Scripting Windows XP System Restore

Exploiting System Restore
The script begins by defining command-line parameters, then prepares to exploit System Restore. The code in Listing 1 shows the latter process.

First, the code at callout A in Listing 1 includes several external helper functions. DecodeSystemRestoreFunction.vbs contains two functions—DecodeRestorePointType() and DecodeEventType()—to decipher the RestorePointType and EventType properties, respectively. DisplayFormattedPropertyFunction.vbs contains the DisplayFormattedProperty() function, which the script uses to display class properties and their values. TinyErrorHandler.vbs contains the ErrorHandler() function, which the script uses to handle execution errors.

Next, the code at callout B in Listing 1 creates two objects: the SWbemLocator object, which the script uses to perform the WMI connection, and the SWbemDateTime object, which the DisplayFormattedProperty() function uses to manipulate WMI date and time properties. The code at callout C defines two constants: cComputerName, which defines the name of the computer to which to connect, and cWMINameSpace, which defines the WMI CIM repository namespace (i.e., root\default) to which to connect. The code goes on to perform command-line parsing by using the Windows Script Host (WSH) 5.6 XML command-line parsing feature. (See "Secure Script Execution with WSH 5.6," August 2002, InstantDoc ID 25644, for information about this feature.) The code at callout D then establishes the WMI connection. . . .