Me, myself & IT

Write, Read and Execute NTFS Alternate Data Streams

Purpose
Background Information
Demonstrations: Example № 1; Example № 2; Example № 3; Example № 4; Example № 5; Example № 6; Example № 7; Example № 8; Example № 9

Purpose

�

Background Information

The MSKB article 105763 provides an introduction to NTFS alternate data streams.

Demonstrations

�

Example № 1

Start the Command Processor Cmd.exe in an arbitrary, preferable empty directory, then execute the following command lines to write, list and execute an (arbitrary) alternate data stream of an arbitrary file and an arbitrary directory:

1>"streams:<|>" ECHO
DIR streams /R
0<"streams:<|>" "%COMSPEC%"
ERASE streams

MKDIR Streams
1>Streams:*.? VERIFY
DIR Streams /R
0<Streams:*.? "%COMSPEC%"
RMDIR Streams

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM                 0 streams
                                    13 streams:<|>:$DATA
               1 File(s)              0 bytes
               0 Dir(s)    9,876,543,210 bytes free

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

ECHO is on.
is on.

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop\Streams

04/27/2012  08:15 PM    <DIR>          .
                                    16 .:*.?:$DATA
04/27/2012  08:15 PM    <DIR>          ..
               0 File(s)              0 bytes
               2 Dir(s)    9,876,543,210 bytes free

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

VERIFY is off.

OOPS: contrary to the MSDN article Naming Files, Paths, and Namespaces, the input redirection character <, the pipeline character |, the output redirection character > as well as the wildcard characters * and ? are valid in the name of an alternate data stream!

Note: the internal Verify command of the Command Processor Cmd.exe fails without (syntax) error message when called with multiple (invalid) arguments!

Example № 2

Start the Command Processor Cmd.exe elevated in an arbitrary, preferable empty directory, then execute the following command lines to create a directory junction to an alternate data stream of itself, create a symbolic link to the former, replace the latter twice, display their directory entries and finally remove both:

MKLINK /J Junction Junction:*
MKLINK Junction:* Junction:?
MKLINK /D Symlink Junction
MKLINK Symlink:? Symlink:*
MKLINK Symlink:* Symlink:?
DIR ?unction ?ymlink /R
RMDIR Junction Symlink

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Junction created for Junction <<===>> Junction:*

There is a mismatch between the tag specified in the request and the tag present in the reparse point.

Symbolic link created for Symlink <<===>> Junction

Symbolic link created for Symlink:? <<===>> Symlink:*

Symbolic link created for Symlink:* <<===>> Symlink:?

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM    <JUNCTION>     Junction [C:\Users\Stefan\Desktop\Junction:*]

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM    <SYMLINKD>     Symlink [Symlink:?]
                                     0 Symlink:?:$DATA
                                     0 Symlink:*:$DATA
               0 File(s)              0 bytes
               2 Dir(s)    9,876,543,210 bytes free

OOPS: contrary to the MSDN article Naming Files, Paths, and Namespaces, the wildcard characters * and ? are valid in the name of an alternate data stream!

Note: the error message There is a mismatch between the tag specified in the request and the tag present in the reparse point. is expected and intended here – a reparse point is always attached to the file system object, not one of its data streams, and can only be replaced with one of the same kind.

Example № 3

Start the Command Processor Cmd.exe in an arbitrary, preferable empty directory, then execute the following command lines to write a JScript that prints its pathname on standard output to the alternate data stream .js of an arbitrary file or (sub)directory and execute it with the Console Based Script Host CScript.exe:
```
1>streams:.js ECHO WScript.Echo(WScript.ScriptFullName)
CSCRIPT.EXE streams:.js
```
Windows Script Host WScript WScript.Echo()
```
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\Users\Stefan\Desktop\streams:.js
```

Write a Windows Script File that executes the JScript from the alternate data stream .js of the file (or subdirectory) streams to its alternate data stream .wsf and execute it with the Console Based Script Host CScript.exe:

IF EXIST streams @(
ECHO ^<?xml version='1.0' encoding='US-ASCII' standalone='yes' ?^>
ECHO ^<job^>^<script src='streams:.js' /^>^</job^>) 1>streams:.wsf
CSCRIPT.EXE streams:.wsf

Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

Input Error: Can not find script file "C:\Users\Stefan\Desktop\streams:.wsf".

Example № 4

Start the Command Processor Cmd.exe in an arbitrary, preferable empty directory, then execute the following command lines to copy an arbitrary file (really: its unnamed default data stream) with the LZ Expansion Utility Expand.exe into an arbitrary alternate data stream of the same or another file or any (sub)directory:

1>streams ECHO
EXPAND.EXE streams streams:\"
DIR streams /R

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Microsoft (R) File Expansion Utility  Version 6.1.7600.16385
Copyright (c) Microsoft Corporation. All rights reserved.

Copying streams to streams:"
streams: 13 bytes copied.

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM                13 streams
                                    13 streams:":$DATA
               1 File(s)             13 bytes
               0 Dir(s)    9,876,543,210 bytes free

OOPS: contrary to the MSDN article Naming Files, Paths, and Namespaces, the quotation mark " alias double quote is also valid in the name of an alternate data stream!

Note: copying an alternate data stream to (the unnamed default data stream of) a file is left as an exercise to the reader.

Example № 5

Execute the alternate data stream " of the file streams created in Example № 4 via the ForFiles.exe console application:
```
FORFILES.EXE /C streams:\". /M streams
```
Note: the trailing dot is required here – without it the extension .exe is appended to the name of the file to execute.
```
ERROR: "streams:"." is not a valid executable.
```
Note: the error message is expected here – the ASCII character string ECHO is on.\r\n is of course an invalid portable executable image.

Note: executing an arbitrary console or Windows application from an alternate data stream is left as an exercise to the reader.

Example № 6

Start the Command Processor Cmd.exe in an arbitrary, preferable empty directory, then execute the following command lines to save its DACL to the alternate data stream <|> of an arbitrary file or (sub)directory and display it:

ICACLS.EXE . /SAVE "streams:<|>" /Q
DIR streams /R
0<"streams:<|>" MORE.COM

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Successfully processed 0 files; Failed processing 0 files

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM                 0 streams
                                   208 streams:<|>:$DATA
               1 File(s)              0 bytes
               0 Dir(s)    9,876,543,210 bytes free

.
D:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;FA;;;S-1-5-21-820728443-44925810-1835867902-1000)

Note: restoring DACLs from an alternate data stream is left as an exercise to the reader.

Example № 7

Start the Command Processor Cmd.exe in an arbitrary, preferable empty directory, then execute the following command lines to export the registry key HKEY_CURRENT_USER\Volatile Environment with the Registry Console Tool Reg.exe to the alternate data stream *.? of an arbitrary file or (sub)directory and display it:

REG.EXE EXPORT "HKEY_CURRENT_USER\Volatile Environment" streams:*.?
DIR streams /R
0<streams:*.? MORE.COM

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

The operation completed successfully.

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM                 0 streams
                                   946 streams:*.?:$DATA
               1 File(s)              0 bytes
               0 Dir(s)    9,876,543,210 bytes free

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Volatile Environment]
"LOGONSERVER"="\\\\AMNESIAC"
"USERDOMAIN"="AMNESIAC"
"USERNAME"="Stefan"
"USERPROFILE"="C:\\Users\\Stefan"
"HOMEPATH"="\\Users\\Stefan"
"HOMEDRIVE"="C:"
"APPDATA"="C:\\Users\\Stefan\\AppData\\Roaming"
"LOCALAPPDATA"="C:\\Users\\Stefan\\AppData\\Local"
"USERDOMAIN_ROAMINGPROFILE"="AMNESIAC"

[HKEY_CURRENT_USER\Volatile Environment\1]
"SESSIONNAME"="Console"
"CLIENTNAME"=""

Note: the import of registry entries from an alternate data stream is left as an exercise to the reader.

Example № 8

Start the Command Processor Cmd.exe in an arbitrary, preferable empty directory, then execute the following command lines to copy its unnamed default data stream with the LZ Expansion Utility Expand.exe into an arbitrary alternate data stream of an arbitrary file or (sub)directory and execute it via the WMI Commandline Utility WMIC.exe:

EXPAND.EXE "%COMSPEC%" streams:\"
WMIC.EXE PROCESS CALL CREATE "%CD%\streams:\""

Note: the command lines can be copied and pasted as block into a Command Processor window.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

Microsoft (R) File Expansion Utility  Version 6.1.7600.16385
Copyright (c) Microsoft Corporation. All rights reserved.

Copying c:\windows\system32\cmd.exe to streams:"
c:\windows\system32\cmd.exe: 345088 bytes copied.

Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
	ProcessId = 1234;
	ReturnValue = 0;
};

Example № 9

Perform the following 21 simple steps to build a DLL, a console and a Windows application solely within NTFS alternate data streams of an arbitrary file or (sub)directory and execute them.

Start the command prompt of the Windows^™ SDK in an arbitrary, preferable empty directory, then create an (empty) file or subdirectory, for example streams, there:
```
IF EXIST streams (COPY /Y NUL: streams) ELSE MKDIR streams
```
```
        1 file(s) copied.
```
Write the hexadecimal dump of a 16-bit DOS program that prints its copyright message on standard output to an alternate data stream, for example .txt, of the file or subdirectory created in step 1.:
```
IF EXIST streams @(
ECHO 4d 5a 90 00 01 00 00 00 04 00 00 00 ff ff 00 00 e0 00 00 00 43 00 00 00
ECHO 40 00 00 00 00 00 00 00 00 00 00 00 19 57 04 27 00 00 00 00 00 00 00 00
ECHO 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 43 29 6f 70 79 72 69
ECHO 67 68 74 20 32 30 30 34 2d 32 30 32 36 2c 20 53 74 65 66 61 6e 20 4b 61
ECHO 6e 74 68 61 6b 20 3c 73 74 65 66 61 6e 2e 6b 61 6e 74 68 61 6b 40 6e 65
ECHO 78 67 6f 2e 64 65 3e 0d 0a 07 24 0e 1f 33 d2 b4 09 cd 21 b8 01 4c cd 21) 1>streams:.txt
```
Note: the MSKB article 65122 documents the IMAGE_DOS_HEADER structure contained in the first 64 bytes; it is followed by the 67 ASCII characters (C)opyright 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>\r\n\a$ and 13 bytes real mode machine code.
Note: the command lines can be copied and pasted as block into a Command Processor window.

�

; Copyright © 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

	.model	tiny

e_header struct				; DOS .EXE header
e_magic	word	5A4Dh			; magic number "MZ"
e_cblp	word	stop - header		; bytes on last page of file
e_cp	word	1			; pages in file
e_crlc	word	0			; number of relocation table entries
e_cparhdr word	sizeof header / 16	; size of header in paragraphs
e_minalloc word	0			; minimum extra paragraphs needed
e_maxalloc word	65535			; maximum extra paragraphs needed
e_ss	word	0			; initial (PSP relative) SS value
e_sp	word	stack - header		; initial (SS relative) SP value
e_csum	word	0			; checksum
e_ip	word	sizeof message		; initial (CS relative) IP value
e_cs	word	0			; initial (PSP relative) CS value
e_lfarlc word	sizeof header		; file offset of relocation table
e_ovno	word	0			; overlay number
e_res	word	4 dup (0)		; reserved words
e_oemid	word	5719h			; OEM identifier
e_oeminfo word	2704h			; OEM information
e_res2	word	10 dup (0)		; reserved words
e_lfanew dword	0			; file offset of new exe header
e_header ends

	.code

header	e_header <>

message	byte	"(C)opyright 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>", 0Dh, 0Ah, 07h, 24h

start:
	push	cs
	pop	ds
	xor	dx, dx
	mov	ah, 09h
	int	21h

	mov	ax, 4C01h
	int	21h
stop:
	dword	20 dup (?)
stack:
	end	start

Decode the 16-bit DOS program to another alternate data stream, for example .dos, of the file or subdirectory created in step 1.:
```
CERTUTIL.EXE /DecodeHex streams:.txt streams:.dos
```
```
Input Length = 438
Output Length = 144
CertUtil: -decodehex command completed successfully.
```
Execute the 16-bit DOS program created in step 3.:
```
.\streams:.dos
```
```
The syntax of the command is incorrect.
```
Oops¹: except for input and output redirection, and except for its internal Dir, Mklink and (prior to Windows 7 also) Start commands, the Command Processor Cmd.exe does not support alternate data streams!
�
```
START .\streams:.dos
```
```
The system cannot find the file .\streams:.dos.
```
Note: the culprit here is not the Start command, but the Win32 function ShellExecuteEx() – with Windows 7 Microsoft^® removed its support for alternate data streams!

Write a JScript that executes the 16-bit DOS program decoded in step 3. and prints its standard output to the alternate data stream .vbs of the file or subdirectory created in step 1., then execute it with the Console Based Script Host CScript.exe:

1>streams:.js ECHO WScript.Echo(WScript.CreateObject('WScript.Shell').Exec('.\\streams:.dos').StdOut.ReadAll())
CSCRIPT.EXE streams:.js

WScript WScript.CreateObject() WScript.Echo() WScript.Shell Exec() Exec WScript.StdOut TextStream ReadAll() 32-bit editions of Windows execute the 16-bit DOS program:

Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

(C)opyright 2004-2026, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[Screen shot of message box from module loader on Windows 7] 64-bit editions of Windows don’t support 16-bit DOS programs and display the message box shown to the right:

C:\Users\Stefan\Desktop\streams:.js(1, 1) WshShell.Exec: This version of C:\Users\Stefan\Desktop\streams:.dos is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher.

Write an ANSI C source code to the alternate data stream .c of the file or subdirectory created in step 1.:
```
1>streams:.c ECHO unsigned _DllMainCRTStartup(void *module, unsigned reason, void *context) { return 0; }
```

Compile and link the source code from the alternate data stream .c written in step 6.:

SET CL=/Fa /Gz /LD /W4 /Zl
SET LINK=/MANIFEST /MAP /NODEFAULTLIB /STUB:streams:.dos
CL.EXE streams:.c

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

streams:.c

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/MANIFEST /MAP /NODEFAULTLIB /STUB:streams:.dos
/out:streams:.dll
/dll
/implib:streams:.lib
streams:.obj

Note: the Visual C compiler writes its output to one or more alternate data streams of the file or subdirectory from which it reads the alternate data stream with the (first) source, then the linker reads object file and DOS stub from and writes its output to one or more alternate data streams of the same file or subdirectory.

List the alternate data streams of the (still empty) file or subdirectory created in step 1.:

DIR streams /R

 Volume in drive C has no label.
 Volume Serial Number is 1957-0427

 Directory of C:\Users\Stefan\Desktop

04/27/2012  08:15 PM                 0 streams
                                   619 streams:.asm:$DATA
                                    89 streams:.c:$DATA
                                 1.024 streams:.dll:$DATA
                                   381 streams:.dll.manifest:$DATA
                                   144 streams:.dos:$DATA
                                    94 streams:.js:$DATA
                                   577 streams:.map:$DATA
                                   469 streams:.obj:$DATA
                                   438 streams:.txt:$DATA
               1 File(s)              0 bytes
               0 Dir(s)    9,876,543,210 bytes free

Execute the DLL built in step 7. via the Microsoft(C) Register Server application:
```
REGSVR32.EXE "%CD%\streams:.dll"
```
Note: the error message box is expected here – the _DllMainCRTStartup() function intentionally returns 0 alias FALSE to let the Win32 functions LoadLibrary() and LoadLibraryEx() fail with Win32 error code 1114 alias ERROR_DLL_INIT_FAILED.
The MSKB article 249873 provides details.
Execute the DLL built in step 7. via the Windows host process (Rundll32) application RunDLL32.exe:
```
RUNDLL32.EXE "%CD%\streams:.dll",#0
```
Note: the error message box is expected here – the _DllMainCRTStartup() function intentionally returns 0 alias FALSE to let the Win32 functions LoadLibrary() and LoadLibraryEx() fail with Win32 error code 1114 alias ERROR_DLL_INIT_FAILED.
Write another ANSI C source code to the alternate data stream .* of the file or subdirectory created in step 1.:
```
1>streams:.* ECHO unsigned mainCRTStartup(void) { return 'NTFS'; }
```

Compile and link the source code from the alternate data stream .* created in step 10.:

SET CL=/W4 /TC /Zl
SET LINK=/ENTRY:mainCRTStartup /FIXED /NODEFAULTLIB /STUB:streams:.dos /SUBSYSTEM:CONSOLE
CL.EXE streams:.*

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

streams:.*

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/ENTRY:mainCRTStartup /FIXED /NODEFAULTLIB /STUB:streams:.dos /SUBSYSTEM:CONSOLE
/out:streams:.exe
streams:.obj

Write a VBScript that executes the Win32 console application built in step 11. and prints its exit code to the alternate data stream .vbs of the file or subdirectory created in step 1., then execute it with the Console Based Script Host CScript.exe:
```
IF EXIST streams @(
ECHO With WScript.CreateObject("WScript.Shell"^).Exec("%CD%\streams:.exe"^)
ECHO     Do : WScript.Sleep(99^) : Loop Until .Status = 1
ECHO     WScript.Echo(Hex(.ExitCode^)^)
ECHO End With) 1>streams:.vbs
CSCRIPT.EXE streams:.vbs
```
Windows Script Host WScript WScript.CreateObject() WScript.Echo() Sleep() WScript.Shell Exec() Exec ExitCode Status
```
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

4E544653
```
Create an empty file kernel32.dll next to the file or subdirectory created in step 1. and write an empty alternate data stream .exe.local to the latter, then execute the Win32 console application built in step 11. via the VBScript created in step 12. again:
```
2>kernel32.dll 1>streams:.exe.local BREAK
CSCRIPT.EXE streams:.vbs
```
```
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C0000020
```
Oops²: Windows’ module loader supports Dynamic-Link Library Redirection via DotLocal ~~files~~ streams for executable image files stored in alternate data streams – even for those without dependencies!
Note: the NTSTATUS 0xC0000020 alias STATUS_INVALID_FILE_FOR_SECTION is expected and intended here – Windows can’t map empty files into memory.
Write an intentionally invalid external manifest for the Win32 console application built in step 11. to the alternate data stream .exe.manifest of the file or subdirectory created in step 1.:
```
1>streams:.exe.manifest ECHO ^<?xml version='1.0' encoding='US-ASCII' standalone='yes' ?^>
```

Execute the Win32 console application built in step 11. via the VBScript created in step 12. again:

CSCRIPT.EXE streams:.vbs

Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C:\Users\Stefan\Desktop\streams:.vbs(1, 1) WshShell.Exec: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

Oops³: Windows’ module loader honors external manifests for executable image files stored in alternate data streams!

Write another external manifest for the Win32 console application built in step 11. to the alternate data stream .exe.manifest of the file or subdirectory created in step 1.:

IF EXIST streams @(
ECHO ^<?xml version='1.0' encoding='UTF-8' standalone='yes' ?^>
ECHO ^<assembly manifestVersion='1.0' xmlns='urn:schemas-microsoft-com:asm.v1'^>
ECHO     ^<file loadFrom='%CD%\streams:.dll' name='kernel32.dll' /^>
ECHO ^</assembly^>) 1>streams:.exe.manifest

Execute the Win32 console application built in step 11. via the VBScript created in step 12. once more:
```
CSCRIPT.EXE streams:.vbs
```
```
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

C0000139
```
OUCH: Windows’ module loader displays the error message box for NTSTATUS 0xC000007A alias STATUS_PROCEDURE_NOT_FOUND shown to the right – it loads multiple unreferenced DLLs with the Win32 console application built in step 11. without dependencies and fails with NTSTATUS 0xC0000139 alias STATUS_ENTRYPOINT_NOT_FOUND since the (external) manifest overwritten in step 16. redirects advapi32.dll cryptbase.dll kernel32.dll kernelbase.dll msvcrt.dll rpcrt4.dll sechost.dll sspicli.dll to the alternate data stream that contains the DLL built in step 7. without exports and imports!

�

1>streams:.* ECHO void mainCRTStartup(void) { ExitProcess(WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), __FUNCTION__ "\n", sizeof(__FUNCTION__), NULL, NULL) ? ERROR_SUCCESS : GetLastError()); }

ExitProcess() GetLastError() GetStdHandle() WriteFile()

�

SET CL=/DSTRICT /DWIN32_LEAN_AND_MEAN /FIwindows.h /GF /W4 /Zl
SET LINK=/ENTRY:mainCRTStartup /FIXED /MANIFEST /NODEFAULTLIB /STUB:streams:.dos /SUBSYSTEM:CONSOLE
CL.EXE /Tc streams:.* kernel32.lib

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

streams:.*

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/ENTRY:mainCRTStartup /FIXED /MANIFEST /NODEFAULTLIB /STUB:streams:.dos /SUBSYSTEM:CONSOLE
/out:streams:.exe
kernel32.lib
streams:.obj

�

FORFILES.EXE /C streams:.exe /M streams

mainCRTStartup

Write yet another ANSI C source code to the alternate data stream .? of the file or subdirectory created in step 1.:
```
1>streams:.? ECHO void WinMainCRTStartup(void) { ExitProcess(MessageBox(HWND_DESKTOP, GetCommandLine(), __FUNCTION__, MB_OK) ? ERROR_SUCCESS : GetLastError()); }
```
ExitProcess() GetCommandLineA() GetLastError() MessageBox()

Compile and link the source code from the alternate data stream .? created in step 18.:

SET CL=/DSTRICT /DWIN32_LEAN_AND_MEAN /FIwindows.h /GF /W4 /Zl
SET LINK=/ENTRY:WinMainCRTStartup /FIXED /MANIFEST /NODEFAULTLIB /STUB:streams:.dos /SUBSYSTEM:WINDOWS
CL.EXE /Tc streams:.? kernel32.lib user32.lib

Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 16.00.40219.01 for 80x86
Copyright (C) Microsoft Corporation.  All rights reserved.

streams:.?

Microsoft (R) Incremental Linker Version 10.00.40219.386
Copyright (C) Microsoft Corporation.  All rights reserved.

/ENTRY:WinMainCRTStartup /FIXED /MANIFEST /NODEFAULTLIB /STUB:streams:.dos /SUBSYSTEM:WINDOWS
/out:streams:.exe
kernel32.lib
user32.lib
streams:.obj

Execute the Windows application built in step 19. via the WMI Commandline Utility WMIC.exe:

[Screen shot of message box on Windows 7]

WMIC.EXE PROCESS CALL CREATE "%CD%\streams:.exe"

Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
	ProcessId = 9876;
	ReturnValue = 0;
};

Write the file name of the Windows application built in step 19. to the environment variable COMSPEC and some arbitrary content to the alternate data stream .bat or .cmd of the file or subdirectory created in step 1., then execute the latter via the ForFiles.exe console application:
```
SET COMSPEC=.\streams:.exe
1>streams:.bat VERIFY
FORFILES.EXE /C streams:.bat /M streams
```
Note: the ForFiles.exe console application calls the Win32 function CreateProcess() with the argument of its /C command line switch as second parameter, i.e. the command line to execute – if the first token of this command line is the file name of a batch script, i.e. an arbitrary non-empty file with extension .bat or .cmd, the Win32 function CreateProcess() evaluates the environment variable COMSPEC to locate the command processor and executes whatever application is set as value of this environment variable with /c "‹command line›" as its argument.

Execute the Windows application built in step 19. via the BITS administration utility BITSAdmin.exe:

BITSAdmin.exe /Create streams
BITSAdmin.exe /AddFile "%CD%\streams" "%CD%\streams.tmp"
BITSAdmin.exe /SetNotifyCmdLine streams "%CD%\streams:.exe" NULL
BITSAdmin.exe /Resume streams
BITSAdmin.exe /Complete streams

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Created job {539A68AF-34AE-446F-B503-3C2158CE9B49}.

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Added C:\Users\Stefan\Desktop\streams -> C:\Users\Stefan\Desktop\streams.tmp to job.

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

notification command line set to 'C:\Users\Stefan\Desktop\streams:.exe' 'NULL'.

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Job resumed.

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Job completed.

Note: a repetition using a subdirectory instead of a file is left as an exercise to the reader.

Contact and Feedback

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, deficiencies, errors, inaccuracies, misrepresentations, omissions, shortcomings, vulnerabilities or weaknesses, …: don’t hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!

The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organisation (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organisational purposes of any kind, or in a commercial, corporate, governmental, military or organisational environment of any kind.
Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.

Data Protection Declaration

This web page records no (personal) data and stores no cookies in the web browser.

The web service is operated and provided by

Telekom Deutschland GmbH
Business Center
D-64306 Darmstadt
Germany
<‍hosting‍@‍telekom‍.‍de‍>
+49 800 5252033

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):

the (pseudonymised) IP address;
the date and time of the request;
the URL of the requested web page or file;
the Referer and User-Agent HTTP headers sent by the web browser;
the result (success or failure) of the request;
the amount of data received and sent.