Home

Batching commands and program flow

When we examined the Little Man in the Computer simulation we saw how programs are executed between CPU and Memory and how the code flows. Batching in DOS is a lower level language than what is actually processed (I.E it must be interpreted first or decompiled) but it still has commands that enable program flow in a friendlier format than what the CPU needs.

To demonstrate this we will use the choice command.

We examined the Choice command and stepped through a printout of MenuTech.bat Download the zipped MenuTech folder here and save it on your Desktop.

You can create or edit batch files using any text editor like Notepad. There is an excellent free editor named Scite. Developed by the Open Source Software Foundation, SciTE provides command highlighting and line numbering making editing easier. You can download and install Scite here.


Screen shot comparison between Notepad and Scite

CHOICE.COM is an external DOS command, i.e. resides as a file in the %PATH% and not within COMMAND.COM.

I have provided CHOICE.COM in the download above as Windows XP doesn't have this command in its Path by default.

The CHOICE command basically pauses and waits for a key press. When a key is pressed it sets a variable named ERRORLEVEL with a value from 1 to the number of choices available in the switch /C: 

  
  SYNTAX 
  
  CHOICE▲/C:123Q▲Make a choice please
 
  IF▲ERRORLEVEL▲4▲GOTO▲DONE
  IF▲ERRORLEVEL▲3▲GOTO▲MYLABEL
  
  :MYLABEL
  {Some code may be here}
  
  :DONE

Pressing Q will generate ERRORLEVEL 4 in the above example. CHOICE works with ERRORLEVEL to direct to a LABEL.

Using the block diagram below identify the flow of the program we wrote in class.

 

AutoIT

AutoIt v3 is an freeware BASIC-like scripting language designed for automating the Windows GUI. Like most programing languages you write commands in a syntax and then compile the code into an executable. It is a fantastic way to get into sripting principles with a very supportive forum and some example files

get it here

AutoIT uses Scite as the code editor, when you install AutoIT choose the default operation for .au3 files to edit scripts. This will load then in Scite and you can run and compile the scripts from the tools menu.

 

Understanding your HOSTS file

For your second assignment you have been asked to perform a Spyware audit and also to print out your HOSTS file. The HOSTS file is where Windows Internet Explorer first looks for the Internet address (IP Address) of a URL you type in the Address bar, or a URL that a program tries to access. If the address is in this file then it will connect to the IP address listed. If it is not in the HOSTS file it will then query a DNS server at your ISP to get the correct IP address of the URL

  
  In Windows 98 and ME, the HOSTS file is located at C:\WINDOWS\
  
  In Windows 2000  C:\WINNT\SYSTEM32\DRIVERS\ETC\
  
  and XP it is located at C:\WINDOWS\SYSTEM32\DRIVERS\ETC\
You can download Hoster - A tool for your control panel to manage the HOSTS file

Every networked PC has an IP address 127.0.0.1 which is known as the Loopback address. Basically 127.0.0.1 is itself! If we put known Spyware or Adservers in our HOSTS file and give the address 127.0.0.1 then we can effectively block access to these sites. This is how programs like AdAware and SpybotSD work, by modifying the contents of the read-only HOSTS file. There is a HOSTS file in the MenuTech folder that has already been populated with known blocked sites that you can install using the MenuTech.bat file. Be sure to print out your existing HOSTS file first for your assignment to show before and after.

Another use of the HOSTS file is to redirect URLs to different sites. For example. Redirect www.google.com to www.google.co.uk


Find the IP Address of google.co.uk by pinging

c:\> ping▲www.google.co.uk

Once you know the IP address of google.co.uk you can add these lines to your HOSTS file.

#Redirect Google US to Google UK
216.239.59.104		www.google.com

Understanding system files.

System files are any files used by the operating system to support running processes. Often these are loaded and unloaded in the background by other applications.

Typical system file extensions include .sys, .ini, .dll, .inf, .dat, .vxd, .db. Often these files are in use and cannot be erased, or replaced unless you are in DOS.

Comparison of DLL and INF files.

Dynamic Link Library
DLLs		 Inf Files
INF
Compiled code. Text file. Can be created in Notepad.
Shared resource. "Why re-invent the wheel?"
DLLs have version numbers to illustrate updated modules.		 Usually associated to a device driver or setup file.
Contains driver settings, Registry entries and default settings.
One program has many DLL processes running. Used to configure AutoPlay CDs.
If corrupt often can only be replaced in DOS. [  ] Brackets are used to group sub-categories within the text file. Many config files now are part of the system registry.
Should exist in the Windows\System\ or Windows\System32\ folders. Some installations keep their associated DLLs in the installed directory to avoid conflicts with existing software. Should exist in the Windows\System\ or Windows\Inf\ folders. Many installations keep their associated INFs in the installed directory.
Poorly written or corrupt DLLs are often the cause for "Illegal Operations" reported by operating systems. "To be installed, drivers for the Microsoft® Windows® 2000 and later operating systems must have an INF file. An INF file is a text file that contains all the necessary information about the device(s) and file(s) to be installed, such as driver images, registry information, version information, and so on, to be used by the Setup components."
Display Loaded Modules A utility which lists running processes on your PC.


Further reading

AutoIT is a relatively new scripting language that is great to learn if you have an interest in programming

AutoIT Programming Tutorial