2

In VBScript on Windows RT, a running script only has access to three COM objects, one of which is Scripting.FileSystemObject.

How can I use only FileSystemObject to determine the operating system's processor architecture (in this case, it is ARM)?

Normally I would query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment -> PROCESSOR_ARCHITECTURE, or I would use WScript.Shell to get the system-level environment variable PROCESSOR_ARCHITECTURE. However, I cannot use the usual techniques in this situation.

Note: I thought about using Scripting.FileSystemObject to get the file version of ntoskrnl.exe, which would tell me that I'm on Windows version 6.3. And then after trying to create a WScript.Shell object and failing, making the assumption that I must be on an ARM Windows RT device. However, this feels very sloppy. It's been a while, but I have seen situations where antivirus interferes with the ability to instantiate objects in VBScript, and I want this code to be accurate/reliable.

Frank Lesniak
  • 560
  • 1
  • 5
  • 18

2 Answers2

1

Based on this answer, I was able to put together a robust VBScript function that reads the "machine type" from the PE header of an executable file.

The function and its prerequisites are too long to post here, but I have added them in a file called GetExecutableProcessorArchitectureFromFile.vbs on my GitHub repository.

Using the function GetExecutableProcessorArchitectureFromFile(), we can get the operating system processor architecture on Windows RT (or any other Windows operating system, really) using code like the following:

' Note: it's best to get the Windows path programmatically; however, the scope of doing so is outside the scope of this question
strWindowsPath = "C:\Windows"
intReturnCode = GetExecutableProcessorArchitectureFromFile(strOSProcessorArchitecture, strWindowsPath & "\explorer.exe")
If intReturnCode >= 0 Then
    WScript.Echo("OS Processor Architecture=" & strOSProcessorArchitecture)
End If

I have tested this technique on Intel IA-32 (32-bit x86), AMD64 / Intel x86-x64 (x64), ARM (32-bit), ARM64, Alpha, PowerPC, and MIPS executables.

Note: I ended up using %WINDIR%\explorer.exe because explorer.exe is present on all versions of Windows that support VBScript excluding Windows Server Core and Nano, all the way back to Windows 95 running VBScript 5.1. It would be more robust to build a logic tree like the following:

  • Check C:\Windows\Sysnative\ntoskrnl.exe (this path allows Windows-on-Windows (WOW) processes - for example, 32-bit cscript.exe on 64-bit Windows - to access the "native" system binaries. However, note: this approach would not work on Windows XP and Windows Server 2003/2003 R2 x64 if KB942589 is missing. It would also fail if the current process is running under the OS-native processor architecture. However, my function handles failures gracefully)
  • If the previous attempt failed (i.e., intReturnCode was < 0), check C:\Windows\System32\ntoskrnl.exe
  • If the previous attempts failed (i.e., intReturnCode was < 0), check C:\Windows\System\krnl386.exe (Windows 95, 98, and ME)
  • If the previous attempts failed (i.e., intReturnCode was < 0), check C:\Windows\explorer.exe

Note 2: If anyone needs a pointer for how to get the Windows or Windows system paths programmatically, see GetWindowsPath.vbs and GetWindowsSystemPath.vbs in my GitHub repository.

Frank Lesniak
  • 560
  • 1
  • 5
  • 18
-1
On error resume Next
Set X = createobject("shell.application")
If err.number <> 0 then
    MsgBox "winrt"
    err.clear
End if
On error Goto 0

So in programming we try and test what happened not try to work out what might happen.

user14797724
  • 109
  • 1
  • 3
  • I appreciate the attempt, but Shell.Application does not exist on legacy operating systems (Windows 95 and 98, for example). This code would result in incorrectly flagging these operating systems as Windows RT. It also doesn't directly state the processor architecture (which is what the question was asking) - though that would only require a replacement of "winrt" with "ARM" – Frank Lesniak Jan 31 '21 at 04:46