wasnt nate

Evil U+202E Sourcery for Hiding Extensions

March 15, 2012 nateb Reverse Engineering, Technology, Testing, 47

I found an interesting video on youtube, which shows a trick to hide file extensions. Please watch the 45 second video before continuing on.

There were two points of the video that were interesting, one the picking of this magic character and that afterward I needed to type things backward?

It turns out that the reason this works is because U+202E is a special character, reservered for specifying right to left operations. From doing a little searching there are other control characters which can be used for switching location and declaring annotations between spaces.

Here is a small snippet that demos the issue, stolen from VX Heaven post-

wchar_t wszFileName[] = {
        'H', 'a', 'i', 0x202E, 't', 'x', 't', '.', 'e', 'x', 'e', 0
    };

    CloseHandle(CreateFileW(wszFileName, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL));

 

47 Responses to “Evil U+202E Sourcery for Hiding Extensions”

Leave a Reply

Recent Posts

Categories

Meta