0
Const HKEY_LOCAL_MACHINE  = &H80000002
Const REG_EXPAND_SZ = 2 
strComputer = "." ' Use . for current machine
hDefKey = HKEY_LOCAL_MACHINE
strKeyPath = "SYSTEM\CurrentControlSet\Services"

On Error Resume Next
Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

oReg.EnumKey hDefKey, strKeyPath, arrSubKeys
For Each strSubkey In arrSubKeys
    strSubKeyPath = strKeyPath & "\" & strSubkey

    oReg.EnumValues hDefKey, strSubKeyPath, arrValueNames, arrTypes        
    For i = LBound(arrValueNames) To UBound(arrValueNames)
        strValueName = arrValueNames(i)
        Select Case arrTypes(i)
            Case REG_EXPAND_SZ
                oReg.GetStringValue hDefKey, strSubKeyPath, strValueName, strValue
                     If InStr(1, strValue, Chr(34), 1) = 0 Then
                         strValueTemp = Chr(34) & strValue
                         wscript.echo "  " & strValueName & " (REG_EXPAND_SZ) = " & strValueTemp
                     End IF
        End Select
    Next
Next 

This code outputs these strings:

ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe -k netsvcs -p

ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe -k netsvcs -p

ImagePath (REG_EXPAND_SZ) = "\SystemRoot\System32\drivers\xboxgip.sys

How could I add another quote to each string at the point where the string has .exe or .sys providing this output.

ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe" -k netsvcs -p

ImagePath (REG_EXPAND_SZ) = "C:\Windows\system32\svchost.exe" -k netsvcs -p

ImagePath (REG_EXPAND_SZ) = "\SystemRoot\System32\drivers\xboxgip.sys"

This code is to apply fix to a Windows Security flaw.

Andrew Drake
  • 655
  • 1
  • 11
  • 25
  • 1
    Possible duplicate of [Adding quotes to a string in VBScript](https://stackoverflow.com/questions/2942554/adding-quotes-to-a-string-in-vbscript) – user692942 Aug 28 '18 at 13:41

1 Answers1

0

If you are just trying to add another quote after the file extension, try this:

strValueTemp = replace(strValueTemp,".exe ",".exe" & Chr(34) & " ")
strValueTemp = replace(strValueTemp,".sys ",".sys" & Chr(34) & " ")

Note that Chr(34) corresponds to a double quote. It is also important to keep the text to be replaced as ".exe " with the space, as the space means that the quote is already missing in the string.

Andrew Drake
  • 655
  • 1
  • 11
  • 25