|
Sync
|
|
Hits: 5 |
|
Date added: 03/01/2005 |
|
UNIX provides a standard utility called Sync, which can be used to direct the operating system to flush all file system data to disk in order to insure that it is stable and won't be lost in case of a system failure. Otherwise, any modified data present in the cache would be lost. Here is a an equivalent that I wrote, called Sync, that works on all versions of Windows. Use it whenever you want to know that modified file data is safely stored on your hard drives. Unfortunately, Sync requires administrative privileges to run. This version also lets you flush removable drives such as ZIP drives.
Usage: sync [-r] [-e] [drive letter list]
-r Flush removable drives.
-e Ejects removable drives.
Specifying specific drives (e.g. c e ) will result in Sync only flushing those drives. |
|
|
|
|
|
|
Strings
|
|
Hits: 5 |
|
Date added: 03/01/2005 |
|
Working on NT and Win2K means that executables and object files will many times have embedded UNICODE strings that you cannot easily see with a standard ASCII strings or grep programs. So we decided to roll our own. Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters. Note that it works under Windows 95 as well.
Usage: strings [-s] [-a] [-u] [-n X] <file or directory>
Strings takes wild-card expressions for file names, and additional command line parameters are defined as follows:
-s Recurse subdirectories.
-a Scan for ASCII only
-u Scan for UNICODE only
-n X Strings must be a minimum of X characters in length.
To search one or more files for the presence of a particular string using strings use a command like this:
strings * | findstr /i TextToSearchFor |
|
|
|
|
|
|
Streams
|
|
Hits: 3 |
|
Date added: 03/01/2005 |
|
The NTFS file system provides applications the ability to create alternate data streams of information. By default, all data is stored in a file's main unnamed data stream, but by using the syntax file:stream , you are able to read and write to alternates. Not all applications are written to access alternate streams, but you can demonstrate streams very simply. First, change to a directory on a NTFS drive from within a command prompt. Next, type echo hello > test:stream . You've just created a stream named 'stream' that is associated with the file 'test'. Note that when you look at the size of test it is reported as 0, and the file looks empty when opened in any text editor. To see your stream enter more < test:stream (the type command doesn't accept stream syntax so you have to use more).
NT does not come with any tools that let you see which NTFS files have streams associated with them, so I've written one myself. Streams will examine the files and directories (note that directories can also have alternate data streams) you specify and inform you of the name and sizes of any named streams it encounters within those files. Streams makes use of an undocumented native function for retrieving file stream information. Full source code is included.
Usage: streams [-s] [-d] <file or directory>
-s Recurse subdirectories.
-d Delete streams.
Streams takes wildcards e.g. 'streams *.txt'. |
|
|
|
|
|
Stealth LKM
|
|
Hits: 4 |
|
Date added: 09/21/2007 |
|
Linux 2.2.x kernel module which discards packets that many OS detection tools use to query the TCP/IP stack. Includes logging of the dropped query packets and packets with bogus flags. |
|
|
|
|
|
|
Statocrypt v0.8
|
|
Hits: 5 |
|
Date added: 12/23/2006 |
|
A shell extension for Windows (2000/XP) which displays a little lock icon in the bottom left corner of the icon for files which are encrypted with NTFS EFS encryption.
* Requires Windows 2000 or higher
* On Win XP displays icon in the folder tree of Explorer for encrypted folders.
Install:
Download the dll and run the following command from your run prompt, replacing the path stuff with the actual path to where you put the dll file:
regsvr32 c:path odllstatocrypt.dll |
|
|
|
