How can I find out if an .EXE has Command-Line Options?

Question

Suppose you have an .EXE and you want to check if it has Command-Line Options. How can one know if the .EXE has this ability. In my case I know that Nir Sofers WebBrowserPassView.exe has the ability to start it via cmd.exe and WebBrowserPassView.exe /stext output.txt. But how can I find out if I don't know?

Solution 1

The easiest way would be to use use ProcessExplorer but it would still require some searching.

Make sure your exe is running and open ProcessExplorer. In ProcessExplorer find the name of your binary file and double click it to show properties. Click the Strings tab. Search down the list of string found in the binary file. Most strings will be garbage so they can be ignored. Search for anything that might possibly resemble a command line switch. Test this switch from the command line and see if it does anything.

Note that it might be your binary simply has no command line switches.

For reference here is the above steps applied to the Chrome executable. The command line switches accepted by Chrome can be seen in the list:

Solution 2

Invoke it from the shell, with an argument like /? or --help. Those are the usual help switches.

Solution 3

Sysinternals has another tool you could use, Strings.exe

Example:

strings.exe c:\windows\system32\wuauclt.exe > %temp%\wuauclt_strings.txt && %temp%\wuauclt_strings.txt

Solution 4

Just use IDA PRO (https://www.hex-rays.com/products/ida/index.shtml) to disassemble the file, and search for some known command line option (using Search...Text) - in that section you will then typically see all the command line options - for the program (LIB2NIST.exe) in the screenshot below, for example, it shows a documented command line option (/COM2TAG) but also some undocumented ones, like /L. Hope this helps?

Solution 5

Really this is an extension to Marcin's answer.

But you could also try passing "rubbish" arguments to see if you get any errors back. Getting any response from the executable directly in the shell will mean that it is likely looking at the arguments you're passing, with an error response being close to a guarantee that it is.

Failing that you might have to directly ask the publishers/creators/owners... sniffing the binaries yourself just seems like far too much work for an end-user.

View more solutions

Comments

[JohnnyFromBF]

They do not help, since the .exe just starts, with no further output.

[JohnnyFromBF]

Yeah well but there must be a possibility to debug this via RE or some other techniques.

[yas4891]

@Ian you are of course free to debug your way through the app and look for switches.

[Michael Nelson]

This was extremely helpful with finding out the switches for MalwareBytes. To expedite your search, most program switches start with a "/" or "-" so using the find dialog (lower right of image above) with these characters may help you find what you are looking for quicker.

[John Suit]

What sort of features does the "Find" in this Process Explorer properties panel support? RegEx? Wildcards? I can't seem to figure it out at first glance.

[Adam]

@JohnSuit, Only basic search I'm afraid but you may notice the "Save" button which lets you export the list to a .txt file. You can open this document with any text editor that supports RegEx, Wildcards etc and search that way.

[Burt_Harris]

Thanks @user8027324. I've added some formatting to your answer. Strings.exe isn't exactly a foolproof way to do this, but I've certainly used it for that purpose before.

[Coldblackice]

This is a great idea to feed garbage as a parameter to see how the program responds.

[Nuno André]

Strings output is also included in ProcessExplorer, in the Strings tab of process Properties.

[Sarker]

Go to 'Image tab' (the left most) you will find the command line agruments in the the text box under 'Command Line'. I am using Process Explorer v16.43