The MASM Forum

Can I get the filepath of "...\drivers\etc\hosts" without use this strange "\\127.0.0.1\c$\" thing

btw: I can upload the source code(I'm not the author, I download it in the forum plus some copy & past), but I need to delete a lot of shit comment I wrote when I learn the code.

Quote from: learn64bit on August 07, 2022, 07:43:45 PM
Can I get the filepath of "...\drivers\etc\hosts" without use this strange "\\127.0.0.1\c$\" thing

What about posting your source???

include \masm32\MasmBasic\MasmBasic.inc         ; download (http://masm32.com/board/index.php?topic=94.0)
  Init
  GetFiles (https://www.jj2007.eu/MasmBasicQuickReference.htm#Mb1056) C:\Windows\System32\drivers\etc\*
  For_ ecx=0 To eax-1           ; print the results
       PrintLine Str$(GfSize(ecx)), Tb$, GfDate$(ecx), Spc2$, GfTime$(ecx), Tb$, Files$(ecx)
  Next
EndOfCode

1615    08.03.2020  06:07:34    C:\Windows\System32\drivers\etc\hosts
3683    10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\lmhosts.sam
407     10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\networks
1358    10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\protocol
17463   10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\services

Oh.
btw: source added on top post.

That's got to be some of the most unreadable damn assembler source I've ever seen.

Quote from: NoCforMe on August 08, 2022, 05:08:24 AM
That's got to be some of the most unreadable damn assembler source I've ever seen.

Impressing indeed :biggrin:

So, learn64bit, what exactly is your problem? Both sources assemble "out of the box", no problem at all, and work fine...

damn...

Ok, Problem is strange as below:

I think this "C:\Windows\System32\drivers\etc" folder is special.

My Windows 7 64-bit with SP1

Browse button -> drivers -> can not see "etc" folder.

Manually input "C:\Windows\System32\drivers", no "etc" in result.txt at all!

This "C:\Windows\System32\drivers\etc" is fine, but I don't want this, I want "C:\" or "C:\Windows\System32\drivers".


Your code is same problem:
Change "C:\Windows\System32\drivers\etc\*" to "C:\Windows\System32\drivers\*", no "etc" folder!

Wooo, MasmBasic looks amazing!

Same result here, I guess (Win7-64). Scan of c:\windows\system32\drivers:

c:\windows\system32\drivers\en-US\bfe.dll.mui
c:\windows\system32\drivers\en-US\ndiscap.sys.mui
c:\windows\system32\drivers\en-US\pacer.sys.mui
c:\windows\system32\drivers\en-US\qwavedrv.sys.mui
c:\windows\system32\drivers\en-US\scfilter.sys.mui
c:\windows\system32\drivers\en-US\tcpip.sys.mui
c:\windows\system32\drivers\gm.dls
c:\windows\system32\drivers\gmreadme.txt
c:\windows\system32\drivers\wimmount.sys

Maybe we're being "protected" from seeing "sacred" operating-system files?

Quote from: learn64bit on August 08, 2022, 05:46:17 AMYour code is same problem:
Change "C:\Windows\System32\drivers\etc\*" to "C:\Windows\System32\drivers\*", no "etc" folder!

include \masm32\MasmBasic\MasmBasic.inc
  Init
  GetFiles C:\Windows\System32\drivers\*
  For_ ecx=0 To eax-1           ; print the results
       PrintLine Str$(GfSize(ecx)), Tb$, GfDate$(ecx), Spc2$, GfTime$(ecx), Tb$, Files$(ecx)
  Next
EndOfCode

1615    08.03.2020  06:07:34    C:\Windows\System32\drivers\etc\hosts
3683    10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\lmhosts.sam
407     10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\networks
1358    10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\protocol
17463   10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\services
30720   16.01.2012  18:58:37    C:\Windows\System32\drivers\it-IT\bfe.dll.mui
6144    16.01.2012  18:58:28    C:\Windows\System32\drivers\it-IT\ndiscap.sys.mui
16384   16.01.2012  18:58:37    C:\Windows\System32\drivers\it-IT\pacer.sys.mui
... (many more)

So etc is clearly there on my Win7-64 machine. Have you checked the folder properties? Mine is read-only but not hidden. I tried to hide etc, Windows asks me to become administrator for doing that but surprise, surprise, even an admin cannot hide etc :cool:

Slightly different test (note the quotes):

include \masm32\MasmBasic\MasmBasic.inc
  Init
  Cls 5
  GetFolders "C:\Windows\System32\drivers"
  For_ ecx=0 To eax-1           ; print the results
       PrintLine Str$(GfSize(ecx)), Tb$, GfDate$(ecx), Spc2$, GfTime$(ecx), Tb$, Files$(ecx)
  Next
EndOfCode

0       01.06.2015  12:43:18    C:\Windows\System32\drivers\etc
0       16.01.2012  18:59:26    C:\Windows\System32\drivers\it-IT
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\2003_amd64
... (some more)

QuoteWooo, MasmBasic looks amazing!

Thanks :biggrin:

Your program will show files in c:\windows\system32\drivers\etc:

C:\Windows\System32\drivers\etc\hosts
C:\Windows\System32\drivers\etc\lmhosts.sam
C:\Windows\System32\drivers\etc\networks
C:\Windows\System32\drivers\etc\protocol
C:\Windows\System32\drivers\etc\services

but you can't navigate to it by browsing. Weird ...
So what is it about that folder that's so special? As JJ said, it's read-only, but so are all the folders below c:\windows. If you look at the folder's properties, nothing seems different from any other folder in that branch of the tree.

Try Explorer, logged in as administrator...

I'm logged in as me (who's been crowned with administrator rights), and I can see all kinds of stuff there w/Explorer. So what does he know that we don't? Probably using some fancy Shell stuff ...

If OP want to see real C:\windows\system32\drivers filelist with 32-bit program in x64 system

https://docs.microsoft.com/en-us/windows/win32/winprog64/file-system-redirector

jj,

win7sp1 64
login as Non administrator

D:\>jj.exe





D:\>_

It looks empty!

###################################################


TimoVJL,

Thanks.

Looks like Microsoft make it far more complicated.

Use "C:\Windows\System32", you get fake(redirected) one.
Use "\\127.0.0.1\C$\Windows\System32", you get real(Non redirected) one.

Win64 is simple. Okay...

Quote from: learn64bit on August 08, 2022, 04:29:34 PM
jj,

win7sp1 64
login as Non administrator

D:\>jj.exe


D:\>_

It looks empty!

???

QuoteUse "C:\Windows\System32", you get fake(redirected) one.
Use "\\127.0.0.1\C$\Windows\System32", you get real(Non redirected) one.

Win7-64:

include \masm32\MasmBasic\MasmBasic.inc
  Init
  Cls 5
  GetFiles \\127.0.0.1\C$\Windows\System32\drivers\etc\*        ; long form
  For_ ecx=0 To eax-1           ; print the results
       PrintLine Str$(GfSize(ecx)), Tb$, GfDate$(ecx), Spc2$, GfTime$(ecx), Tb$, Files$(ecx)
  Next
  Print
  GetFiles C:\Windows\System32\drivers\etc\*                    ; short form
  For_ ecx=0 To eax-1           ; print the results
       PrintLine Str$(GfSize(ecx)), Tb$, GfDate$(ecx), Spc2$, GfTime$(ecx), Tb$, Files$(ecx)
  Next
EndOfCode

1615    08.03.2020  06:07:34    \\127.0.0.1\C$\Windows\System32\drivers\etc\hosts
3683    10.06.2009  23:00:26    \\127.0.0.1\C$\Windows\System32\drivers\etc\lmhosts.sam
407     10.06.2009  23:00:26    \\127.0.0.1\C$\Windows\System32\drivers\etc\networks
1358    10.06.2009  23:00:26    \\127.0.0.1\C$\Windows\System32\drivers\etc\protocol
17463   10.06.2009  23:00:26    \\127.0.0.1\C$\Windows\System32\drivers\etc\services

1615    08.03.2020  06:07:34    C:\Windows\System32\drivers\etc\hosts
3683    10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\lmhosts.sam
407     10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\networks
1358    10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\protocol
17463   10.06.2009  23:00:26    C:\Windows\System32\drivers\etc\services

Interesting: my own file-finder, FindIt!.exe, will find all the files in c:\windows\system32\drivers with that special string, but it won't recurse into any of the sub-folders like etc:

C:\Windows\sysnative\drivers\etc
C:\Windows\sysnative\drivers\etc\hosts
C:\Windows\sysnative\drivers\etc\lmhosts.sam
C:\Windows\sysnative\drivers\etc\networks
C:\Windows\sysnative\drivers\etc\protocol
C:\Windows\sysnative\drivers\etc\services

So where does "\sysnative\" come from?

And yes, that works too. I have no idea why, though:

https://docs.microsoft.com/en-us/windows/win32/winprog64/file-system-redirector

Quote32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access. This mechanism is flexible and easy to use, therefore, it is the recommended mechanism to bypass file system redirection. Note that 64-bit applications cannot use the Sysnative alias as it is a virtual directory not a real one.

Thank you for that clarification.

Question, though: The folder "etc" is still not found by using this alias. (However, the program will find files in this folder if you explicitly search C:\windows\system32\drivers\etc.) Why is this? What's so special about this folder?

(BTW, my code uses the legacy functions FindFirstFile() and FindNextFile().)

=========================================================
Editorializing:

At the rate things are going, I predict that within a couple years everything in Windoze will be "virtualized" to the point that nothing will be identifiable as a file or folder: everything will simply be part of some huge "class" of "objects", accessible only by C++ "methods".

Sort of the OS version of "you won't own anything"?

Strange, my 32-bit proggie finds all folders on Win7-64 :cool:

0       01.06.2015  12:43:18    C:\Windows\System32\drivers\etc
0       16.01.2012  18:59:26    C:\Windows\System32\drivers\it-IT
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\2003_amd64
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\2003_ia64
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\2003_x86
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\Vista_amd64
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\Vista_ia64
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\Vista_x86
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\w2k_x86
0       14.10.2011  05:50:07    C:\Windows\System32\drivers\nti\Xp_x86
0       16.01.2012  19:02:02    C:\Windows\System32\drivers\UMDF
0       16.01.2012  18:59:26    C:\Windows\System32\drivers\UMDF\it-IT

JJ, one request: could you please not post .asc files for those of us here who don't use whatever editor uses those files? I use Notepad, and in any case only deal with ANSI-type files, as I'm guessing do a lot of others here.

Quote from: NoCforMe on August 09, 2022, 06:59:40 AM
JJ, one request: could you please not post .asc files...

Nah, it's his way of trying to convert users here to use his MasmBasic.
I generally ignore anything posted with

"include  \masm32\MasmBasic\MasmBasic.inc.   download" and believe such things don't belong here in the Campus anyway. But hutch apparently allows it, although mixing MasmBasic and Masm32 sources here would confuse newbies.

Yesh, it does seem like some underhanded proselytizing on his part on behalf of MasmBasic. But I like JJ, and MB's pretty kewl (even though I haven't touched it yet), so I let all that slide ...

Quote from: NoCforMe on August 09, 2022, 06:59:40 AM
JJ, one request: could you please not post .asc files for those of us here who don't use whatever editor uses those files? I use Notepad, and in any case only deal with ANSI-type files, as I'm guessing do a lot of others here.

The *.asc files open fine in MS Word, Wordpad, LibreOffice and others, but ok, I will try to attach also the plain asm versions from now on :cool:

Btw I had forgotten that we are in The Campus here. This is definitely not n00b stuff any more, maybe the thread could be moved to The Workshop.

As to proselytizing: my proggies find the etc folders, yours don't. Why? That's an interesting question. Either it's my machine, or it's my code that is different. Has anybody tried to run the exe that I posted above, and with which result?

I totally believe that your code works (you posted the output) and was curious to see how that was accomplished, hence the non-.asc request. An interesting question, indeed.

After running it, I can see that it has the same problem as my FindIt! program: it doesn't find \etc at all. Shows everything else, though. So my system?

Its basically the case that JJ's masmbasic is a derivation of MASM so its a rough fit here but the problem I agree with is files that require word processors to read it. This is like posting source that you have to use Photoshop to open where code historically and currently uses single byte characters sets that open correctly in any plain text editor.

The other problem is that masmbasic is closed source and its use in postings will be seen by many as advertising rather than posting source code. I try in this world to keep everybody happy and to this extent, JJ has a dedicated forum for masmbasic where most of this stuff should and up as mixing masm code and a derivation like masmbasic is confusing for people who come to the masm forum for masm code.

Quote from: NoCforMe on August 09, 2022, 07:41:50 AMI can see that it has the same problem as my FindIt! program: it doesn't find \etc at all. Shows everything else, though. So my system?

This was my suspicion, too, because under the hood I use the same standard FindFirstFile* calls.

Now I've opened my brand new Win10 machine (which I avoid, I hate Win10), and surprise, surprise, it can't find the etc folder, but it does find the files inside that folder :cool:

@Hutch: ok, will try to reduce MB. But looking through my recent posts you'll find a lot of plain Masm32 SDK stuff, too. Even Masm64 ;-)

FindfileMB.exe find these folders:
0 14.07.2009  08:37:46 C:\Windows\System32\drivers\en-US
0 14.07.2009  08:37:46 C:\Windows\System32\drivers\UMDF
0 14.07.2009  08:37:46 C:\Windows\System32\drivers\UMDF\en-US
Just check what you really have in C:\Windows\SysWOW64\drivers folder.

Hutch, did you remove the post I made suggesting (suggesting, not demanding) that JJ not post MasmBasic stuff in this forum?

If so, why? Please explain.

Yes, and No.

You assume you are in a position to determine policy here, you are not.

Look, all I did was make a suggestion. Are you so thin-skinned that nobody may even make a suggestion here? Do you know the difference between a suggestion and a demand? My suggestion was made politely. If everyone chooses to not follow it, fine. I really don't understand your problem here.

David,

You need to grasp that I have to manage a balancing act here to try and keep everybody happy and it does not happen via anyone who wants to tell other people how they should act. As a matter of fact, I am not thin skinned, I put up with a mountain of chyte on a regular basis from people who think they are in a position to dictate to others. This discourse is heading for the scrap heap and to keep the peace and balance between members, it will stay that way.

Well, I still think it was a good suggestion; people who object to JJ's posting MasmBasic would have nothing more to complain about, no n00bs would be confused, and JJ would still post MasmBasic stuff elsewhere. (I have no objections to MasmBasic myself, btw: I think it's a great tool. Just not for me.)

Anyhow. Back to this strange file-system stuff ...

Let's calm down a bit, we are a few exotic animals in the programming world, and it makes no sense to fight among us.

I will keep MasmBasic out of the Campus, and reduce it elsewhere. Sometimes I just don't find the energy to cook up a pure Masm32 SDK example for explaining simple stuff, so bear with me... it's old age.

For those who find it difficult to open *.asc files, here is a tiny rtf reader (http://masm32.com/board/index.php?topic=10254.0). Guess what? There is even the complete source, in plain ASM, and it's the purest Masm32 SDK code you can imagine. The executable is 7,168 bytes.