Extreme programming - Coding binary through ECHO

[MagicMovingImages]

Hi All

I've written an article on creating executable binary files directly through the MSDOS ECHO command. I have provided examples and steps for all actions and have managed to solve the dreaded problem of outputting NULLs too!

The link is here for all interested.
http://colinord.blogspot.co.uk/2015/02/ ... coded.html

Thanks,
Colin Ord.

www.colinord.com
Magic Moving Images

[foxidrive]

From the page:

As you delve further into learning this technique one glaring problem will eventually arise, how to input NULL characters using ECHO. No matter how hard I tried I couldn't get ECHO to produce the Null code using values from 0-255. After much research I eventually found two other key combinations that create NULLs. A CTRL-@ and LALT- 256 both create NULLS!

I didn't study it all - which OS and version are you using to do this, and how do you echo the null character, say into a file?

There are methods in threads here that create all 256 bytes using tools native to Windows which you might find interesting.

ASCII Binaries are also used by people like Laura Fairhead and Herbert Kleebauer which you can find in Usenet archives in alt.msdos.batch/alt.msdos.batch.nt and which may be if interest if you haven't seen them.

[MagicMovingImages]

Hi

The version I'm using is DOS 6.22 but the keycodes work in various environments like Windows Notepad, DOSBOX etc.

To create a binary file with a NULL you can use the alternative approach noted in the article by using the little known Ctrl -@ or the ALT-256 combination.

;Creates a single binary file with a NULL.
c:\> copy CON test.com
CTRL @ ;creates a Null by using the keys Control -@
CTRL Z to end and write file.

You can either icopy this single byte NULL into your binary file at each point you require it or you could type the whole binary executable file using the ECHO and ALT keypad techniques I wrote about in my article if no NULL is required.

Regards,
Colin

[Squashman]

Your article says tested on Windows Vista and 7. Did you test on 64bit?

[carlos]

You are using 16 bit that is not emulated on windows x64.

About create binary files using 16 bits please check my program wrichr.com (includes source) here:

Code: Select all

http://consolesoft.com/batch/binary/

it is encoded using the latest version of a utility of Herbert Kleebauer. Look the content of wrichr.com and you will found only printable characters.
So, you can create wrichr.com using the echo command. And then create every ascii file.

create_wrichr.bat

Code: Select all

(
echo hD1X-s0P_kUHP0UxGWX4ax1y1ieimnfeinklddmemkjanmndnadmndnpbbn
echo hhpbbnpljhoxolnhaigidpllnbkdnhlkfhlflefblffahfUebdfahhfkokh
echo v17/@yEh9/@/20My/E652hs4/eDAwl/UubnT6/cukMTt//hz8jys79Ah5/c
echo yzLb/o9EnVAQn.
) > wrichr.com

And for create for example the nul character:
wrichr.com 0 > 0.chr
And for create the ascii 1:
wrichr.com 1 > 1.chr

For 32 bits and 64 bits the equivalence of wrichr.com is genchr.cmd

Code: Select all

http://ss64.com/nt/syntax-genchr.html

it uses makecab.

But for create binary files using batch faster you can use my bhx program:

Code: Select all

http://consolesoft.com/p/bhx/

[Aacini]

Some time ago I used a method that entirely avoids this problem: just generate the .com file without control characters! How to do that? Well, using some simple tricks in the assembly source code, for example:

Code: Select all

SUB AX,AX       ;load two bytes of zeros in AX

MOV AL,113      ;load 113 in AL
SUB AL,100      ;AL = 13 (CR)
MOV AH,110      ;load 110 in AH
SUB AH,100      ;AH = 10 (LF)

This way the running code use any desired value, but the .com file have not a single control character, so its contents may be directly placed in an ECHO command. I wrote several .COM auxiliary programs using this technique, like ColorMsg.com:

I just realized that the definition of ColorMsg.com auxiliary program may be included in the Batch file. At beginning of the Batch file include this line:

Code: Select all

if not exist ColorMsg.com call :DefineColorMsg

And at the end:

Code: Select all

:DefineColorMsg
setlocal DisableDelayedExpansion
set ColorMsg=³2ÿŠOÿ2íã9‹û° üó®tQã~ŠEÿ³$þÇS³­ÿãën€= tsÐàÐàÐàÐàŠàGŠEÿ³^<Sëq³A€/!+ÄIãN2äP¸""ò®uDãB‹÷‹Ñò®u^@J:%%u;GIuó+Ñt-‹Ê³^|€/!³†€/![° ´*€ì!Í1²"¬´/€ì!Í1:Âu—Šâ:$u‘Fâë2À´LÍ!ëÇë¦,0Ã<Arù²ùöÚ*Âëñ<arð, ëì
setlocal EnableDelayedExpansion
echo !ColorMsg!> ColorMsg.com
exit /B

This way, the Batch file may be distributed with no additional instructions on create the auxiliary programs. Interesting, isn't it?

A VERY INTERESTING IDEA that crossed my mind is that ColorMsg variable above contains executable code in .COM file image format; that means, it represent a MACHINE LANGUAGE MACRO I am looking for a method to execute it!!!!!!!!!!

However, trying to using this trick to generate an .exe file is not possible because that format requires many control characters. Anyway, creating an .exe file via ECHO commands have other disadvantages, the first one is its size: just the header of the .exe file is much larger than the size of the majority of my .com programs! So we must use a different method in this case.

We started with VBS and JScript code as aid to generate bytes with any value, until a team of several regulars here developed the excellent technique we use nowadays, that uses standard Batch commands only.

Humm, err... Isn't this topic a somewhat old one?


Antonio

[foxidrive]

The version I'm using is DOS 6.22 but the keycodes work in various environments like Windows Notepad, DOSBOX etc.

To create a binary file with a NULL you can use the alternative approach noted in the article by using the little known Ctrl -@ or the ALT-256 combination.

Thanks for your reply Colin.

I tried the control @ and ALT-256 in notepad and edit and my text editor before I asked my question and I couldn't get the result you have, in Windows 8.1 here

[Liviu]

I tried the control @ and ALT-256 in notepad and edit and my text editor before I asked my question and I couldn't get the result you have, in Windows 8.1 here

Ctrl-@ (or simply Ctrl-2 on a us-en keyboard) works here in "copy con testfile" from at least xp upwards, including x64 win7 and 2012 r2 (a.k.a. 8.1 server).

Alt-256 is an alternative that I was not aware of. I can see it's still working in xp (as do Alt-512 and larger multiples of 256). That might have been legacy or perhaps accidental behavior, and seems to no longer work in/since win7.

Liviu

[foxidrive]

Ctrl-@ (or simply Ctrl-2 on a us-en keyboard) works here in "copy con testfile" from at least xp upwards, including x64 win7 and 2012 r2 (a.k.a. 8.1 server).
Liviu

It's good in Win 8.1 32 bit also.

[penpen]

Win XP home 32bit (german) SP3.

Results "notepad.exe":
- "CTRL+@": It seems nothing happens.
- "CTRL+2": It seems nothing happens.
- "ALT+256": You hear a "%SystemRoot%\Media\Windows XP-Ping.wav".

Results "edit.com":
- "CTRL+@": It seems nothing happens.
- "CTRL+2": OK.
- "ALT+256": It seems nothing happens.

Results "cmd.exe" (copy con test.bin):
- "CTRL+@": It seems nothing happens.
- "CTRL+2": OK.
- "ALT+256": OK.

Sidenotes:
1) I'm using a german keyboard, with the glyphs 2 (2), doublequotes (SHIFT+2) and ² (ALT GR+2) assigned to the key 2.
2) Under XP you could also use "findstr" instead of "copy", too:

Code: Select all

>"test.bin" findstr "^"

I've once started to write an assembler using batch (actually i don't know if i will ever finish it). Therefore i've created with (an older version of the) "genchr.cmd" all the characters, and i copied them using hex, dec and oct notation as filename ("0x00" ... "0XFF", "0000" ... "0377", "0" ... "255" . So you could easily write opcodes using:

Code: Select all

@echo off
setlocal enableExtensions enableDelayedExpansion
:: ...
set "instructionPrefixes=!lockAndRepeatPrefix!!segmentOverride!!operandSizePrefix!!addressSizePrefix!"
set "ModR/M=!Mod!!Reg/Opcode!!R/M!"
set "SIB=!Scale!!Index!!Base!"

for %%a in ("[eax]+disp8", "[ecx]+disp8", "[edx]+disp8", "[ebx]+disp8", "[--][--]+disp8", "[ebp]+disp8", "[esi]+disp8", "[edi]+disp8") do set "%%~a=1"
set /A "bl=bx=ebx=mm3=xmm3=3"
:: ...

setlocal enableExtensions enableDelayedExpansion
:: ...

:: add byte ptr [eax+0x00], bl
set "opcode= 0x00"
set "Mod= 0![eax]+disp8!"
set "Reg/Opcode=!bl!"
set "R/M=!eax!"
set "Displacement= 0x00"

:: ...

type%instructionPrefixes%!Opcode!%ModR/M%%SIB%!Displacement!!Immediate!

:: ...
endlocal
:: ...
endlocal

penpen

Edit: Added partial assembler source example.

[MagicMovingImages]

Hi

I think you have forgotten to type these ALT numbers using the number pad. It won't work if you just type ALT and an asciicode.

Do these steps!
1) Switch on Num Lock first
2) Hold Left ALT
3) Whilst holding Left Alt down type the Ascii code number on the KEYPAD e.g. 80 (P)
4) Let go of the Left Alt key.

You should then seen the letter P onscreen.

Thanks

[ShadowThief]

Hi

I think you have forgotten to type these ALT numbers using the number pad. It won't work if you just type ALT and an asciicode.

Do these steps!
1) Switch on Num Lock first
2) Hold Left ALT
3) Whilst holding Left Alt down type the Ascii code number on the KEYPAD e.g. 80 (P)
4) Let go of the Left Alt key.

You should then seen the letter P onscreen.

Thanks

I don't know who you think you're talking to, but everybody here knows how to use the alt key with the number pad.

[penpen]

Our lazy syntax may be confusing: Same syntax for different semantic, when using something like "Ctrl-2", "ALT+256", ... .

The correct syntax for the key event order (using a german standard keyboard: only important for the '@'-char), used in the above posts is:
- "Ctrl-@", "CTRL+@": LEFT_CTRL+(RIGHT_ALT+RIGHT_CTRL+Q)
- "Ctrl-2", "CTRL+2": LEFT_CTRL+D2
- "Alt-256", "ALT+256": NUMLOCK_ON+LEFT_ALT+(NumPad2, NumPad5, NumPad6)

ALT GR equals RIGHT_ALT+RIGHT_CTRL (at least using my WinXP version).

penpen

[Aacini]

Ctrl-@ is an extended key (the same type of F1 or Home keys) that produce two bytes with values 0 and 3 (F1 produce 0 and 59, and Home produce 0 and 71). You may see this post for further details (below SHOWKEYCODES.BAT program).

My current laptop computer, bought about a year ago, does NOT include the "numeric keypad", so I can't use the Alt-nnn method to enter Ascii values! (To be clearer, it has NOT NumLock key nor blue digits in MJKLUIO789 keys. When I complained to HP about this point, they replied with something like "this keyboard layout (with no numeric keypad) is standard in new laptops".)

I tested this in another computer with Windows 8 - 32 bits. In Notepad, Ctrl-@ and Alt-256 both sound the attention tone. In the command line they do nothing. In edit, Alt-256 do nothing, but Ctrl-@ works:

Code: Select all

C:\> edit test.txt

C:\> echo/        > eightSpaces.txt

C:\> dir *.txt
 El volumen de la unidad C es Acer
 El número de serie del volumen es: 5C79-7E3F

 Directorio de C:\Users\Antonio\DOCUME~1\ASMB

06/02/2015  02:00 p. m.                10 eightSpaces.txt
06/02/2015  01:58 p. m.                10 test.txt
               2 archivos             20 bytes
               0 dirs   8,182,767,616 bytes libres

C:\> type test.txt
Here: <-

C:\> fc /B test.txt eightSpaces.txt
Comparando archivos test.txt y EIGHTSPACES.TXT
00000000: 48 20
00000001: 65 20
00000002: 72 20
00000003: 65 20
00000004: 3A 20
00000005: 00 20
00000006: 3C 20
00000007: 2D 20

However, bytes with these values can not be accurately posted in any web site, as shown here. This is the above test.txt file:

Code: Select all

Here: <-

so I can't see the point of this method...

Antonio