atoms

Overview

atoms command-line tool works with Windows global and user atom tables.

Syntax

atom <-command>

atom <-command:parameter>

Global atom table

-ga command adds a string to Windows global atom table (GlobalAddAtom).

-gd command deletes global atom (GlobalDeleteAtom).

-gf command finds a string in Windows global atom table (GlobalFindAtom).

-gq command returns global atom name (GlobalGetAtomName).

-ge command enumerates Windows global atom table strings (GlobalGetAtomName).

Global atom table (using undocumented NTDLL functions)

-na command adds a string to Windows global atom table (NtAddAtom).

-nd command deletes global atom (NtDeleteAtom).

-nf command finds a string in Windows global atom table (NtFindAtom).

-nq command queries basic information about global atom (NtQueryInformationAtom).

-ne command enumerates Windows global atom table strings (NtQueryInformationAtom).

User atom table

-ua command adds a string to Windows user atom table (RegisterClipboardFormat).

-uf command finds a string in Windows user atom table (GetClipboardFormatName).

-uq command returns user atom name (GetClipboardFormatName).

-ue command enumerates Windows user atom table strings (GetClipboardFormatName).

Options

-silent shows no error messages; please check exit code

Examples

atoms -na:vurdalakov
atoms -nd:50802
atoms -nf:vurdalakov
atoms -nq:50802
atoms -ne

Reusable classes (C#)

• AtomTable.cs - works with Windows global and user atom tables.

Keywords

C#, NtAddAtom, NtFindAtom, NtDeleteAtom, NtQueryInformationAtom, GlobalAddAtom, GlobalDeleteAtom, GlobalFindAtom, GlobalGetAtomName, GetClipboardFormatName

Links

• Atom Tables on MSDN
• Smashing The Atom: Extraordinary String-based Attacks (PPT)