如何通过PowerShell线程作业修改第三方应用窗口标题并规避日志泄露

核心思路 #

你之前用SetWindowText()修改标题仅临时生效，原因是第三方应用会主动重置标题。PowerShell的Start-ThreadJob能实现永久修改，本质是持续检测并重置标题。现在可以通过VB启动第三方应用，再让PowerShell通过窗口句柄持续维护自定义标题，同时避免敏感参数被日志记录。

具体实现方案 #

1. VB中启动应用并获取窗口句柄 #

在VB里直接启动第三方应用（敏感参数直接传递，不经过PowerShell），然后通过Windows API枚举窗口匹配进程ID，获取目标窗口句柄：

Imports System.Diagnostics
Imports System.Runtime.InteropServices

Public Class AppLauncher
    <DllImport("user32.dll", SetLastError:=True, CharSet:=CharSet.Auto)>
    Private Shared Function GetWindowThreadProcessId(ByVal hWnd As IntPtr, ByRef lpdwProcessId As Integer) As Integer
    End Function

    <DllImport("user32.dll", CharSet:=CharSet.Auto, SetLastError:=True)>
    Private Shared Function EnumWindows(ByVal lpEnumFunc As EnumWindowsProc, ByVal lParam As IntPtr) As Boolean
    End Function

    Private Delegate Function EnumWindowsProc(ByVal hWnd As IntPtr, ByVal lParam As IntPtr) As Boolean

    Private Function FindWindowByProcessId(processId As Integer) As IntPtr
        Dim targetWnd As IntPtr = IntPtr.Zero
        EnumWindows(Function(hWnd, lParam)
                        Dim pid As Integer = 0
                        GetWindowThreadProcessId(hWnd, pid)
                        If pid = processId Then
                            targetWnd = hWnd
                            Return False
                        End If
                        Return True
                    End Function, IntPtr.Zero)
        Return targetWnd
    End Function

    Public Sub StartThirdPartyApp()
        ' 直接在VB中传递敏感参数启动应用，绕过PowerShell日志
        Dim psi As New ProcessStartInfo("c:\Program Files\Application\Application.exe")
        psi.Arguments = "-id=userid -pass=password"
        Dim proc As Process = Process.Start(psi)
        proc.WaitForInputIdle(3000) ' 等待程序初始化窗口

        ' 获取目标窗口句柄
        Dim targetHwnd As IntPtr = FindWindowByProcessId(proc.Id)
        If targetHwnd = IntPtr.Zero Then Return

        ' 调用PowerShell脚本维护标题
        Dim psScript As String = $@"
Add-Type @'
using System;
using System.Runtime.InteropServices;
public class Win32Api {{
    [DllImport(""user32.dll"", CharSet = CharSet.Auto)]
    public static extern bool SetWindowText(IntPtr hWnd, string lpString);
    
    [DllImport(""user32.dll"", CharSet = CharSet.Auto)]
    public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder lpString, int nMaxCount);
}}
'@

$hwnd = [IntPtr]::{targetHwnd.ToInt64()}
$customTitle = ""My Title""

Start-ThreadJob {{
    param($windowHandle, $title)
    $sb = New-Object System.Text.StringBuilder(256)
    while ($true) {{
        [Win32Api]::GetWindowText($windowHandle, $sb, 256)
        if ($sb.ToString() -ne $title) {{
            [Win32Api]::SetWindowText($windowHandle, $title)
        }}
        Start-Sleep -Milliseconds 500
    }}
}} -ArgumentList $hwnd, $customTitle
"
        ' 启动PowerShell执行脚本，隐藏窗口避免干扰
        Dim psStartInfo As New ProcessStartInfo("powershell.exe")
        psStartInfo.Arguments = $"-NoProfile -Command ""{psScript}"""
        psStartInfo.WindowStyle = ProcessWindowStyle.Hidden
        Process.Start(psStartInfo)
    End Sub
End Class

2. PowerShell端持续维护标题 #

PowerShell脚本通过Start-ThreadJob创建后台线程，每隔500毫秒检测一次窗口标题，一旦发现被第三方应用修改，立即重置为自定义标题：

• 提前导入user32.dll的API用于读取和设置窗口标题
• 线程循环运行，保证标题持续保持为自定义内容

3. 避免敏感参数被日志记录 #

• 敏感参数（-id、-pass）直接在VB的ProcessStartInfo中传递给第三方应用，完全不经过PowerShell，因此不会被PowerShell日志记录
• PowerShell仅接收窗口句柄和自定义标题，不涉及任何敏感数据

关键注意事项 #

• 调用WaitForInputIdle()等待程序初始化窗口，确保能获取到有效的窗口句柄
• 检测间隔设置为500毫秒，平衡标题恢复及时性和系统资源占用
• 如果第三方应用有多个窗口，可扩展FindWindowByProcessId方法，通过匹配窗口类名进一步精准定位目标窗口

内容的提问来源于stack exchange，提问作者Eric van Loon