Why does this run net1.exe?

[xpdev]

Why does typing this run net1.exe?

Code: Select all

"n<z

C:\Windows\System32\net1.exe doesn't have any letter Z in it.
I set the PATH to just System32 and it still runs net1.exe
Same thing with:

Code: Select all

"n<l

[penpen]

The lower than ('<') is an undocumented wildcard, see:
viewtopic.php?t=6207.

On first look it seems as if that expression is able to match for characters not in filename after an '<'.
Actually i don't remember those rules in detail, but i'm not sure that should be possible.

A first dive into the analysis shows, that on my pc "net.exe" is called (which then starts "net1.exe") instead of directly "net1.exe".
You might check that with "Process Monitor" available at https://docs.microsoft.com/en-us/sysint ... ds/procmon.

Also the following commands all do that on my system (meanwhile i checked for all unicode characters now):

Code: Select all

"n<1"
"n<2"
"n<4"

"n<D"
"n<F"
"n<L"
"n<M"
"n<X"
"n<Z"

"n<d"
"n<f"
"n<l"
"n<m"
"n<x"
"n<z"

penpen


Edit: Added the last paragraph.
Edit2: Tested all Unicode characters. The above is the full list on my computer. Also removed the edit-notifications.

[penpen]

If someone wants to test that behaviour, then you need to copy the following original files (from C:\Windows\System32" to a test folder):

Code: Select all

net.exe
netutils.dll

However these files won't be able to execute "net.exe" with the strings in my above post.

Once you added files with the following names, you will be able to trigger that behaviour:

Code: Select all

net1.exe
netapi32.dll
netcfgx.dll
netdiagfx.dll
NetDriverInstall.dll
netfxperf.dll
netid.dll
netplwiz.dll
Netplwiz.exe
netprofm.dll
NetSetupShim.dll
netshell.dll
nettraceex.dll
Netwuw04.dll

None of these files need to be an original file, so an empty file with that name will do the trick.
You also don't need all files, as the existence of each single one of them is sufficient

I don't see, why those should be special - there are other files with filenames (without extension) also starting with an 'n' and ending in '1', '2', '4', 'D', 'F', 'L', 'M', 'X', 'Z', 'd', 'f', 'l', 'm', 'x', 'z', like:

Code: Select all

NL7Data0011.dll
NL7Lexicons0011.dll
NL7Models0011.dll
ntasn1.dll

I then thought that this behaviour might be caused by files starting with "net", but there are also some counterexamples:

Code: Select all

netbios.dll
NetCellcoreCellManagerProviderResources.dll
netcenter.dll

However those filenames that trigger the above behaviour are all files that start with "net" and end on '1', '2', '4', 'D', 'F', 'L', 'M', 'X', 'Z', 'd', 'f', 'l', 'm', 'x', 'z'.
I tested all other unicode letters - none other caused that behaviour in my tests.

It also seems like that the extension doesn't matter:

Code: Select all

net1.txt
net1.doc
net1.unknown

Also shortnames probably are not the cause, else i would have expected "NetSetupMig.log" (with short name "NETSET~1.LOG") to trigger "n<1".
A file with the long name "NETSET~1.LOG" enables "n<1" to call "net.exe".


I don't see any regularities i could blame for.
@all: Any additional ideas?


penpen