in cmd.exe, search for the hex string "68 7B 23 00 00"
.text:4AD1B2F9 83 3D C4 CA D2 4A+ cmp dword_4AD2CAC4, 0 .text:4AD1B300 74 34 jz short loc_4AD1B336 ...... fill this with NOPS ( byte value 0x90 ): .text:4AD1B302 68 28 23 00 00 push 2328h ; "NY" .text:4AD1B307 68 7B 23 00 00 push 237Bh ; "Terminate batch job (Y/N)? " .text:4AD1B30C 6A 00 push 0 .text:4AD1B30E E8 2D 03 00 00 call sub_4AD1B640 .text:4AD1B313 83 F8 01 cmp eax, 1 .text:4AD1B316 0F 85 11 7B FE FF jnz sub_4AD02E2D ...... .text:4AD1B31C 56 push esi .text:4AD1B31D 8B 35 C4 CA D2 4A mov esi, dword_4AD2CAC4 .text:4AD1B323 EB 0C jmp short loc_4AD1B331the offsets displayed here are dependend on the exact os version, this is winxp.
You may have some trouble replacing cmd.exe because of the "Windows File Protection". What I do, is put it in a different location, and put that in my COMSPEC environment variable.
ExpandAndApplyToFS, at offset 110FEh, where ctrl-c is checked, i added a jump to my patch. the patch itself is located at the end of the import descriptors, where there were a few bytes unused still.
assemble the following piece of assembly code using Microsoft Macro assembler ( ml.exe ), then use a hexeditor to copy over the bytes from the resulting .obj, and patch them back into cmd.exe
; this changes cmd.exe, such that filename completion no longer
; checks the old dos filenames.
; such that when a dir contains '.config' and 'config.h'
; trying to complete 'con' will not result in .config
; these are the actual patches:
; 4AD110FE
;000104FE:E9,BD,F4,00,00
; 4AD205C0
;0001f9c0:8b,85,dc,fd,ff,ff,8b,08,8d,57,30,66,8b,01,66,83,f8,2a,0f,84,32,0b,ff,ff,66,83,f8,00,0f,84,28,0b,ff,ff,66,33,02,66,83,e0,df,0f,85,d6,0b,ff,ff,83,c2,02,83,c1,02,eb,d4
; fileofs 000001d8 .text(vsize) := 0001f600
.586
.model flat
.code
org 110FEh
patch_location:
jmp my_patch
org 111C5h
try_next:
org 1110Ah
continue:
org 205c0h
; eax = free to use
; ebx == 0
; ecx = free to use
; edx = free to use
; esi = ptr to list object
; edi = ptr to listitem
my_patch:
mov eax, [ebp-224h] ; p_wildcard
mov ecx, [eax]
lea edx, [edi+30h] ; +struct_listitem.fd.cFilename
@@loop:
mov ax, word ptr [ecx]
cmp ax, '*'
jz continue
cmp ax, 0
jz continue
xor ax, word ptr [edx]
and ax, not 20h
jnz try_next
add edx, 2
add ecx, 2
jmp @@loop
end