.BAT works in TCC-RT 25, but not in TCC-RT 26

[Joe Caverly]

I have the following .BAT file;

@setlocal
@echo off
set "beginJS=mshta "javascript:close(new ActiveXObject('Scripting.FileSystemObject').GetStandardStream(1).Write("
set "endJS=));""
for /f %%N in (
  '%beginJS% \u0047etObject('winmgmts:').ExecQuery('Select * from Win32_PerfFormattedData_PerfOS_Memory').ItemIndex(0).AvailableBytes %endJS%'
) do set free_mem=%%N
echo free_mem=%free_mem%
endlocal

The above runs and returns the correct results in CMD and PowerShell, and TCC-RT 25;

e:\utils>"C:\Program Files\JPSoft\TCC_RT_25\tcc.exe" /q "E:\Utils\testhta.bat"
free_mem=130199814144

Version TCC-RT 25.00.27 x64

However, it does not return the correct results in TCC-RT 26;

e:\utils>"C:\Program Files\JPSoft\TCC_RT_26\tcc.exe" /q "E:\Utils\testhta.bat"
free_mem=

e:\utils>"C:\Program Files\JPSoft\TCC_RT_26\tcc.exe" /q "e:\utils\whatver.btm"
     _x64: 1
   _admin: 1
_elevated: 1

TCC-RT  26.01.35 x64   Windows 10 [Version 10.0.18362.720]
BuildNumber  Caption                   CSDVersion  OSArchitecture  Version
18362        Microsoft Windows 10 Pro              64-bit          10.0.18362

Joe

 

[vefatica]

Here, that batfile works only in CMD (failing in TCC 24, 25, and 26, and in PowerShell).

If I put the "FOR ... IN ( ... ) DO ... " statement all on one line it also fails in CMD (no output at all).

HeeHee!! When I changed "\u0047" to "G" and tried running it in TC24 I got this.

 

[Joe Caverly]

Yes, mshta.exe worked fine in Windows 7 and earlier versions of Windows 10, but it is frequently detected now as a virus (false-positive) by several anti-virus programs.

It still works fine (no virus alert) on my system for some things;

mshta.exe "javascript:clipboardData.setData('text','Joe');close()"

mshta.exe vbscript:Execute("msgbox ""message"",0,""title"":close")

mshta javascript:alert("Message\n\nMultiple\nLines\nIn\nThis\nDialog\!");close();

Joe

 

[vefatica]

That security alert gives a hint about what's happening. TCC24 apparently stops parsing FOR's set at the single quote following "winmgmts".

 

[rconn]

That batch file doesn't work in any version of TCC.

The problem is the multiple nested ( and ) and ' characters are confusing the FOR parser. I might have a fix, but I'm going to need to test it for a bit to make sure it doesn't break existing behavior.