Welcome!

By registering with us, you'll be able to discuss, share and private message with other members of our community.

SignUp Now!

.BAT works in TCC-RT 25, but not in TCC-RT 26

Aug
1,917
68
I have the following .BAT file;
Code:
@setlocal
@echo off
set "beginJS=mshta "javascript:close(new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write("
set "endJS=));""
for /f %%N in (
  '%beginJS% \u0047etObject('winmgmts:').ExecQuery('Select * from Win32_PerfFormattedData_PerfOS_Memory').ItemIndex(0).AvailableBytes %endJS%'
) do set free_mem=%%N
echo free_mem=%free_mem%
endlocal

The above runs and returns the correct results in CMD and PowerShell, and TCC-RT 25;
Code:
e:\utils>"C:\Program Files\JPSoft\TCC_RT_25\tcc.exe" /q "E:\Utils\testhta.bat"
free_mem=130199814144

Version TCC-RT 25.00.27 x64

However, it does not return the correct results in TCC-RT 26;
Code:
e:\utils>"C:\Program Files\JPSoft\TCC_RT_26\tcc.exe" /q "E:\Utils\testhta.bat"
free_mem=

e:\utils>"C:\Program Files\JPSoft\TCC_RT_26\tcc.exe" /q "e:\utils\whatver.btm"
     _x64: 1
   _admin: 1
_elevated: 1

TCC-RT  26.01.35 x64   Windows 10 [Version 10.0.18362.720]
BuildNumber  Caption                   CSDVersion  OSArchitecture  Version
18362        Microsoft Windows 10 Pro              64-bit          10.0.18362

Joe
 
Here, that batfile works only in CMD (failing in TCC 24, 25, and 26, and in PowerShell).

If I put the "FOR ... IN ( ... ) DO ... " statement all on one line it also fails in CMD (no output at all).

HeeHee!! When I changed "\u0047" to "G" and tried running it in TC24 I got this.

1587654066540.png
 
Yes, mshta.exe worked fine in Windows 7 and earlier versions of Windows 10, but it is frequently detected now as a virus (false-positive) by several anti-virus programs.

It still works fine (no virus alert) on my system for some things;
Code:
mshta.exe "javascript:clipboardData.setData('text','Joe');close()"
Code:
mshta.exe vbscript:Execute("msgbox ""message"",0,""title"":close")
Code:
mshta javascript:alert("Message\n\nMultiple\nLines\nIn\nThis\nDialog\!");close();

Joe
 
That security alert gives a hint about what's happening. TCC24 apparently stops parsing FOR's set at the single quote following "winmgmts".
 

Similar threads

Back
Top