The following is reposted from the help room on this site:
http://www.cn-dos.net/forum/viewthread.php?tid=12892#pid95281
Several Technical Discussions on HDKP
============================================================================
Author: Will Sort
Date: 2005-04-22
Version: 1-20050505
Keywords: HDKP, %comspec%, command interpreter, drive check, disk check, command-line loop
Abstract: Related discussion of HDKP disk checking and disk traversal in terms of algorithm and details
----------------------------------------------------------------------------
Background
Full name: Hard Drive Killer Pro
Version: the commonly circulated version is 4.0 (including the bat version and the exe version compressed from bat), latest version 5.0beta
Author: Munga Bunga (Australia)
Date: version 4.0 was completed no later than May 2001
Platform: according to the original author, this program can work under DOS/Win3.x/9x/NT/2000 and other systems, suitable for
90% of the computers in the world; XP and 2003 did not yet exist at that time
Purpose: to destroy, or say “clean,” all data on all hard disks, floppy disks, and flash disks in a computer. Of course, due to its
long history, most currently popular antivirus software can remove it.
----------------------------------------------------------------------------
Preface
I first saw this reposted batch program in A Simple Batch Tutorial. The author of the tutorial listed it as the finale among the excellent program examples. At the time, because I had considerable hostility toward any programs with words like Killer/Hacking in them, I only glanced at it briefly and did not read it carefully. Later I again saw this program reposted in a thread by brother “Shenxian Beibei” on the “Union DOS Forum”, but for similar reasons, I only skimmed through to see whether there were any replies worth noting, then casually closed it, to the point that I later did not even see brother Climbing's invitation.
In mid-April I began reading old batch-related threads on the “Union DOS Forum,” and several times I saw the suggestion “study it carefully” in the sticky digest index by brother Climbing. At last I opened brother “Shenxian Beibei”'s old thread again. By then, brother wangsea had already done a fine job of annotating it, so my task was simply to enjoy the fruits of others' labor.
But unfortunately, too many problems and flaws appeared in this program. Some problems, such as the invalid format switch /autoSample and :Sampledrv, were obviously not slips by the original author, but seemed specially modified by some interested person or interested program; some other problems, such as dedecated and elapse, I do not know whether they were Australian dialect or accidental mistakes by the author; as for the remaining problems, the main person responsible can definitely be said to be the author himself.
Of course, for the sake of fairness and universality in discussion, I found the original link for this program and tried to download it, but the download failed. I tried several other methods as well, but the versions I found were no different from the one by “Shenxian Beibei.” In the end, I decided to continue using the latter as the basis for discussion, so what I am discussing is only the merits and faults of the code, not the merits and faults of the author.
----------------------------------------------------------------------------
Main text
There is no denying that the program does indeed use some advanced techniques, and the most important manifestation of these techniques is the disk checking program (drivechk.bat). But it should be noted that drivechk.bat was not the author's own original creation. Its original author was Tom Lavedas, which is exactly why the author wrote “Except for.” However, it is possible that the author did not thoroughly understand this program and only made some simple modifications, or that the author cited an earlier program by Lavedas, so this section of code has some problems.
Below is a part of the program that dynamically generates drivechk.bat
echo @echo off >drivechk.bat
echo @prompt %%%%comspec%%%% /f /c vol %%%%1: $b find "Vol" > nul >{t}.bat
%comspec% /e:2048 /c {t}.bat >>drivechk.bat
del {t}.bat
echo if errorlevel 1 goto enddc >>drivechk.bat
The purpose of this section is to write the following code into drivechk.bat. Brother wangsea has already analyzed the process, so I will not repeat the details.
%comspec% /f /c vol %1: | find "Vol" > nul
if errorlevel 1 goto enddc
First, the line “echo @echo off >drivechk.bat” is not necessary. Because drivechk.bat is a dynamically generated called program, when it is called by call, it inherits the echo off state of the calling program.
Only when it is called with %comspec% /c might “echo off” be needed, because %comspec% /c creates a new layer of command-interpreter environment, and in this new environment the echo state is reset. That is also why the program can obtain the modified command prompt through %comspec% /e:2048 /c {t}.bat: it is exactly the statement to be written into drivechk.bat.
Second, “%%%%comspec%%%%” in the second line can be completely changed to “%comspec%”. The function of “%%%%” is to delay the substitution of %comspec%, so that %comspec% is not replaced by the path of the command interpreter until drivechk.bat is executed; but that is unnecessary, because the called drivechk.bat and the main calling program must run in the same environment, so it makes no difference whether the substitution happens earlier or later.
Moreover, I suggest directly changing %comspec% to command. Because in NT-type command-line environments, %comspec% usually points to cmd.exe, which differs from command.com in many ways—for example, the code page differs in non-English systems, causing find "Vol" /c to fail. And in early MS-DOS environments, %comspec% may also point to non-standard command interpreters such as NDOS, whose switch parameters and execution output may both cause the %comspec% line to fail. The biggest problem with using command directly is that it might not be in the current path or %Path%, but that is almost impossible.
Third, “find "Vol" > nul” should be “find "Vol" $g nul”, otherwise “> nul” cannot be written into drivechk.bat, and that may cause the find message to “leak” when drivechk is called. When the program calls it, the author tried to avoid this hidden problem through “call drivechk.bat %%a >nul”, but he may not have known that this “>nul” is ineffective for call batch processing.
Only by calling a batch file through %comspec% /c can its output be redirected or piped. But even so, some output from executing vol %1: may still be impossible to suppress—for example, error messages produced when accessing a nonexistent or unready drive, because they use error-device output rather than the standard console, so they are not passed through the pipe. The solution is to add a pair of ctty nul and ctty con statements before and after %comspec% /c. However, ctty is supported only in MS-DOS and the 9x command line; in NT-type command lines such as XP, ctty was removed. In such environments, error messages can only be redirected through 2> nul.
Fourth, “if errorlevel 1 goto enddc” ignores many problems. In MS-DOS or the 9x command line, using vol to access an existing but unready drive will still produce Vol information output, but the program will not jump to the end at that time; in addition, when a read-only CD or flash disk is accessed, there will also be Vol information output.
So in order to remedy these two defects, the program later uses dir | find "bytes" to test the readiness situation, and then uses dir | find "0 bytes" to check for read-only CDs. But locked flash disks still cannot be judged correctly. Perhaps by the time the program was completed, the locking function on flash disks was still uncommon.
The statement for detecting whether a disk is readable can also be replaced with dir %1:\nul|find "\" , and checking whether a disk is writable can use copy /y _writed_.tag %1: and if exist %1:_writed_.tag for judgment. Of course, these statements still all need to run inside the shell of %comspec% /f/c. But there are still some problems we might not think of—for example, on a shared drive in Virtual PC, I can only create and modify files, but cannot delete them. As for other things such as network drives and memory virtual drives, I have not discussed them in more detail. On such details, professional programs may perhaps do better.
Fifth, there is another relatively simple technique in the program, namely disk traversal in :Sampledrv. Using the For statement for loop-style traversal may be the usual practice in batch programming, yet in some situations that practice may not be optimal.
In fact, very early on, people used more flexible command-line loops to deal with many problems that For could hardly solve. For example, when there are multiple statements after do, we have to put these statements into a batch file and call them; but the characteristics of for determine that it makes repeated multiple calls during execution, while the advantage of a command-line loop is that it needs only one call, and what remains is just shift and goto inside the program. This saves quite a lot of performance, because call consumes far more performance resources than shift and goto.
Sixth, let us discuss the necessity of dynamically generating drivechk.bat. This is not about the necessity of drivechk.bat itself, but about the necessity of generating it dynamically. We may guess that the reason the program goes to such trouble to generate this code dynamically, rather than statically embedding it in the main program, is mainly that it can use it for loop traversal during disk checking. However, the author may not have noticed or realized that static code can accomplish the same task. This means that all the detours the entire program takes in writing drivechk.bat are unnecessary, and we can completely find a more direct and shorter route.
By embedding code that the program needs to use repeatedly as a module within itself, and then repeatedly calling that module, one can achieve an effect similar to calling dynamic code. In plain terms, a module means a whole section of code beginning with a label and ending with goto end, and to call this module you only need to use call %0 : lablename together with if "%1"==":" goto %2.
Structure of the calling program
CODE:
...
:: Call-type call to itself
call %0 : labelname
...
:: Goto-type call to itself
%0 : lablename
...
:: Call-type call to another Bat
call bat_name : labelname
...
:: Goto-type call to another Bat
bat_name : lablename
...
Structure of the called program (which may also be the calling program)
CODE:
@echo off
if "%1"==":" goto %2
...
:labelname
:: module code section
...
goto end
...
:end
----------------------------------------------------------------------------
Conclusion
My purpose in writing this article, as mentioned in the abstract, is to try to discuss some technical characteristics and details concerning disk checking and command-line loops, not to provide technical support for HDKP or similar malicious programs. As for the purpose for which HDKP was written, I personally still maintain an opposing attitude. This program is probably, just as the author hoped, useful only to “a very special person that does not want to be named.” To me, it is merely an imperfect combination of technique and conception.
I know that professional third-party programs for disk checking have long already existed, such as dready.com. But as a technical branch of batch programming, discussing it is still beneficial: it can help us understand system working principles more deeply and become more familiar with the environment in which we work. Also, as far as batch files are concerned, not relying on third-party programs still has considerable advantages and value.
----------------------------------------------------------------------------
References:
01. I hope some friend can write a complete annotation for this batch file
http://www.cn-dos.net/dosbbs/dispbbs.asp?boardid=9&id=12892
02. China DOS Union Forum Help Room Digest Index
http://bbs.cn-dos.net/dispbbs.asp?boardid=9&id=13226
03. Hard Drive Killer Pro (HDKP) - The Hackology Network
http://www.hackology.com/programs/hdkp/ginfo.shtml
04. Safely Testing the Status of All Types of Drives - Tom Lavedas
http://www.pressroom.com/~tglbatch/testdrv.html
05. Avoiding Drive Not Ready - alt.msdos.batch
http://groups-beta.google.com/group/alt.msdos.batch/browse_thread/thread/
df0213182e13de5b/fa2abe726f972567?q=%22:_end%22+label+name&rnum=2&hl=en
=============================================================================