old hotfix against CVE 2012-1533

'
' [*] patch javaws.exe (version 1.6.0_31 OR 1.7.0_03) against JNLP parsing 0day on Windows XP and Windows 7
' [*] by Rh0
' [*] Mar 15 2012
' [*] this blown up script has mainly the sense to change only one byte in the javaws.exe of
' [*] JRE 1.6.0_31 or 1.7.0_03
'
'     CAUTION:
'     =======
' [*] This is unofficial, use at your own risk!!
' [*] Also only one JRE should be installed when running the patch !!
' [*] Not tested with JDK versions of java !!
' [*] Be sure to make a copy of javaws.exe always before running this
'
'     INFO:
'     =====
' [*] In case of JRE 1.6 the double quote (") will be added to the list
' [*] of characters which should be escaped with a backslash (\) in the
' [*] command line of javaw.exe . In case of JRE 1.7 the tilde (~) in the list will be
' [*] replaced by a double quote as the list is already full (only one
' [*] terminating zero). So tildes in command line parameters will not be
' [*] escaped anymore.
'
' [*] Maybe UAC in windows 7 has be be disabled for this script to work


'======'
 Main()     ' Main Call
'======'



function Main()
    Doit = MsgBox("This patch will alter your javaws.exe"&chr(10)&"Continue ?",65,"JRE 1.6_31/1.7_03 JNLP 0day Patch by Rh0")
    If Doit = 2 Then
        wscript.quit
    End If

    on Error resume next
    set FSO = CreateObject("Scripting.FileSystemObject")
    set WS = CreateObject("WScript.Shell")

    offsetJRE6 = 104890 '0x199ba offset to free place of character list in javaws.exe data section (JRE 6)
    offsetJRE7 = 161494 '0x276d6 offset to tilde (~) in character list in javaws.exe data section (JRE 7)


    ' --------------------- This stuff detects the java version ---------------------------

    ' get java version family, assuming to get the right java web start by targeting the JRE registry strings
    FamilyVersion = WS.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\CurrentVersion")
    checkError Err,"Cannot read CurrentVersion of Java in registry"

    ' check the version
    JavaFamily = "None"
    If FamilyVersion ="1.6" Then
        JavaFamily = "6"
        offset = offsetJRE6
    ElseIf FamilyVersion = "1.7" Then
        JavaFamily = "7"
        offset = offsetJRE7
    end If

    ' wrong version ...
    If JavaFamily = "None" Then
        WrongVersion()
    End If

    ' get exact version
    ExactVersion = WS.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\Java"&JavaFamily&"FamilyVersion")
    checkError Err,"Cannot read Java"&JavaFamily&"FamilyVersion of Java in registry"

    If Exactversion <> "1.6.0_31" And ExactVersion <> "1.7.0_03" Then
        WrongVersion()
    End If


    ' get javaws.exe path
    JavaWS = WS.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\"&ExactVersion&"\JavaHome") &"\bin\javaws.exe"
    checkError Err,"Cannot obtain Java installation path out of registry"

    ' check if javaws.exe exists
    FSO.GetFile(JavaWS)
    checkError Err,"Cannot find javaws.exe file"

    '---------------------- End of JRE version detection ------------
    '---------------------- JavaWS should now contain the path to javaws.exe


    ' make backup
    FSO.copyFile JavaWS, JavaWS&".bak"
    checkError Err,"Cannot backup copy javaws.exe to javaws.exe.bak"

    ' open javaws.exe as stream
    set Jws = CreateObject("ADODB.Stream")
    Jws.Type = 1    ' binary
    Jws.Mode = 3    ' read/write
    Jws.Open
    Jws.LoadFromFile JavaWS
    checkError Err,"Cannot open javaws.exe"

    ' seek to position where character list is stored
    ' and add the character 0x22 (double quote) to it.
    ' The characters in this list are searched in the
    ' command line parameters in a running javaws.exe
    ' process. If they are encountered they are escaped
    ' by a \ and the whole command line parameter is
    ' enclosed inside double quotes for javaw.exe

    Jws.Position = offset ' offset to list

    ' create the double quote and copy it into javaws.exe stream
    With CreateObject("ADODB.Stream")
        .Type = 2
        .Open
        .WriteText chr(34)      ' double quote
        .Position = 2           ' stream starts here, consists only of one "
        .CopyTo JWS             ' insert it into file stream
        .Close
    End With

    ' save the modified stream as new javaws.exe
    JWS.SaveToFile JavaWS,2
    checkError Err,"Cannot write to javaws.exe, permission problem ?"
    JWS.close

    MsgBox " Patch applied successfully",64, "JRE 1.6_31/1.7_03 JNLP 0day Patch by Rh0"

End Function


Function WrongVersion()
    MsgBox " Wrong Java version, nothing to do... Exiting...", 0, "JRE 1.6_31/1.7_03 JNLP 0day Patch"
    wscript.quit
End Function

Function checkError(Err,Msg)
    If Err <> 0 Then
        MSgBox Msg,48," [!] Error "
        Err.Clear
        wscript.quit
    End If
End Function