Why does this run net1.exe?

Discussion forum for all Windows batch related topics.

Moderator: DosItHelp

Posts: 15
Joined: 25 Oct 2019 20:34
Location: Baltimore, MD USA

Re: Why does this run net1.exe?

#16 Post by CJM » 29 Jun 2021 16:56

penpen wrote:
29 Jun 2021 06:02
Also, since "n<<<<<<" matches an ".exe"-file, i would expect "n<<<<<<.exe" to match the same executable, but on my system the first executes "C:\Windows\Notepad.exe" while the last starts "C:\Windows\System32\Narrator.exe".
Yes, but while "n<<<<<<" does indeed match an ".exe"-file, that's not the FIRST one matched on the wildcard PATH+PATHEXE search that is being done on this extension-less wildcard command. Run through the backtrack steps I outlined, and for the directory in questions here, the file used for character substitution is the FIRST file reported by:

DIR C:\Windows\System32\n******.*

which is effectively the same as:

DIR C:\Windows\System32\n*.*

On my system, the FIRST file reported is: NAPCRYPT.DLL

So, starting with the 2nd character, replace the "<<<<<<" in your original command with "APCRYP", making your PATHEXT search in C:\Windows\System32: nAPCRYP.com, nAPCRYP.exe, etc. which will fail to match any file in \System32, so the next PATH directory is C:\Windows where the same wildcard search DIR C:\Windows\n*.* returns first (and only) notepad.exe, so again replace "<<<<<<" with "otepad", and the "notepad" PATHEXE search will fail on notepad.com, then succeed on notepad.exe, and launch!

In order to follow what's happening, it's necessary to do the wildcard search, character replacement, and PATHEXE search on each directory in the PATH order.
penpen wrote:
29 Jun 2021 06:02
I just checked a similar scenario, so all results are:
- "n>>>>>>" executes "C:\Windows\Notepad.exe"
- "n>>>>>>.exe" executes "C:\Windows\System32\nbtstat.exe"
- "n<<<<<<" executes "C:\Windows\Notepad.exe"
- "n<<<<<<.exe" executes "C:\Windows\System32\Narrator.exe"
Same results here. Our systems aren't so different.

Post Reply