A source for many batch-file tricks: ghidra/launch.bat at master · NationalSecurityAgency/ghidra
Posted by jpluimers on 2026/05/20
If you want to improve your batchfile-fu, this might be your start: [Wayback/Archive] ghidra/launch.bat at master · NationalSecurityAgency/ghidra
After a quick look, I already recognised these tricks:
^<%%#%~set "SUPPORT_DIR=%SUPPORT_DIR:~0,-1%""%SUPPORT_DIR:!=%"=="%SUPPORT_DIR%"set /A INDEX=!INDEX!+1if %INDEX% geq 6 goto continue1java -version >nul 2>nulfor /f "delims=*" %%i in%SystemRoot%\System32\timeout.exe /NOBREAK 1 > NULexit /B %ERRORLEVEL%^(
Via:
- [Wayback/Archive] SwiftOnSecurity on Twitter: “The is the ideal Windows batch script. You may not like it, but this is what peak performance looks like.”
Broken WMI. It’s pretty extreme but it’s deployed at scale if the issue is detected.
- [Wayback/Archive] Malwrologist on Twitter: “@JohnLaTwC @danielhbohannon @RGB_Lights timeout is used commonly in malicious batch scripts”
- [Wayback/Archive] John Lambert on Twitter: “I wonder if the use of # as a variable name (in
%%#) instead ofa–zis a TTP. So much expertise to signature. Time for #Yara rule retrohunt!”
Swift quoted this source code via [Wayback/Archive] Google Lens OCR:
[Wayback/Archive] Batch file from https://twitter.com/SwiftOnSecurity/status/1644002540810280964 (hope there are no typos)
–jeroen
https://gist.github.com/jpluimers/fa7ad4154e6af2859b006a5f67cbdb16
The Wiert Corner - irregular stream of stuff 
Leave a comment