5

I came across a mind-blowing weird script that crashes the console:

set "h=/?" & call [if | for | rem] %%h%%

@jeb pointed out CALL doesn't execute the following special characters, but instead convert them into a "token" (version dependent):

  • & returns /
  • && returns 1
  • | returns 2
  • || returns 0
  • /? returns <
  • @ returns +
  • @() returns ;
  • @if a==a : returns ,
  • @for %a in () do : returns +
  • @rem : returns -

However, even though they have unique parsers, it still doesn't explain why they all crash. So I did some testing:

  • Remove call
    C:\>set "h=/?" & for %h%
    %%h%% was unexpected at this time.
  • Change the command to something else. (I tried all other internal commands, none works)
  • Seperate two commands:
    C:\>set "h=/?"
    C:\>call for %%h%%
    --FOR help message--
  • Add @
    C:\>set "h=/?" & call for @%%h%%
    CRASH!!!
  • Surround the scriptblock by ()
    C:\>set "h=/?" & call for (%%h%%)
    CRASH!!!

Summary of question:

  • What role does call play?
  • What caused the parser to crash?
ScriptKidd
  • 803
  • 1
  • 5
  • 19
  • 1
    Why not ask the author of that script @npocmaka? (although I guess, there is a reason why it's listed under "bugs") – Stephan Feb 23 '20 at 18:50
  • 1
    The downvote wasn't me. Why should I? I just mentioned the author to maximize your chance to get an answer. And three weeks ago? I can't remember (probably not). If you tell me which Q/A, I'll tell you. – Stephan Apr 26 '20 at 07:57

2 Answers2

2

The CALL is necessary to start a second round of the parser.

But there is a small bug (or more), in that phase it's not possible to execute any of the special commands or using &, |, &&, ||, redirection or command blocks.

The cause seems to be, that the parser build internally a token graph, replacing the special things into some kind of token values.
But with CALL the executer doesn't know anymore how to handle them.

This code tries to execute a batch file, named 3.bat !!!
(The name can be different, depending on the windows version)

set "cmd=(a) & (b)"
call %%cmd%%

But in your sample, the help function is triggered on a non executable token.
That seems to be the final death trigger for the executer to be completely out of sanity.

jeb
  • 78,592
  • 17
  • 171
  • 225
1

Summary of Research:

Calling linefeeds \n or FOR, IF & REM's help function crashes cmd, exiting with ERRORLEVEL -1073741819 aka 0xC0000005, which indicates an access violation error.

First, the cmd parser tries to start werfault to terminate the process.

If you prematurely terminate werfault, an error message will appear!

Access violation error:
The instruction at 0x00007FF7F18E937B referenced memory at 0x0000000000000070. The memory could not be read.

It is conjectured that if, for and rem uses special parsers, but when the help function is triggered by call, a non-command token is returned, which crashes the cmd parser.

Sources:

  1. Why I can't CALL "IF" and "FOR" neither in batch nor in the cmd?
  2. CALL me, or better avoid call
  3. Limit CMD processing to internal commands, safer and faster?
ScriptKidd
  • 803
  • 1
  • 5
  • 19