Demon

http://demon.tw/reverse/vbscript-internal-createobject.html

http://demon.tw/programming/createobject-again.html

首先那篇文章不是我写的，是复制粘贴UMU的，文章下面有链接http://hi.baidu.com/umu618/item/8c621e8be433025d840fab07

其次UMU的文章并不完全正确

再次，就算那篇文章正确，你的代码也不正确

Demon

第一，按照UMU的理论，Programmable或者Implemented Categories为{40FC6ED5-2438-11CF-A3DB-080036F12502}的组件都能被VBS调用，你的代码只列出了Programmable的

第二，某些CLSID下的ProgID子键为空，而你的代码没有判断ProgID是否为空，例如下面这样的，你的代码就会匹配到hex(0):

[HKEY_CLASSES_ROOT\clsid\{639F5AF5-BCED-4369-AC34-360B16D955FD}]
@="GestureRecognizer Class"

[HKEY_CLASSES_ROOT\clsid\{639F5AF5-BCED-4369-AC34-360B16D955FD}\InprocServer32]
@=hex(2):25,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,50,00,72,00,6f,00,67,00,72,\
  00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,4d,00,69,00,63,00,\
  72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,68,00,61,00,72,00,65,00,64,\
  00,5c,00,49,00,6e,00,6b,00,5c,00,49,00,6e,00,6b,00,4f,00,62,00,6a,00,2e,00,\
  64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"

[HKEY_CLASSES_ROOT\clsid\{639F5AF5-BCED-4369-AC34-360B16D955FD}\ProgID]
@=hex(0):

[HKEY_CLASSES_ROOT\clsid\{639F5AF5-BCED-4369-AC34-360B16D955FD}\Programmable]

[HKEY_CLASSES_ROOT\clsid\{639F5AF5-BCED-4369-AC34-360B16D955FD}\TypeLib]
@=hex(0):

[HKEY_CLASSES_ROOT\clsid\{639F5AF5-BCED-4369-AC34-360B16D955FD}\VersionIndependentProgID]
@=hex(0):
复制代码