China DOS Union

-- Unite DOS · Advance DOS · Grow DOS --

Union site: www.cn-dos.net Forum site: www.cn-dos.net/forum
DOS stands for freedom, openness and progress. Let us work hard, learn from the openness and GNU spirit of FreeDOS and Linux, and together build and grow a free GNU GPL world!

中国DOS联盟论坛
The time now is 2026-06-25 11:09
中国DOS联盟论坛 » 贴图灌水、文学娱乐专区 » How many people know about the internal commands of Microsoft employees? View 16,464 Replies 70
Floor 16 Posted 2004-03-14 00:00 ·  中国 山东 烟台 福山区 联通
元老会员
★★★★
Batchinger
Credits 4,432
Posts 1,512
Joined 2002-10-18 00:00
23-year member
UID 19
Gender Male
Status Offline
Re All:

Judging only from the content of this post, it really is quite original. Because many people know it can be used this way, but don't think of using it this way. It's just that the OP's last paragraph really lacked consideration, so it was only natural to provoke public anger.

As for the OP's final question, I think brother "Ultimate Warrior"'s line of thought is correct, it's just that the implementation method wasn't well considered. For editing exe files or other binary files, you absolutely must not use text editors like edit, and must use a dedicated hex editor instead.

And following the OP's line of thought, it seems this problem also needs to use commands that come with DOS, so that leaves only debug. Below is my solution. For the sake of simplicity, some detailed issues are omitted.

Note:
All numbers appearing below are hexadecimal, and calculations should also use that basis;
The contents in square brackets should be hexadecimal values; here they are named according to what they represent, and in actual operation they need to be replaced with the corresponding values according to context;
The contents in parentheses are comments and should not be entered during actual operation;


c:\windows>ren 3.exe 3.eee (change the program's extension to avoid debug's special handling of executable programs)
c:\windows>debug 3.eee
-s 100 ffff "MZ" (search for the MZ signature word in the range 100 to ffff)
: (shows matching address)
:
.... (there may be some more)
-d (display each address in turn, determine the start address of the second program from the displayed contents)
-d (assume the start of the second file Begin2 is found at xxxx1)
-n 1.eee (create file 1.eee)
-r cx (edit file length)
CX (shows the length of the original file 3.eee)
: (enter Begin2 minus 100 here, that is, the length of file 1.eee)
-w (write file 1.eee)
Writing bytes (shows number of bytes written)
-m ffff 100 (move the contents of the second file to the start at 100)
-h (use the difference to calculate the length of the second file)
(the former is the sum, the latter is the difference; the difference is the length of the third file minus the first file)
-n 2.eee (create file 2.eee)
-r cx (edit the length of file 2.eee)
CX (shows the length of the original file 1.eee)
: (enter the length of file 2.eee here)
-w (write file 2.eee)
Writing bytes (shows number of bytes written)
-q (quit DEBUG)
c:\windows>ren 1.eee 1.exe (change the program extension back)
c:\windows>ren 2.eee 2.exe







Recent Ratings for This Post ( 3 in total) Click for details
RaterScoreTime
ngd +1 2008-01-12 13:53
regvip2008 +2 2008-04-26 09:57
sl543001 +8 2010-08-15 23:31
※ Batchinger 致 Bat Fans:请访问 批处理编程的异类 ,欢迎交流与共享批处理编程心得!
Floor 17 Posted 2004-03-18 00:00 ·  中国 新疆 乌鲁木齐 电信
初级用户
Credits 105
Posts 3
Joined 2004-03-18 00:00
22-year member
UID 20464
Gender Male
Status Offline
Bump
Floor 18 Posted 2004-04-14 00:00 ·  中国 广东 广州 越秀区 电信
初级用户
Credits 156
Posts 17
Joined 2004-03-08 00:00
22-year member
UID 19588
Gender Male
Status Offline
Expert above,

DEBUG may be something very easy for you people, but for those of us without an assembly background it's simply harder than climbing to heaven,

I once tried random experiments with DEBUG and made the hard disk unbootable and inaccessible. I exhausted every data recovery program under the sun and still couldn't recover it (except professional recovery). So I'm a bit afraid of random experimenting with DEBUG
Viruslib is a registered mark of Z..soft
Floor 19 Posted 2004-04-14 00:00 ·  中国 山东 济南 莱芜区 联通
高级用户
★★
Credits 736
Posts 210
Joined 2004-04-12 00:00
22-year member
UID 22336
Gender Male
From 中國
Status Offline
If you say it, don't just make things up
Floor 20 Posted 2004-04-14 00:00 ·  中国 山西 运城 联通
元老会员
★★★★
Batchinger
Credits 4,432
Posts 1,512
Joined 2002-10-18 00:00
23-year member
UID 19
Gender Male
Status Offline
※ Batchinger 致 Bat Fans:请访问 批处理编程的异类 ,欢迎交流与共享批处理编程心得!
Floor 21 Posted 2004-04-18 00:00 ·  中国 山东 东营 联通
初级用户
Credits 110
Posts 5
Joined 2004-04-18 00:00
22-year member
UID 22788
Gender Male
Status Offline
That is indeed how the Benbengou software works. It first splits 3.exe into 1.exe and 2.exe; afterward it creates a batch file, and the contents of the batch file are just copy/b 1.exe+2.exe 3.exe. As for debug, I don't really understand it either.
Floor 22 Posted 2006-06-21 09:57 ·  中国 江苏 无锡 电信
新手上路
Credits 14
Posts 7
Joined 2006-06-19 13:49
20-year member
UID 57246
Status Offline
So much time has passed and the OP still hasn't said anything. Looks like the OP doesn't know either!
Floor 23 Posted 2006-06-21 14:05 ·  IANA 局域网IP(Private-Use)
铂金会员
★★★★
Credits 7,493
Posts 2,672
Joined 2005-09-02 00:00
20-year member
UID 42173
Gender Male
Status Offline
Try disassembling copy

C:\>BLOG http://initiative.yo2.cn/
C:\>hh.exe ntcmds.chm::/ntcmds.htm
C:\>cmd /cstart /MIN "" iexplore "about:<bgsound src='res://%ProgramFiles%\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll/10/5432'>"
Floor 24 Posted 2006-06-21 15:15 ·  中国 上海 黄浦区 电信
金牌会员
★★★★
Credits 4,639
Posts 2,239
Joined 2005-01-30 00:00
21-year member
UID 35785
Gender Male
Status Offline
Floor 25 Posted 2006-06-30 12:23 ·  中国 上海 青浦区 电信
中级用户
★★
Credits 326
Posts 70
Joined 2003-01-10 00:00
23-year member
UID 718
Gender Male
Status Offline
Child's play. If younger people aren't very proficient with DEBUG, that's okay. I'll post E32 for DOS for everyone; it can modify TXT and BIN files. You just need to search for MZ (because EXE files usually start with those two characters), then copy, cut, and save, and enjoy yourself. How can operating under DEBUG count as an internal employee command? Besides, if the program contains more than two MZs, would you still be so smug? Also, let me tell everyone that E32 is very easy to use. I use it to edit and modify hard disk firmware, and it's very practical, with quite good compatibility!

[ Last edited by cnch on 2006-6-30 at 12:34 ]
Attachments
E32.rar (64.07 KiB, Credits to download 1 pts, Downloads: 118)
Floor 26 Posted 2006-06-30 12:28 ·  中国 江苏 苏州 电信
新手上路
Credits 2
Posts 1
Joined 2006-06-23 19:33
20-year member
UID 57471
Status Offline
Child's play, garbage
Floor 27 Posted 2006-07-01 16:59 ·  中国 四川 自贡 电信
初级用户
Credits 20
Posts 9
Joined 2006-06-12 03:06
20-year member
UID 56897
Gender Male
Status Offline
This is really simple

Aren't 1.exe and 2.exe still both right there

Just delete 3.exe and keep those two

OP, stop hiding it already. If there's really an answer then say it. After you say it, everyone can give you a good beating
Floor 28 Posted 2006-07-01 17:05 ·  中国 四川 自贡 电信
初级用户
Credits 20
Posts 9
Joined 2006-06-12 03:06
20-year member
UID 56897
Gender Male
Status Offline
By the way, one more thing:
if you want to do this relying only on standard DOS internal commands, then it is absolutely impossible to implement it perfectly
^^^^^^^^^^^^
You definitely need help from third-party software (even if it's made by MS, it's still third-party)

And even with third-party software, manual intervention is still needed

Because a binary file may contain more than one MZ marker. Intelligent splitting is just a dream that can never be perfectly realized

Of course, if on the basis of the MZ marker you also add checks for the load point and relocation markers, then the success rate should be higher

But by the way, let me ask the OP, what's the use of doing it this way? It's okay for killing boring time
Floor 29 Posted 2006-07-01 17:08 ·  中国 四川 自贡 电信
初级用户
Credits 20
Posts 9
Joined 2006-06-12 03:06
20-year member
UID 56897
Gender Male
Status Offline
By the way, one more thing: we need to express praise and respect to our moderator comrade

For still taking such a serious, negative, and sincere attitude in trying to solve a thread this boring, almost garbage

That really is how a responsible good moderator acts

Thumbs up!
Floor 30 Posted 2006-07-01 20:42 ·  中国 四川 成都 联通
铂金会员
★★★★
Credits 7,493
Posts 2,672
Joined 2005-09-02 00:00
20-year member
UID 42173
Gender Male
Status Offline
Two clues for everyone:

http://www.cn-dos.net/forum/viewthread.php?tid=9682&fpage=1&highlight=&page=1

http://www.cn-dos.net/forum/viewthread.php?tid=9732&fpage=1&highlight=

Both of these threads were posted by the OP, and after the forum conversion the OP never came online again. The email contact left behind has also become invalid. Maybe this thred will become one of the Union's great unresolved mysteries

I did a preliminary search with baidu. The OP was on forums related to wuyou, 20cn, Kanxue, microcontrollers, PXE boot, and the technical level was actually pretty good, so he probably wasn't just making things up

[ Last edited by electronixtar on 2006-7-1 at 20:52 ]

C:\>BLOG http://initiative.yo2.cn/
C:\>hh.exe ntcmds.chm::/ntcmds.htm
C:\>cmd /cstart /MIN "" iexplore "about:<bgsound src='res://%ProgramFiles%\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll/10/5432'>"
Forum Jump: