View difference between Paste ID: J29nWzXS and cQ4s0FhY

-:: Analyze crash minidumps by aveyo v1.0b
+:: Analyze local crash minidumps by aveyo v1.1
 :: You need to install Standalone Debugging Tools for Windows (WinDbg) before using this script!
 :: http://msdn.microsoft.com/library/windows/hardware/ff551063%28v=vs.85%29.aspx
 :: In the installation wizard, select Debugging Tools for Windows, and clear all other components
 :: and override the default install path to C:\ instead (it will use C:\Debuggers)
-:: No more wasting internet bandwidth with 30MB+ dumps (like in dota2). Send just the text summary
+:: Includes dxdiag report and installed and running programs
 @ECHO off
 
 CALL :CHECK_OS
 
 :: Check for Debugging Tools for Windows installation
 :: If script can't find them it means MS changed paths again
 
 SET "TOOLS_FOUND="
 SET "DEBUG_TOOLS=%PFVAR%\Debugging Tools for Windows (x86)"
 IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
 IF NOT DEFINED TOOLS_FOUND SET "DEBUG_TOOLS=C:\Program Files\Debugging Tools for Windows (x64)"
 IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
 SET "DEBUG_TOOLS=%PFVAR%\Windows Kits\8.1\Debuggers\x86"
 IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
 SET "DEBUG_TOOLS=%PFVAR%\Windows Kits\8.1\Debuggers\x64"
 IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
 SET "DEBUG_TOOLS=C:\Debuggers\x86"
 IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
 SET "DEBUG_TOOLS=C:\Debuggers\x64"
 IF EXIST "%DEBUG_TOOLS%\kd.exe" SET /A TOOLS_FOUND=1
 :: edit
-IF NOT DEFINED TOOLS_FOUND CALL :ERR You need to install Standalone Debugging Tools for Windows (WinDbg) before using this script!
+IF NOT DEFINED TOOLS_FOUND SET "DEBUG_TOOLS=C:\Program Files (x86)\Windows Kits\10\Debuggers\x64"
-IF NOT DEFINED TOOLS_FOUND CALL :ERR http://msdn.microsoft.com/library/windows/hardware/ff551063%28v=vs.85%29.aspx
+
-IF NOT DEFINED TOOLS_FOUND CALL :ERR In the installation wizard, select Debugging Tools for Windows, and clear all other components
+::
-IF NOT DEFINED TOOLS_FOUND CALL :ERR and override the default install path to C:\ instead (it will use C:\Debuggers)
+
 IF NOT DEFINED TOOLS_FOUND ECHO. & ECHO    You need to install Standalone Debugging Tools for Windows (WinDbg) before using this script!
 IF NOT DEFINED TOOLS_FOUND ECHO   https://msdn.microsoft.com/en-us/library/windows/hardware/ff551063(v=vs.85).aspx
 IF NOT DEFINED TOOLS_FOUND ECHO   In the installation wizard, select Debugging Tools for Windows, and clear all other components
 IF NOT DEFINED TOOLS_FOUND ECHO   and override the default install path to C:\ instead (it will use C:\Debuggers)
 IF NOT DEFINED TOOLS_FOUND CALL :ERR ...
 
 rem CALL :XECHO Debugging Tools for Windows="%DEBUG_TOOLS%"
 
 :: Choose minidump file by filepicker window
 CALL :XECHO Choose the .dmp/.mdmp file you want to analyze:
 IF NOT EXIST "%~1" CALL :VBCHOOSEFILE
 :: Choose minidump file by 1st parameter, skipping filepicker
-"%DEBUG_TOOLS%\kd.exe" -y "srv*c:\symbols*http://msdl.microsoft.com/download/symbols" -logo "%ChosenFile%.txt" -c ".reload;!analyze -v;r;kv;lmnt;.logclose;q" -z "%ChosenFile%"
+
-START " " /WAIT dxdiag /dontskip /whql:on /t dxdiag.txt
+
-COPY /Y "%ChosenFile%.txt" + "%DUMPDIR%\dxdiag.txt" "%ChosenFile%.txt" >nul 2>&1
+
 CALL :XECHO Dump file = %ChosenFile%
 :: get dxdiag and programs info
 FINDSTR "'~1337%skip%vbprg" "%~f0">"%temp%\~1337prg.vbs"
 START " " /WAIT dxdiag /t \Users\%USERNAME%\AppData\Local\Temp\dxdiag.txt
 echo [INSTALLED PROGRAMS User] >"%TEMP%\List_my_programs.txt"
 CSCRIPT //nologo "%temp%\~1337prg.vbs" "32" "HKCU" >>"%TEMP%\List_my_programs.txt"
 echo [INSTALLED PROGRAMS Machine x86] >>"%TEMP%\List_my_programs.txt"
 CSCRIPT //nologo "%temp%\~1337prg.vbs" "32" "HKLM" >>"%TEMP%\List_my_programs.txt"
 echo [INSTALLED PROGRAMS Machine x64] >>"%TEMP%\List_my_programs.txt"
 CSCRIPT //nologo "%temp%\~1337prg.vbs" "64" "HKLM" >>"%TEMP%\List_my_programs.txt"
 DEL /F /Q "%temp%\~1337prg.vbs"
 rem echo [INSTALLED PROGRAMS - MSI] >>"%TEMP%\List_my_programs.txt"
 rem wmic product list brief | MORE >>"%TEMP%\List_my_programs.txt"
 echo [STARTUP] >>"%TEMP%\List_my_programs.txt"
 wmic startup list brief>"%TEMP%\wmic1.tmp"
 TYPE "%TEMP%\wmic1.tmp"| MORE >>"%TEMP%\List_my_programs.txt"
 echo [SERVICES] >>"%TEMP%\List_my_programs.txt"
 wmic service list brief>"%TEMP%\wmic2.tmp"
 TYPE "%TEMP%\wmic2.tmp"| MORE >>"%TEMP%\List_my_programs.txt"
 echo [RUNNING PROGRAMS] >>"%TEMP%\List_my_programs.txt"
 WMIC path win32_process get Processid,Caption,Commandline,WorkingSetSize>"%TEMP%\wmic3.tmp"
 TYPE "%TEMP%\wmic3.tmp"| MORE >>"%TEMP%\List_my_programs.txt"
 PING -n 10 localhost >nul 2>&1
 :: start debugger
 PUSHD "%DUMPDIR%"
-SET _MYVER=%~n0 by a^v^ey^o^ v1.0 &TITLE %_MYVER%
+"%DEBUG_TOOLS%\kd.exe" -y "srv*c:\symbols*http://msdl.microsoft.com/download/symbols" -logo "%ChosenFile%.txt" -c ".reload;!exploitable -m;.symopt;!analyze -v -f;!address -summary;vertarget;!PEB;lmft;.ecxr;kb;~*kp;.logclose;q" -z "%ChosenFile%"
 COPY /Y "%ChosenFile%.txt" + "%USERPROFILE%\AppData\Local\Temp\dxdiag.txt" + "%TEMP%\List_my_programs.txt" "%ChosenFile%.txt" >nul 2>&1
 START " " notepad "%ChosenFile%.txt"
 POPD
 ECHO  DONE!  &PING localhost >nul 2>&1 &EXIT /B
 
 GOTO :eof
 
 :CHECK_OS
 :: This must run first
 :: Usage: CALL :CHECK_OS
 IF "%PROCESSOR_ARCHITECTURE%"=="x86" (
 SET "MACHINE="
 IF DEFINED PROCESSOR_ARCHITEW6432 SET "MACHINE=_x64"
 ) ELSE (
 SET "MACHINE=_x64"
 )
 SET "REGNODE="
 FOR %%I IN ("%PROGRAMFILES%") DO SET "PFVAR=%%~sI"
 FOR %%I IN ("%WINDIR%\SYSTEM32") DO SET "SSVAR=%%~sI"
 :: MS put ZERO thinking in naming x64 Program Files - brackets are deadly in batch files
 IF "%MACHINE%"=="_64" (
 FOR %%I IN ("%PROGRAMFILES(X86)%") DO SET "PFVAR=%%~sI"
 FOR %%I IN ("%WINDIR%\SysWOW64") DO SET "SSVAR=%%~sI"
 SET "REGNODE=Wow6432Node\"
 IF DEFINED PROCESSOR_ARCHITEW6432 FOR %%I IN ("%WINDIR%\Sysnative") DO SET "SSVAR=%%~sI"
 )
 SET _MYVER=%~n0 by a^v^ey^o^ v1.1, please wait
 TITLE %_MYVER% & COLOR 70
 rem FOR /F "tokens=4-5 delims=. " %%i IN ('ver') DO SET WINVERSION=%%i%%j
 rem IF %WINVERSION% LEQ 60 CALL :ERR ONLY FOR WINDOWS 7 OR ABOVE
 rem CALL :XECHO PROGRAMFILES=%PFVAR% SYSTEM=%SSVAR%
 GOTO :eof
 ::END.CHECK_OS
 
 :ERR
 :: Usage: Call :ERR string
 echo/
 echo #ERROR! %*
-IF [%ChosenFile%]==[] CALL :ERR No file was chosen, please select a .dmp/.mdmp file next run
+
 GOTO :eof
 ::END.ERR
 
 :XECHO
 :: Extended echo
 :: Usage: Call :XECHO string/var
 :: Output: onscreen
 rem CLS
 echo/
-WScript.echo "set ChosenFile=" & oExec.StdOut.ReadLine '~1337vbcf
+
 IF DEFINED _TRACE echo/ & PAUSE
 GOTO :eof
 ::END.XECHO
 
 :VBCHOOSEFILE
 :: Show a vbs prompt to pick a file
 :: Usage: CALL :VBCHOOSEFILE
 :: Output: %SOURCEDIR% %SOURCEFILE%
 FINDSTR "'~1337v%skip%bc%skip%f" "%~f0">"%temp%\~1337cf.vbs"
 CSCRIPT //nologo "%temp%\~1337cf.vbs" >"%temp%\~1337cf.cmd"
 CALL "%temp%\~1337cf.cmd"
 CALL :__VBCHOOSEFILE_VERIFY
 GOTO :eof
 :__VBCHOOSEFILE_VERIFY
 :: file type filtering
 DEL /F /Q "%temp%\~1337cf.vbs" >NUL 2>&1
 DEL /F /Q "%temp%\~1337cf.cmd" >NUL 2>&1
 IF ["%ChosenFile%"]==[""] CALL :ERR No file was chosen, please select a .dmp/.mdmp file next run
 IF /I NOT [%ChosenFile:~-3%]==[dmp] CALL :ERR Please select a .dmp/.mdmp file next run
 IF NOT EXIST "%ChosenFile%" CALL :ERR File cannot be accessed, try moving it to the current dir
 GOTO :eof
 ::END.VBCHOOSEFILE
 
 
 GOTO :eof
 :: these are bundled vbs scripts used by this batch file
 Set wShell=CreateObject("WScript.Shell") '~1337vbcf
 Set oExec=wShell.Exec("mshta.exe ""about:<input type=file id=FILE><script>FILE.click();new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).WriteLine(FILE.value);close();resizeTo(0,0);</script>""") '~1337vbcf
 WScript.echo "set ChosenFile=" & oExec.StdOut.ReadLine '~1337vbcf
 Const HKCU = &H80000001, HKLM = &H80000002 '~1337vbprg
 Set oCtx = CreateObject("WbemScripting.SWbemNamedValueSet") '~1337vbprg
 If WScript.Arguments(0) = "32" Then oCtx.Add "__ProviderArchitecture",32 Else oCtx.Add "__ProviderArchitecture",64 '~1337vbprg
 oCtx.Add "__RequiredArchitecture", TRUE '~1337vbprg
 Set oLoc = CreateObject("Wbemscripting.SWbemLocator") '~1337vbprg
 Set oSvr = oLoc.ConnectServer("","root\default","","",,,,oCtx) '~1337vbprg
 Set oReg = oSvr.Get("StdRegProv") '~1337vbprg
 If WScript.Arguments(1) = "HKCU" Then Call ListMyApps(HKCU) Else Call ListMyApps(HKLM) '~1337vbprg
  '~1337vbprg
 Sub ListMyApps(HIVE) '~1337vbprg
 Set enumkey = oReg.Methods_("EnumKey").Inparameters '~1337vbprg
 enumkey.Hdefkey = HIVE '~1337vbprg
 enumkey.Ssubkeyname = "Software\Microsoft\Windows\CurrentVersion\Uninstall\" '~1337vbprg
 set aApps = oReg.ExecMethod_("EnumKey", enumkey,,oCtx) '~1337vbprg
 For Each strSubKey In aApps.snames '~1337vbprg
 Set search = oReg.Methods_("GetStringValue").Inparameters '~1337vbprg
 search.Hdefkey = HIVE '~1337vbprg
 search.Ssubkeyname = "Software\Microsoft\Windows\CurrentVersion\Uninstall\" & strSubKey '~1337vbprg
 search.Svaluename = "DisplayName" '~1337vbprg
 set sName = oReg.ExecMethod_("GetStringValue", search,,oCtx) '~1337vbprg
 If sName.sValue <> "" Then '~1337vbprg
 search.Svaluename = "DisplayVersion" '~1337vbprg
 set sVersion = oReg.ExecMethod_("GetStringValue", search,,oCtx) '~1337vbprg
 If sVersion.sValue <> "" Then wscript.echo sName.sValue & " v" & sVersion.SValue Else wscript.echo sName.sValue '~1337vbprg
 End If '~1337vbprg
 Next '~1337vbprg
 End Sub '~1337vbprg