Monday, February 14, 2022

How to fix right-to-left files - bulk command line tool

Malware writers can trick you in 2 ways into thinking your file is a "PDF looking" file using the Right-to-Left embedded characters. 

Firstly, maliciously constructed “.exe” can be built to display an PDF icon, so it looks like PDF default reader will open this file. If the filename is really long then, you can't see the extension (see image below). 

2ndly and may not be so obvious, malicious PDF filename is constructed as with a right-to-left override character is such a way that the file ends ".pdf" extension, but really is an ".exe".  


So in example below, the 2nd file looks like a ".txt" file, but is really a ".docx" file (the 1st file). The 1st file has been cleansed of the RTL Unicode character, and ends in ".docx". 

The PDF file is actually an ".exe" file, but looks like it will open with default PDF reader. 


Download RTLExample.7z ( it includes the above files with PDF ".exe" example. The files contain no viruses or malware. The PDF is safe ".exe", and just opens this page in Chrome). The "PDF" is safe ".exe", and just opens this page in Chrome. But GDrive marks these examples "Sorry, this file is infected with a virus", which good because they are detecting the RTL character and exe. But it a false positive, since there is no virus in the files. You can create you own examples by inserting the RTL character into the filename, see this video https://youtu.be/n2kV3Q2eTCY). 


Here's the same files as viewed from the command (cmd.exe) line. The box character represents the RTL character.


Note: Detection of malicious file is never done by a filename alone, so a good antivirus will flag the contents of this file, for known signatures. BUT you can remove the annoying RTL character with the free tool below! 

How is RTLO being abused by malware writers?

In apps that support Unicode like Window Explorer, the right-to-left override malware method uses  a RTL Unicode character, that will reverse the order of the characters that follow it. It's used mainly for Middle Eastern/Asian languages that you read right-to-left.

RTLO can be used to spoof fake extensions. To do this we need a hidden RTL Unicode character in the file name.

What is “Right-to-Left Override” RTLO?
The RTLO method is used to hide the true type of a file, so it might trick you into open text file (.txt) which really is a Word file (.docx) with malicious malware. More recently this file could hide a .wav file. Audio files such .wav file are being embedded with malware, is on the forefront of malware maliciousness. Read about that on my post here.
The method exploits a feature built into Windows Explorer. Since Microsoft Windows does a great job of supporting different languages from around the world, some of those languages that are written from right-to-left (RTL). 
Let’s say you want to use a right-to-left written language, like Hebrew or Arabic, on a site combined with a left-to-right written language like English or French. In this case, you would want bidirectional script support.
Bidirectional script support is the capability of a computer system to correctly display bi-directional text. In HTML we can use Unicode right-to-left marks and left-to-right marks to override the HTML bidirectional algorithm when it produces undesirable results:
left-to-right mark: ‎ (U+200E) Unicode character
right-to-left mark: ‏ (U+200F) Unicode character
How do you fix files that have the RTLO or other bad characters ? 

Here's a tool I built to clean up Right-to-Left Mark (and many others) and Unicode Control Characters from your files. It's super fast, small and written in native C++.

Updated Thu 21-Apr-22 - new build, fixed many recursive issues




Download
 touchRTL.7z (you need https://www.7-zip.org/ to unpack). For personal use only. Will open this page on each run. Copy into c:\windows to use from cmd.exe.


License : 

touchRTL.7z personal use only, for commercial use buy touchLTRPRO. Contact as validated today available for license request. 

touchRTLPRO.7z, has flags to remove Unicode spaces and punctuations (math symbols, currency, open closing braces, and accent marks).  

Just run this command and it will recursively rename filenames to remove those characters under the specified directory name. If directory name, contains spaces you need quotes.


touchRTL -v -R -l -y "directory name"

where


Usage: touchRTL [-aclmpRuvxy] [-r REFFILE | -d DATETIME] PATH...

UNIX touch mimic, updates files access, modification and creation times of file(s) in PATH to the current time,
If PATH argument does not exist, creates corresponding new empty file or directory (using -y), unless -c or --n
Supports directory recursion and time stamping!
Supports Right-to-Left (RTL) character removal for files.
PATH argument can represent a filename(s) or directory. Double quote if it contains spaces. eg "c:\as is.txt"

  -a, --access-time        change only the file access time
  -c, --no-create          do not create any new files - If the file exists, touch will update the access time,
  -l, --RTL                remove Unicode control & format characters (esp. infamous right-to-left) from filena
  -m, --modif-time         change only the file modification time
  -p, --pause-exit         pause on exit (non-GNU extra)
  -R, --recursive          recursively touch files in specified directory and all subdirectories (non-GNU extra
  -u, --unicntrl           remove Unicode control characters only - https://www.fileformat.info/info/unicode/ca
  -v, --verbose            output the result of every file processed (non-GNU extra)
  -x, --creation-time      change only the file creation time (non-GNU extra)
  -y, --directory          specify directory, instead of default file
  -r, --reference REFFILE  use this file's times instead of current time
  -s, --spaces (PRO edtn)  remove Unicode spaces from filename
  -!, --puncs  (PRO edtn)  remove Unicode punctuations & symbols (math & modifiers) from filename

  -d, --date DATETIME      use YYYY-MM-DDThh:mm:ss[.ms] instead of current time (non-GNU, does not parse string
                           accepted "2033-04-01T07:07:07", "2033-04-01 07:07:07"

  -h, --help               Display this help and exit.

      --version            Display version information and license information.

For personal use only. Commercial license required for business use and removes page open. See --version for al
Copyright © 2019-2022 M. Pahulje <metadataconsult@gmail.com> - https://http://metadataconsulting.blogspot.com/

Wednesday, February 9, 2022

Emacs - How to open a web page URL from the command line

 Here's how to open a URL in Emacs text browser called EWW from the command line: 

runemacs --eval "(eww \"https://google.ca\")"

if not in path variable
C:\Program Files\Emacs\x86_64\bin\runemacs --eval "(eww \"https://google.ca\")"
or
C:\Program Files\Emacs\x86_64\bin\emacs-27.2 --eval "(eww \"https://google.ca\")"

Here's the result 




























Now available in 1-click in my Clipboard PowerTool, handles search terms and URLs to browse in text. 

Friday, February 4, 2022

How to determine if application is 32-bit or 64-bit Windows 10+

Windows software developers denote x86 stands for 32-bit program and x64 stands 64-bit programs. The 64-bit version of the program is usually denoted by suffixing 64 or x64 with the filename — e.g., PlainTextClipbpard.exe vs. PlainTextClipbpard.exe. In some cases, the bitness notation may be missing, and you may be wondering if the executable is 32-bit or 64-bit.

To check if your current running program is 32-bit or 64-bit; 

  1. Open Task Manager and select the Details tab in Windows10+
  2. Right-click on the column header and click Select columns. The column header is the row that has the caption for each column, such as Image Name, PID, Status etc. 
  3. Enable the Platform checkbox and click OK. It will indicate if programs is 32-bit or 64-bit.
  4. Also recommend click command line to get path/location on disk to the file running exe.



To determine and individual file or dll use sigcheck from the command line; 

sigcheck c:\windows\system32\notepad.exe

returns

Sigcheck v2.82 - File version and signature viewer
Copyright (C) 2004-2021 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\system32\notepad.exe:
        Verified:       Signed
        Signing date:   12:48 AM 10-Jul-15
        Publisher:      Microsoft Windows
        Company:        Microsoft Corporation
        Description:    Notepad
        Product:        Microsoft® Windows® Operating System
        Prod version:   6.1.7601.18917
        File version:   6.1.7601.18917 (win7sp1_gdr.150709-0600)
        MachineType:    64-bit

Download for free - Sigcheck - Windows Sysinternals | Microsoft Docs

Thursday, February 3, 2022

Disable Year Month Listing efficiently for Wordpress Using .htaccess











Here's how to "disable" redirect URLs with Year/Month efficiently in WordPress using .htaccess. 

Place this at the top before # BEGIN WordPress and # BEGIN iThemes Security and other security plugins.

 
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

#redirects yoursite.com/2022/01 to new url - Wed 02-Feb-22 8:34pm metadataconsulting.ca - 
RewriteRule ^\d{4}\/\d{2}/(.*)$ https://yoursite.com/your/new/url [R=301,L]
RewriteRule ^\d{4}\/\d{2}$ https://yoursite.com/your/new/url [R=301,L]

</IfModule>