https://msdn.microsoft.com/en-us/library/windows/hardware/ff551063(v=vs.85).aspx
IF NOT DEFINED TOOLS_FOUND ECHO   In the installation wizard, select Debugging Tools for Windows, and clear all other components
IF NOT DEFINED TOOLS_FOUND ECHO   and override the default install path to C:\ instead (it will use C:\Debuggers)
IF NOT DEFINED TOOLS_FOUND CALL :ERR ...

rem CALL :XECHO Debugging Tools for Windows="%DEBUG_TOOLS%"

:: Choose minidump file by filepicker window
CALL :XECHO Choose the .dmp/.mdmp file you want to analyze:
IF NOT EXIST "%~1" CALL :VBCHOOSEFILE
:: Choose minidump file by 1st parameter, skipping filepicker
IF EXIST "%~1" SET "ChosenFile=%~1"
IF EXIST "%~1" CALL :__VBCHOOSEFILE_VERIFY
FOR /F "tokens=*" %%I IN ("%ChosenFile%") DO ( SET "DUMPDIR=%%~dpI" &SET "DUMPFILE=%%~nI%%~xI")
CALL :XECHO Dump file = %ChosenFile%
:: get dxdiag and programs info
FINDSTR "'~1337%skip%vbprg" "%~f0">"%temp%\~1337prg.vbs"
START " " /WAIT dxdiag /t \Users\%USERNAME%\AppData\Local\Temp\dxdiag.txt
echo [INSTALLED PROGRAMS User] >"%TEMP%\List_my_programs.txt"
CSCRIPT //nologo "%temp%\~1337prg.vbs" "32" "HKCU" >>"%TEMP%\List_my_programs.txt"
echo [INSTALLED PROGRAMS Machine x86] >>"%TEMP%\List_my_programs.txt"
CSCRIPT //nologo "%temp%\~1337prg.vbs" "32" "HKLM" >>"%TEMP%\List_my_programs.txt"
echo [INSTALLED PROGRAMS Machine x64] >>"%TEMP%\List_my_programs.txt"
CSCRIPT //nologo "%temp%\~1337prg.vbs" "64" "HKLM" >>"%TEMP%\List_my_programs.txt"
DEL /F /Q "%temp%\~1337prg.vbs"
rem echo [INSTALLED PROGRAMS - MSI] >>"%TEMP%\List_my_programs.txt"
rem wmic product list brief | MORE >>"%TEMP%\List_my_programs.txt"
echo [STARTUP] >>"%TEMP%\List_my_programs.txt"
wmic startup list brief>"%TEMP%\wmic1.tmp"
TYPE "%TEMP%\wmic1.tmp"| MORE >>"%TEMP%\List_my_programs.txt"
echo [SERVICES] >>"%TEMP%\List_my_programs.txt"
wmic service list brief>"%TEMP%\wmic2.tmp"
TYPE "%TEMP%\wmic2.tmp"| MORE >>"%TEMP%\List_my_programs.txt"
echo [RUNNING PROGRAMS] >>"%TEMP%\List_my_programs.txt"
WMIC path win32_process get Processid,Caption,Commandline,WorkingSetSize>"%TEMP%\wmic3.tmp"
TYPE "%TEMP%\wmic3.tmp"| MORE >>"%TEMP%\List_my_programs.txt"
PING -n 10 localhost >nul 2>&1
:: start debugger
PUSHD "%DUMPDIR%"
"%DEBUG_TOOLS%\kd.exe" -y "srv*c:\symbols*http://msdl.microsoft.com/download/symbols" -logo "%ChosenFile%.txt" -c ".reload;!exploitable -m;.symopt;!analyze -v -f;!address -summary;vertarget;!PEB;lmft;.ecxr;kb;~*kp;.logclose;q" -z "%ChosenFile%"
COPY /Y "%ChosenFile%.txt" + "%USERPROFILE%\AppData\Local\Temp\dxdiag.txt" + "%TEMP%\List_my_programs.txt" "%ChosenFile%.txt" >nul 2>&1
START " " notepad "%ChosenFile%.txt"
POPD
ECHO  DONE!  &PING localhost >nul 2>&1 &EXIT /B

GOTO :eof

:CHECK_OS
:: This must run first
:: Usage: CALL :CHECK_OS
IF "%PROCESSOR_ARCHITECTURE%"=="x86" (
SET "MACHINE="
IF DEFINED PROCESSOR_ARCHITEW6432 SET "MACHINE=_x64"
) ELSE (
SET "MACHINE=_x64"
)
SET "REGNODE="
FOR %%I IN ("%PROGRAMFILES%") DO SET "PFVAR=%%~sI"
FOR %%I IN ("%WINDIR%\SYSTEM32") DO SET "SSVAR=%%~sI"
:: MS put ZERO thinking in naming x64 Program Files - brackets are deadly in batch files
IF "%MACHINE%"=="_64" (
FOR %%I IN ("%PROGRAMFILES(X86)%") DO SET "PFVAR=%%~sI"
FOR %%I IN ("%WINDIR%\SysWOW64") DO SET "SSVAR=%%~sI"
SET "REGNODE=Wow6432Node\"
IF DEFINED PROCESSOR_ARCHITEW6432 FOR %%I IN ("%WINDIR%\Sysnative") DO SET "SSVAR=%%~sI"
)
SET _MYVER=%~n0 by a^v^ey^o^ v1.1, please wait
TITLE %_MYVER% & COLOR 70
rem FOR /F "tokens=4-5 delims=. " %%i IN ('ver') DO SET WINVERSION=%%i%%j
rem IF %WINVERSION% LEQ 60 CALL :ERR ONLY FOR WINDOWS 7 OR ABOVE
rem CALL :XECHO PROGRAMFILES=%PFVAR% SYSTEM=%SSVAR%
GOTO :eof
::END.CHECK_OS

:ERR
:: Usage: Call :ERR string
echo/
echo #ERROR! %*
PAUSE &EXIT
GOTO :eof
::END.ERR

:XECHO
:: Extended echo
:: Usage: Call :XECHO string/var
:: Output: onscreen
rem CLS
echo/
IF NOT "%1_"=="_" echo #INFO: %*
IF DEFINED _TRACE echo/ & PAUSE
GOTO :eof
::END.XECHO

:VBCHOOSEFILE
:: Show a vbs prompt to pick a file
:: Usage: CALL :VBCHOOSEFILE
:: Output: %SOURCEDIR% %SOURCEFILE%
FINDSTR "'~1337v%skip%bc%skip%f" "%~f0">"%temp%\~1337cf.vbs"
CSCRIPT //nologo "%temp%\~1337cf.vbs" >"%temp%\~1337cf.cmd"
CALL "%temp%\~1337cf.cmd"
CALL :__VBCHOOSEFILE_VERIFY
GOTO :eof
:__VBCHOOSEFILE_VERIFY
:: file type filtering
DEL /F /Q "%temp%\~1337cf.vbs" >NUL 2>&1
DEL /F /Q "%temp%\~1337cf.cmd" >NUL 2>&1
IF ["%ChosenFile%"]==[""] CALL :ERR No file was chosen, please select a .dmp/.mdmp file next run
IF /I NOT [%ChosenFile:~-3%]==[dmp] CALL :ERR Please select a .dmp/.mdmp file next run
IF NOT EXIST "%ChosenFile%" CALL :ERR File cannot be accessed, try moving it to the current dir
GOTO :eof
::END.VBCHOOSEFILE


GOTO :eof
:: these are bundled vbs scripts used by this batch file
Set wShell=CreateObject("WScript.Shell") '~1337vbcf
Set oExec=wShell.Exec("mshta.exe ""about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();resizeTo(0,0);</script>""") '~1337vbcf
WScript.echo "set ChosenFile=" & oExec.StdOut.ReadLine '~1337vbcf
Const HKCU = &H80000001, HKLM = &H80000002 '~1337vbprg
Set oCtx = CreateObject("WbemScripting.SWbemNamedValueSet") '~1337vbprg
If WScript.Arguments(0) = "32" Then oCtx.Add "__ProviderArchitecture",32 Else oCtx.Add "__ProviderArchitecture",64 '~1337vbprg
oCtx.Add "__RequiredArchitecture", TRUE '~1337vbprg
Set oLoc = CreateObject("Wbemscripting.SWbemLocator") '~1337vbprg
Set oSvr = oLoc.ConnectServer("","root\default","","",,,,oCtx) '~1337vbprg
Set oReg = oSvr.Get("StdRegProv") '~1337vbprg
If WScript.Arguments(1) = "HKCU" Then Call ListMyApps(HKCU) Else Call ListMyApps(HKLM) '~1337vbprg
 '~1337vbprg
Sub ListMyApps(HIVE) '~1337vbprg
Set enumkey = oReg.Methods_("EnumKey").Inparameters '~1337vbprg
enumkey.Hdefkey = HIVE '~1337vbprg
enumkey.Ssubkeyname = "Software\Microsoft\Windows\CurrentVersion\Uninstall\" '~1337vbprg
set aApps = oReg.ExecMethod_("EnumKey", enumkey,,oCtx) '~1337vbprg
For Each strSubKey In aApps.snames '~1337vbprg
Set search = oReg.Methods_("GetStringValue").Inparameters '~1337vbprg
search.Hdefkey = HIVE '~1337vbprg
search.Ssubkeyname = "Software\Microsoft\Windows\CurrentVersion\Uninstall\" & strSubKey '~1337vbprg
search.Svaluename = "DisplayName" '~1337vbprg
set sName = oReg.ExecMethod_("GetStringValue", search,,oCtx) '~1337vbprg
If sName.sValue <> "" Then '~1337vbprg
search.Svaluename = "DisplayVersion" '~1337vbprg
set sVersion = oReg.ExecMethod_("GetStringValue", search,,oCtx) '~1337vbprg
If sVersion.sValue <> "" Then wscript.echo sName.sValue & " v" & sVersion.SValue Else wscript.echo sName.sValue '~1337vbprg
End If '~1337vbprg
Next '~1337vbprg
End Sub '~1337vbprg