按照这个问题，我试图弄清楚如何cscript.exe解析.wshWindows 脚本宿主控制文件。首先我尝试了 WinDbg，但 Radare2-Cutter 似乎是一个更好的软件 TBH。我做了什么：
C:\Windows\System32\cscript.exeFile > Import PDB > cscript.pdbView > Refresh Contents但是，图表选项卡显示为空：
图表（空）
未检测到功能。无法显示图表。
如果您能帮助我了解问题所在以及如何解决，我将不胜感激。
PS对解决原始问题的任何其他帮助也受到高度赞赏。😉
使用 cdb（windbg 控制台）调试
打开提升的命令提示符
运行
cdb -c "bp cscript!CscriptFile::create;g;kc;r;du@rcx;" cscript hell.vbs
这会在创建时设置断点并在命中 bp 时转储堆栈
可以看到 cscript!CscriptEngine::Compile 函数在这之后解析和编译文件
Breakpoint 0 hit
Call Site
cscript!CScriptFile::Create
cscript!CHost::RunStandardScript
cscript!CHost::Execute
cscript!CHost::Main
cscript!main
cscript!_mainCRTStartup
cscript!mainCRTStartup
KERNEL32!BaseThreadInitThunk
ntdll!RtlUserThreadStart
rax=0000000000000000 rbx=000000e91cdff380 rcx=000002404a919a58
rdx=0000000000000000 rsi=000000e91cdff600 rdi=000002404c6109a8
rip=00007ff617175b14 rsp=000000e91cdfeb58 rbp=0000000000000000
r8=000000e91cdff600 r9=0000000000000000 r10=000002404a8fb2f0
r11=000000e91cdfeb60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=000000e91cdff6c8
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
cscript!CScriptFile::Create:
00007ff6`17175b14 48895c2410 mov qword ptr [rsp+10h],rbx ss:000000e9`1cdfeb68=0000000000000000
00000240`4a919a58 "c:\hell.vbs"
创建、加载、编译和执行脚本的函数
0:000> uf /c cscript!CHost::RunStandardScript
cscript!CHost::RunStandardScript (00007ff6`17171d88)
cscript!CHost::RunStandardScript+0x39 (00007ff6`17171dc1):
call to cscript!CScriptFile::Create (00007ff6`17175b14)
cscript!CHost::RunStandardScript+0x4c (00007ff6`17171dd4):
call to cscript!CScriptFile::Load (00007ff6`17171cd0)
cscript!CHost::RunStandardScript+0x74 (00007ff6`17171dfc):
call to cscript!CScriptingEngine::Compile (00007ff6`1717589c)
cscript!CHost::RunStandardScript+0x96 (00007ff6`17171e1e):
call to ntdll!LdrpDispatchUserCallTarget (00007ffd`f574c510)
cscript!CHost::RunStandardScript+0xc3 (00007ff6`17171e4b):
call to ntdll!LdrpDispatchUserCallTarget (00007ffd`f574c510)
cscript!CHost::RunStandardScript+0xd5 (00007ff6`17171e5d):
call to cscript!CTimer::Stop (00007ff6`17174478)
cscript!CHost::RunStandardScript+0x614f (00007ff6`17177ed7):
call to cscript!CHost::ReportLoadError (00007ff6`1717b930)
cscript!CHost::RunStandardScript+0x6165 (00007ff6`17177eed):
call to cscript!CTimer::Start (00007ff6`1717d3dc)
cscript!CHost::RunStandardScript+0x6183 (00007ff6`17177f0b):
call to ntdll!LdrpDispatchUserCallTarget (00007ffd`f574c510)
0:000>