Script Kitties Early Trick or Treat, Part 2

I promised a treat. Well, as scripts go, this will probably be like the time you went trick-or-treating as a kid and the old couple gave you three pennies and then you walked down the street and realized the pennies seemed to smell bad, but hey, it's money you didn't have before, so what the hay. It's not quite that bad, it's just I wrote it in 2006 and I didn't do much to bring it into modern times. But, here we go...

In 2006, PowerShell was just about to be released and around the same time I was thinking, darn it, wouldn't it be easier to experiment with VBScript if they had given me a command line? So I made one.

As it turns out, some malware is written in VBScript, so this came in handy a while back for me to decode a few lazily "encoded" strings that were assembled using the VBScript Chr() function and string concatenation. It let me figure out what COM objects were being created and move on with my life, so maybe it'll be useful to you.

I also added the ability to switch to JScript, because people also write malware in JScript, so hell, why not.

Here's a little demo:

You're wishing I just gave you the pennies now, aren't you.

Yeah, that's it. If you look at the code, you'll find out why it stinks just like those pennies. But it serves its purpose. So, enjoy!

Here's the code: https://github.com/strictlymike/eval-hta

Not a Fan

I use my sleep timer hypertext application with Windows Media Player to sing myself to sleep at night and softly wake me up in the morning.  It works pretty well.  But this morning at 5:07 AM, I woke up to my CPU fan spinning loudly.  On the nightstand.  Next to my ear.  I waited a minute hoping it would pass, but then the fan noise intensified as things really cranked into gear.  When I finally opened the lid and started poking around, the fans turned off and CPU utilization returned to normal before I could launch taskman.exe and see what was going on.

Being a judiciously paranoid android, this meant I had to stay up until six in the morning troubleshooting, eyes half-open, tweaking and testing to discover what was using my idle cycles so aggressively.

Finding the CPU Hog

The difficult part of finding the culprit was twofold: the offending process only seemed to run when the computer was idle (which takes about five minutes for Windows to decide is the case), and touching the keyboard or mouse (such as to sort processes by CPU % utilization) caused my quarry to go back into hiding.

Naturally, Mark Russinovich had me covered.  Process Explorer has a CPU History column that can be added to the processes pane, and if you sort processes by either CPU or CPU History, you can see the offending process without manipulating or interrupting the idle state of the desktop.

So, I set it up and hopped back into bed, waiting for the fan to come back on.  And of course, it did.  After one failed attempt (I screwed up and hit a key before my eyes were really open), I was able to hop back out of bed and find that MsMpEng.exe had risen to the top of the list.  I have a list of executables on my box which I searched for MsMpEng, finding one of the paths within an amd64_windows-defender-service WinSxS directory.  The Windows Defender event logs (in eventvwr.msc) correlated with the times at which I had been woken up, confirming that this was probably the culprit:

A little bit of searching confirmed that other people have had this problem due to scheduled scanning, which encouraged me to look in the Task Scheduler MMC snap-in and find this:

Being tired, I disabled these, made a note of it in my TODO list to look into later, and hopped into bed.

Cue Fans

Then it started *$#@ing doing it again!

I hopped out of bed and looked at Process Explorer, which I had left around out of either cynicism or laziness.  The new hotness was svchost.exe -k defragsvc.  DISK DEFRAGMENTER!  I thought you died with Windows 95!  I picked through the services MMC snap-in (services.msc), eyes still half-open, and couldn't find it.  I went to the command-line to figure out WTH the service name was so I could disable it.

C:\Users\someone>sc qc defragsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: defragsvc
  TYPE               : 10  WIN32_OWN_PROCESS
  START_TYPE         : 3   DEMAND_START
  ERROR_CONTROL      : 1   NORMAL
  BINARY_PATH_NAME   : C:\Windows\system32\svchost.exe -k defragsvc
  LOAD_ORDER_GROUP   :
  TAG                : 0
  DISPLAY_NAME       : Optimize drives
  DEPENDENCIES       : RPCSS
  SERVICE_START_NAME : localSystem

C:\Users\someone>

Yes, I could have disabled it from the command-line if I'd had the patience.  Instead I went and changed the service start-up type from manual to disabled.  I went to bed and laid with one eye open...  The screen dimmed, as it had before.  Then it went black, and still nothing.  Success!

A Workaround

This morning I re-enabled the services, and this evening I wrote a test to evaluate a fix for my sleep timer that would suppress idle tasks when it is in use (allowing me to sleep).

sh = new ActiveXObject("WScript.Shell");

function nudgeDown() {
    sh.SendKeys(String.fromCharCode(0xae));
}

while (true) {
    nudgeDown();
    WScript.Echo('Sleeping 60 seconds');
    WScript.Sleep(60 * 1000);
}

I saw that sending the volume-down character every 60 seconds stopped the screen from dimming, and I'm optimistic that it will serve my purpose.  In the long-term, maybe I could throttle Windows' CPU frequency scaling governer, but for purposes of going to sleep tonight, this will do.

Another time, maybe I'll describe how that snooze timer works.  For now, I'm snoozing.  G'nite.

Snooze

When I was in high school, I used to set a sleep timer and an alarm on my stereo and fall asleep to music, then wake up to it again in the morning.  Once I got into college, I did the same thing with .BAT files that would stop and re-start WinAmp (those were the days).

A couple years ago, to my wife's dismay, I remembered how much I enjoyed this, and wrote some scripts for Linux to not only stop and start different music but also fade the volume out so the sleep timer didn't abruptly wake me up, and back in so that the wake-up experience was a little more pleasant.  Soon after, I re-did this all as a Windows HTA (HyperText Application), and finally I re-did it this month in JavaScript so that it would work with Windows 8 and have a gradient.  It looks like this:

I call it "fade" because it fades music in and out, in addition to being a nice sleep / wake timer.  You can download the code at https://github.com/strictlymike/fade and follow along if you're interested.  Or, just save fade.hta to your computer and run it.  If it doesn't work for some reason, feel free to contact me, or use your HTML/JScript skillz to figure it out.  Cheers.

Getting Faded

If you know HTML, it's reasonably simple to get started.  You might want to know about this little guy, though:

    <meta http-equiv="x-ua-compatible" content="IE=edge" /> <!-- Gradients -->

Without him, you can't have gradients.  Though, if you use him, you have to use JavaScript -- VBScript has been eliminated.

The UI is a designer's nightmare, but here it is:

The BODY tag has an onload function to initialize the UI, and an oncontextmenu function that disables right-click:

    <body onLoad="onLoad()" oncontextmenu="return false">

The CSS includes a gradient and disables the scroll bar with the overflow: hidden directive:

    <style>
        body { background: linear-gradient(#000044, black 100%);
                                    overflow:          hidden;        }
    </style>

Another SELECT element is pre-populated with times that don't fall within nice, easy increments of 15 minutes:

                <select style="width: 100%;" name="selOffTime">
                    <option value="-1">Never</option>
                    <option value="0">Immediately</option>
                    <option value="0.25">15 seconds</option>
                    <option value="1">1 minute</option>
                    <option value="5">5 minutes</option>
                    <option value="10">10 minutes</option>
                    <option value="15">15 minutes</option>
                    <option value="20">20 minutes</option>
                </select>

The rest are calculated within the body's onLoad() function:

        for (min=30; min<240; min+=15) {
            opt = document.createElement('OPTION');
            if (min == 60) {
                opt.textContent = '1 hour';
            } else if (min > 60) {
                opt.textContent = (min/60).toString() + ' hours';
            } else {
                opt.textContent = min.toString() + ' minutes';
            }
            opt.value = min.toString();
            selOffTime.add(opt);
        }

An INPUT element is pre-populated with a likely (or is it unlikely?) wakeup time, and given an onchange handler:

                    onChange="updateOnTimerLabel()" name="txtOnTime"/>

Another INPUT element, of type "file", is added to permit selection of MP3 files or playlists:

    <input type="file" style="width: 100%;" name="fileToPlay"></input>
    <br/>

A start and cancel button are present, and each has a respective onClick handler:

                <button style="width: 100%;" onClick="start()"
                    name="btnStart">Start</button>

Finally, a status bar is at the bottom, with a black background to match the ending color of the linear gradient defined in the CSS:

    <div id="divStatusBar"
        style="color: white; background-color: black; font-weight: bold;">
        Loading...</div>

If you're a designer or just enjoy attention to detail, take a moment to appreciate the fact that I not only included my CSS in a <style/> tag, but also took the time to mix it with inline CSS using the style=... attribute for each element.

In my onLoad() function, I take care of initialization: resizing the window, instantiating COM objects, updating the label for the sleep time, setting the progress bar update timeout, and adding options in increments of 15 minutes to the timer select box.

The rest is triggered largely through the start() function, wherein I check whether a valid playlist or MP3 was selected for waking, and schedule fade-out and fade-in of the music.

When the sleep timer expires, fadeOut() is called, which in turn schedules nudgeDownWrapper() to be called ever two seconds.  The role of nudgeDownWrapper() is to send a keystroke event for the media volume down button (see https://msdn.microsoft.com/en-us/library/windows/desktop/dd375731%28v=vs.85%29.aspx) and count how many times this is done, finally sending a keystroke event for the media stop button.  The volume only needs to be decreased 50 times before it is certain to be muted, so that is how many times it is decreased.

If there is a wake timer, then after it expires, Windows Media Player is invoked with the playlist or MP3 as an argument, and nudgeUpWrapper() gets called to do its thing with volumeUp() several times.

I had another version that was media player-agnostic, but this simpler version is all that most people will need to get started building their own.

Rock_on.