Adding some character to Alternate Data Streams

Posted on by

Update

After I published it Vess suggested a test with \x08 (backspace) – it was a pretty cool idea so here is the result of testing:

  • c:\test\test.exe:foo\x08\x08\x08\x08\x08\x08\x08\x08\x08bar

Old Post

One of the file name restrictions that is listed on the classic Naming Files, Paths, and Namespaces page is this:

  • Characters whose integer representations are in the range from 1 through 31, except for alternate data streams where these characters are allowed. For more information about file streams, see File Streams.

I was curious how it works in practice with the ADS so here is the result of a test where I create the following file:

  • c:\test\test.exe:foo\x13\x10bar

So… creating the ADS using characters \x00-\x1F can produce unexpected results and possibly break various parsers. Not a biggie, but worth knowing about!

You can download the test file here. Just place it in c:\test\test.exe and run it.

Beyond good ol’ Run key, Part 82

Posted on by

This is just an addendum to my previous post. I’ve been reading more about what other UI enhancements Windows Explorer offers with regards to menus and found one more interesting bit that is worth documenting. Again, nothing ground breaking (and the more I read online the more I find out that it was actually discussed a lot before), but who knows… maybe one day this knowledge will come handy…

Shell has the menu entries for the ‘usual’ right click, and SHIFT+right click. The latter is defined by the presence of ‘Extended’ value under the key e.g.:

  • HKCR\Directory\shell\cmd
    • @=”@shell32.dll,-8506″
    • “Extended”=””
    • “HideBasedOnVelocityId”=dword:00639bc8
    • “NoWorkingDirectory”=””

One can ‘force’ the menu to appear on right click by removing the ‘Extended’ value (you can see it on the screenshot below where I removed that entry and the command appears on the menu).

Then there is one more interesting bit – we can add menu items that shows up only when the user clicks the ‘white’ space of the opened folder. This is pretty cool, as we can add both right click, and extended right click menu there as well + users do right click on that white space a lot. Little persuasion, and they may actually click our entry.

For the RIGHT click, all we have to do is to add this data to the Registry:

  • HKCR\Directory\Background\shell\test
    • @=”Launch Chrome”
  • HKCR\Directory\Background\shell\test\command
    • @=”c:\\windows\\system32\\calc.exe”

For the SHIFT+RIGHT CLICK we just need to add the ‘Extended’ value.

With no ‘Extended’ value for the ‘Launch Chrome’ menu item and with the removed ‘Extended’ bit for the ‘Open command window here’ the result will look like this:


Again, this particular menu is activated ONLY when the user right clicks on the folder’s white space (‘background’).


This MSDN post provides some more details, same as this discussion on StackOverflow.