SET  ::WM_KEYDOWN                      =0x0100
SET  ::WM_KEYUP                        =0x0101
SET  ::WM_CHAR                         =0x0102

//函数: RUNASUSER
//作用：用指定用户名和密码运行指定程序
//参数：16进制密码串   用户名   指定程序 参数表
//示例：RUNASUSER "0x31 0x32 0x33" administrator  cmd.exe /c copy c:\boot.ini c:\boot.in_
_SUB RUNASUSER
MSTR  &PSW=<~1>%*
MSTR  &CMD=<3->%*
ENVI PID=
exec --pid:PID ! runas /user:%2  %&CMD% 
TEAM WAIT 250| FIND --forpid:PID  --wid*  &WID,%SystemRoot%\System32\runas.exe
FIND $""="%&WID%", TEAM WAIT 250| FIND --forpid:PID  --wid*  &WID,%SystemRoot%\System32\runas.exe
FIND $""="%&WID%", TEAM WAIT 250| FIND --forpid:PID  --wid*  &WID,%SystemRoot%\System32\runas.exe
FIND $""="%&WID%", TEAM WAIT 250| FIND --forpid:PID  --wid*  &WID,%SystemRoot%\System32\runas.exe
WAIT 100
ENVI @@POS=%&WID%:::::::1:1 
ENVI &I=1
ENVI &CH=*
LOOP $"" = "%&CH%",! 
{
MSTR  &CH=<%&I%>%&PSW%
TEAM ENVI @@SENDMSG=%&WID%;%&WM_CHAR%;%&CH%| WAIT 50  //输入密码
CALC &I= %&I% + 1
} 
TEAM ENVI @@SENDMSG=%&WID%;%&WM_CHAR%;0x0D| WAIT 50  //回车，密码结束
//MESS  [%PID%] %&WID%
_END
 

RUNASUSER "0x31 0x32 0x33" administrator  cmd.exe 
