CSDN专家博客精华版

为人民服务!
  首页  :: 新随笔  :: 管理

COMMAND.COM的破解.(有关DIR /S/A的BUG.)

Posted on 2007-12-17 11:24  csdnexpert  阅读(153)  评论(0编辑  收藏  举报
I know what you are thinking, "what does this have to
do with Windows?".

You may be aware of a "bug" in Command.com's "Dir/s"
(Directory Search for a file/s) which skips Hidden
sub-directories (common in "Windows" (95/98)).  The "bug"
is not setting the proper attribute to include hidden directories.
I have modified "Command.com" for MS Dos 6.0 to 7.1 on 5
computers.

If you have a Hex Editor, enter the Search string (without quotes)
"8B D4 B9 10 00 B4 4E CD 21 72 2C E8 ".
           
Replace the 10 with 16.  Also verify that the 4th byte past E8 is
also a 10 and replace that with 16 too.  NOTE: if the 2nd 10
is Not present (SHOULD BE) at the 4th pos/byte past E8, then abort
the modification.

  VERIFY PROPER FIX: (Note: Original Command.com will have ".BAK")

  Use Dos's file compare (FC) for binary files and type (without
quotes) "FC/B COMMAND.BAK COMMAND.COM".

  Dos V6.2 Command.com:
  00003BD3: 10 16
  00003BDF: 10 16

  Dos V7.1 Command.com:
  0000A2D6: 10 16
  0000A2E2: 10 16

  Use this fixed version of Command.com and replace the other/s
in other directories, then RESTART your PC.  NOTE: If you don't
replace others,  you may get a system halt with a "invalid
command.com" message due to a mismatch (checksum of the first
Command.com installed during startup does not match a reloaded
Command.com).

Disassembled: (Note: I do NOT have a full Command.com disassemble)

8BD4      MOV DX,SP
B91000    MOV CX,0010h ;Bug ( "Plain" Directory, but not hidden
                        (or one with "System"  Attr set))
B44E      MOV AH,4Eh ;Find first (sub-directory)
CD21      INT 21h
722C      JB 3D07h ;JB if NOT found.  NOTE: 3D07h depends where you
                                  disassemble, but 72 2C is constant
E8FBFD    CALL 3AD9h ;(3AD9h Dos 6.2 which is different in Dos 7.1)
B91000    MOV CX,0010h ;Bug part 2
          MOV AH,4Fh ;Find next (sub-directory)
          INT 21h

      John Augustine




Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=3092