What are some tricks or methods to reverse-engineer undocumented and half-documented Windows cmd commands such as the findstr, cd, dir, echo, etc to determine their behavior?

  • Just step through them in a debugger :D Mar 5, 2017 at 3:53
  • @VitalyOsipov, Is that the only/best way to do it?
    – Pacerier
    Mar 5, 2017 at 8:43

2 Answers 2

  • There is leaked source code of windows 2000. I don‘t know if it covers those utilities.
  • Also the reactos project (an open source reimplementation of windows) is usually very faithful to the original.

Both source codes are not exactly what you seek, but might give you an idea what to expect when you reverse engineer the real thing.


If by "features" you mean windows' cmd.exe built-in tools and utility commands, there's no way other than reverse engineering cmd.exe like any other software.

Finding it's input processing function would be the first step, then followed by finding the parts handling the specific commands you're interested in.

The only "tip" I can offer is using windows symbols server when available (IDA will automatically ask you if you'd like to use it if symbols are available), though it binds you to an EULA.

  • (Yes I mean all the "commands", "tools", "apps", that comes by default with a Windows installation and Windows update.) Regarding your answer, is this method what the best people in the field do or are there other better methods to approach this problem?
    – Pacerier
    Mar 5, 2017 at 8:44
  • 3
    Generally, if documentation and other available resources are not sufficient, reverse engineering is usually the most complete solution. As a decent professional reverse engineer, I can't think of a better way to address your vague and general question.
    – NirIzr
    Mar 5, 2017 at 8:50
  • and consider than if the feature is truly undocumented, it's behavior is subject to modification at any time. Mar 10, 2017 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.