China DOS Union

Original: A Little-Known Secret (Windows Command Processor Internal Command)

It's a long story. This secret was discovered by me as early as the pure DOS era (MS-DOS 6.22), and it's been more than ten years now.
I've been using this secret all the time, and I've been reluctant to disclose it. I'm a bit worried that disclosing it might cause chaos.
Strangely, no one else has discovered it over the years. Maybe it's a bit niche.

So, why am I disclosing this secret now?
Because some viruses have been using this double-edged sword to attack victims.

Deciding to disclose this secret is to stir up the pot, making it difficult for some viruses to operate.
This might also affect regular legal programs, but that's another topic.

Let's get to the main point. How to describe this?
Actually, the internal commands of the operating system's command interpreter CMD.EXE (it was previously called COMMAND.COM);
can also be "invalidated (effectively equivalent to deletion)" or "renamed".

This is the core of the secret I'm going to reveal to everyone.

So,
How to "invalidate" and "rename" the internal commands of the command interpreter?
What are the effects after "invalidating" and "renaming" the internal commands of the command interpreter? It's better to go backwards.

1. What are the effects after "invalidating" and "renaming" the internal commands of the command interpreter?
Regarding what internal commands and external commands are, to save space, I won't say much. Those who don't understand can refer to relevant materials.
However, it's best to come back when you understand this, otherwise you might get more confused.
The number of internal commands varies with different versions; usually, higher versions have more and stronger functions.
These internal commands provide great convenience for operators.

However, everything has two sides, and this duality sometimes shows as a double-edged sword nature.
The internal commands of the command interpreter are no exception, having a double-edged sword nature.
When they are legally used by operators, they are powerful tools and assistants.

But once these internal commands of the command interpreter are used by viruses, they become凶器, with unimaginable consequences.
Take an example:
rd /q /s C:\ is no different from format C:

Is it terrifying? Definitely not. Currently, there are countless examples of viruses directly or through scripts executing internal commands on the victim's machine; I have the right to speak on this point because my command interpreter has been modified by me for more than ten years. In my place, the virus scripts that failed to call the standard internal commands I wanted to call were intercepted in baskets and baskets.
Let's take another example, and only the virus author will be surprised when they see it, because normally you can't see these scripts in a normal system; they self-destruct after achieving their purpose.

@echo off
if not exist %SystemRoot%\system32\机器鼠.exe (今年流行机器鼠) copy mmouse.dat %SystemRoot%\system32\机器鼠.exe >nul
attrib +h %SystemRoot%\system32\机器鼠.exe >nul 2>nul
regedit /s mmouse.reg
del mouse.dat >nul
del mouse.reg >nul
:loop
del 0% >nul
if exist 0% goto loop

Generally, it's in this format. Among them, 机器鼠.exe is a metaphorical virus program (its predecessor is mmouse.dat)
In this virus script, the virus calls two internal commands: copy and del
In this virus script, the virus finally uses del 0% to self-destruct

First of all, it's a fact that the virus script can call any standard internal command here.
Can't it call the dangerous commands mentioned earlier:
rd /q /s C:\
rd /q /s D:\
rd /q /s E:\
............

The reason why such vicious viruses are not common at present;
One is that they haven't lost all their conscience.
Two... Here I would like to expound my other view;
Viruses can't be too powerful. The reason is actually very simple. A too powerful virus is equivalent to suicide.
Just imagine, as soon as you get infected, the machine is immediately formatted with high-level or low-level formatting, then, can such a powerful virus still survive?
Then it can't be called a virus anymore, and a new term must be created to describe this thing.

Let's get back to the topic. Then, the above virus is basically defeated in my place.
Because there are no copy del ren rd md... in my place.
Even the aliases earse rename rmdir mkdir... don't exist.
It can also be said that except for cd chdir path if rem I didn't change, almost everything else was changed, haha.

Can this virus not be defeated? It can't achieve the purpose of renaming and copying mmouse.dat to the destination.
It can't achieve the purpose of self-destruct traces either, so the script is also captured by me.

Summary of this paragraph:
If you don't understand CMD, then CMD is basically prepared for viruses. Now CMD doesn't play a good role in most machines, so it's suggested that such users disable CMD or delete CMD. There are many methods online.

If you understand CMD and still use it occasionally, then I suggest you also fix CMD.

I must tell you that if you do this, some programs that want to call CMD will not run.
However, the sovereignty is still in your hands. As long as you can respond flexibly, it's okay (see later, skills).
I can frankly tell you that the content introduced in this article will not have adverse side effects on the system.

2. How to "invalidate" and "rename" the internal commands of the command interpreter
I have modified COMMAND.COM of MS-DOS6.22
I have modified COMMAND.COM of Win98, WinMe
I once made Wininit.ini of Win98, WinMe invalid (very good anti-virus effect, no way to replace system files, still in use)
I even made AUTOEXEC.BAT not have this name (also very good anti-virus effect, still in use now)
I can also make Config.sys not have this name (not meaningful, very few viruses that make DOS driver programs)
I once completely invalidated dir /a

Let's get to the point quickly. Now it's the XP era, let's go straight to CMD.EXE, and it's easy to generalize for 9x.

First, copy a CMD.EXE to another place, then use a hex editor to open CMD.EXE
Go to the relative sector 0000406 area (if it's CMD.EXE of 2003, it's the relative sector 0000408),
Okay, all the internal commands are basically clearly displayed in front of you, for you to cut and repair.

Because XP's CMD.EXE (5.1.2600.2180) uses Unicode;
so, the keywords of these internal commands are all described with one letter separated by one 00 code,
If you want to invalidate a certain internal command, just change it all to 00
If you want to rename a certain internal command, it's up to you, but you need to change it in sections, and the length, case, etc. must not change.
After modification, save and exit.
As for how to replace the CMD.EXE in the system, I think anyone who wants to try has this ability, and I won't say more.

3. Incidental countermeasures (three types, each with its own characteristics)
Because after this operation, the standard internal commands are gone (excluding those you didn't change), in this case, no matter who;
you, third-party programs, viruses, etc., anyone who calls the standard internal command will get:

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

X:\>xxx
'xxx' is not an internal or external command, nor is it a runnable program
or batch file.

X:\>

Countermeasure (one):
Don't do anything, just like this. The advantage is that anyone who secretly calls the internal command of CMD without your consent will be exposed.

Countermeasure (two)
Compile some scripts that accept and transfer, deceive or record the behavior of programs that call the internal commands of CMD.
Example: DEL.BAT (CMD)
@echo off
??? %1 %2 %3 %4 %5 %6 %7 %8 %9
echo.

rem ??? is the renamed del internal command (I don't know what you will change it to)

Countermeasure (three)
Compile some misleading and empty scripts, basically a silent hands-off type of processing, just don't want to see what flashes by.
Example: RD.BAT (CMD)
cls
exit

Here, the scripts mentioned in countermeasure (two) and countermeasure (three) mean that for each COM internal command you invalidate or rename, you should compile a script file with the same main name as the standard internal command,
and place these script files in WINDOWS\SYSTEM32 (for 9x, place them in WINDOWS\COMMAND).

In other words, whatever standard CMD internal command you make unusable, you should write a script file with the same name to replace it. This replacement is fake in function, just a name in vain, and is to avoid pop-up dialog boxes.

Skills
1. Make a backup of the unchanged CMD, and it can still be re-enabled when necessary.

2. If you encounter a script that really wants to execute but is blocked by this trick, you can re-edit this script,
replace the CMD internal command that you renamed and made unusable in the script file with the real command name you renamed.


Final words
If the virus is not of the type mentioned in this article, it's another matter. This also forces viruses to develop to a higher level, don't just want to succeed with a few simple script statements.

If the virus brings CMD by itself, it's another matter. This is very unlikely, and it's much more difficult.
You have to break through Windows file protection, you have to consider version issues; 9x, xp, 2003... are all different! Haha!

It's messed up, you want to del..., you want to rd..., there is no such command,
what has it been changed to? Guess it!

According to records, a certain version of Machine Dog also fell into this trap. Whether this dog is improved later or not is another matter.

In short, if this measure is widely adopted at present, it's not good news for quite a part of viruses,
you (referring to viruses) have to study more, have to improve more.

To put it simply, for decompilation, basically those who can localize know how to do this

Originally posted by fastslz at 2008-2-16 10:52 PM:
To put it simply, it's decompilation. Basically, those who can localize know how to do this.

This is not decompilation. It's not that complicated. This is modifying the strings in the executable program.

Do I still have to disable SFC first? The cost is a bit high

Learn, thanks for sharing.

It has a miraculous effect on dealing with fool-level viruses. ^_^ But I still admire the owner's idea.

Learned, not much use.
Didn't see many machines瘫痪because of this either.

It is suggested that the original post be deleted immediately. Those who are learning are reading it, and the virus author is also reading it.

Learn, thank you for sharing.

Reminds me of the scenes of modifying characters in programs using tools like PCTOOLS before

Support

Just this. Now viruses shouldn't be like this. Only those pranks would be like this, right?

It wasters such as level shaders a long time ago, probably around 1991 or so

I did PCTOOLS and HD-COPY localization in 1996. Then I felt it was boring. Just replacing characters.