About script calls external to image and type library _vbs

First, for example, the latest Flash Web horse calls:
var flashver = (new ActiveXObject ("shockwaveflash.shockwaveflash.9")). GetVariable ("$version"). Split (",");

This shockwaveflash.shockwaveflash.9 from where, with Exescope open Flash9f.ocx Select typelib, you can see shockwaveflash.shockwaveflash.9 to image function, which has GetVar Iable. This brings another problem, how to know is to open the Flash9f.ocx? If this is only for this, you can use IE's Component Manager to find out.

So what do we call the other components, like the mstsc.exe,3389 connector? Registry Lookup Mstsc.exe, find the Hkey_classes_root\clsid\{3523c2fb-4031-44e4-9a3b-f1e94986ee7f}\inprocserver32 is C:\WINDOWS\ System32\mstscax.dll, and then open with Exescope to see the functions, properties, methods, etc. of this component. Can be a simple example (MD, only can change the mstsc.exe of all aspects of the attribute value, has not opened the connection interface, who will change?) ）：

Sub executeconnection (strserver, struser, STRPW)
' Create the client '
Dim objmsrdpclient
Set objmsrdpclient = CreateObject ("Mstscax.mstscax.3")
Objmsrdpclient.server = strserver
Objmsrdpclient.username =struser
Objmsrdpclient.fullscreen = False
ObjMsRdpClient.AdvancedSettings2.RedirectDrives = False
ObjMsRdpClient.AdvancedSettings2.RedirectPrinters = False
ObjMsRdpClient.AdvancedSettings2.RedirectPorts = False
ObjMsRdpClient.AdvancedSettings2.RedirectSmartCards = False

ObjMsRdpClient.AdvancedSettings2.ClearTextPassword = STRPW
objmsrdpclient.startconnected = True
WScript.Echo "Before connecting"

WScript.Echo Objmsrdpclient.version
Dim intresult
Intresult = Objmsrdpclient.connect
WScript.Echo "After connecting Result:" & Intresult

End Sub

To invoke the component, you can use not only the Hkey_classes_root\clsid\{3523c2fb-4031-44e4-9a3b-f1e94986ee7f}\progid found in the registry (the example above is CreateObject (" Mstscax.mstscax.3 ")
, also can use HKEY_CLASSES_ROOT\CLSID, this is why we can also use in the ASP Trojan ClassID, like Haiyang top 2006+ source code:

<object runat= "server" id = "ws" Scope = "page" classid = "Clsid:72c24dd5-d70a-438b-8a42-98424b88afb8" ></object >
<object runat= "server" id = "FSO" scope = "page" classid = "clsid:0d43fe01-f093-11cf-8940-00a0c9054228" ></ Object>
<object runat= "server" id = "ws" Scope = "page" classid = "clsid:f935dc22-1cf0-11d0-adb9-00c04fd58a0b" ></object >
<object runat= "server" id = "sa" scope = "page" classid = "clsid:13709620-c279-11ce-a49e-444553540000" ></object >

Of course other Nets horse, the basic call is the CLSID, you can look for some net horse.

But in the VBS does not seem to be able to call ClassID directly, put in the wsf file can, of course, HTML and so does not matter.
Here is simply to say, if you want to see the text of the tutorial, you can look at this: