0

What are some tricks or methods to reverse-engineer undocumented and half-documented Windows cmd commands such as the findstr, cd, dir, echo, etc to determine their behavior?

  • Just step through them in a debugger :D – Vitaly Osipov Mar 5 '17 at 3:53
  • @VitalyOsipov, Is that the only/best way to do it? – Pacerier Mar 5 '17 at 8:43
2

If by "features" you mean windows' cmd.exe built-in tools and utility commands, there's no way other than reverse engineering cmd.exe like any other software.

Finding it's input processing function would be the first step, then followed by finding the parts handling the specific commands you're interested in.

The only "tip" I can offer is using windows symbols server when available (IDA will automatically ask you if you'd like to use it if symbols are available), though it binds you to an EULA.

  • (Yes I mean all the "commands", "tools", "apps", that comes by default with a Windows installation and Windows update.) Regarding your answer, is this method what the best people in the field do or are there other better methods to approach this problem? – Pacerier Mar 5 '17 at 8:44
  • 3
    Generally, if documentation and other available resources are not sufficient, reverse engineering is usually the most complete solution. As a decent professional reverse engineer, I can't think of a better way to address your vague and general question. – NirIzr Mar 5 '17 at 8:50
  • and consider than if the feature is truly undocumented, it's behavior is subject to modification at any time. – peter ferrie Mar 10 '17 at 17:50
2
  • There is leaked source code of windows 2000. I don‘t know if it covers those utilities.
  • Also the reactos project (an open source reimplementation of windows) is usually very faithful to the original.

Both source codes are not exactly what you seek, but might give you an idea what to expect when you reverse engineer the real thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.