AaronLS
14th April 2008 21:30 UTC
Integrity Level(IL) and Vista
During my install, I extract two exe's to the temp directory and run one asynchronously, and then execute the second with ExecWait. The job of the first Exe(an AutoIt exe) is to silently wait for a dialog to appear and click its Yes button. The second exe will sometimes prompt the user with this dialog, and I am automating the process of clicking the button.
All works fine on WinXP.
On Vista, the first exe fails to click the button. I have also tried right clicking the installer Exe and using "run as administrator", but the AutoIt exe still fails to do its job.
However, when the second exe pauses while it's model dialog box is up, waiting for user to click a button, if I right click the AutoIt Exe and click Run as Administrator, it works fine, which seems to indicate that if the AutoIt exe is run as administrator then it will succeed on Vista.
So what I don't understand is, when I run my installer as Administrator, why doesn't the Exec instruction also run the AutoIt exe as administrator?
Or it might have something to do with the Integrity Level:
http://msdn2.microsoft.com/en-us/library/ms644950(VS.85).aspx
From reading about UIPI(http://en.wikipedia.org/wiki/User_In...lege_Isolation) it sounds like this is a likely problem given the methods AutoIt uses. So the solution I would guess is to make sure the two execs, the AutoIt and then the second one that had a dialog, both run at the same Integrity Level. Which I believe is not necessarily the same as running as administrator, although maybe it is a side effect. I'm not sure how to set the integrity level though. The UAC plugin doesn't seem to make mention of this.
Any suggestions appreciated. I will experiment with UAC plugin in the meanwhile. Thanks.
Anders
14th April 2008 21:47 UTC
If the button you want to click is in a dialog on the secure desktop, there is no way to click it
It might help to set uiAccess = true in the autoit exe's manifest, but for that to work, the exe needs to be signed
It helps if you can tell me what dialog you want to click yes in (UAC, unsigned driver, etc.)
AaronLS
14th April 2008 21:52 UTC
If that is true, how does the AutoIt exe succeed in clicking the button when I right click it and select "run as adminstrator"?
I'm not understanding something here.
AaronLS
14th April 2008 22:02 UTC
Originally posted by Anders
If the button you want to click is in a dialog on the secure desktop, there is no way to click it
It might help to set uiAccess = true in the autoit exe's manifest, but for that to work, the exe needs to be signed
It helps if you can tell me what dialog you want to click yes in (UAC, unsigned driver, etc.)
Sorry, didn't see your last 2 sentences when I posted. The dialog is not part of any kind of UAC or WHQL certification kind of stuff. Just a simple yes/no dialog:
; >>>> Window <<<<
; Title: WARNING!
; Class: #32770
; Position: 533, 394
; Size: 546, 119
; Style: 0x94C801C5
; ExStyle: 0x00010101
; Handle: 0x000F0E9E
; >>>> Control <<<<
; Class: Static
; Instance: 2
; ClassnameNN: Static2
; ID: 65535
; Text: A backup of data.mdb already exists in C:\Program Files\Data\Backup. Overwrite with new backup?
; Position: 62, 20
; Size: 473, 15
; ControlClick Coords: 172, 7
; Style: 0x50022080
; ExStyle: 0x00000004
; Handle: 0x00150E4A
; >>>> Control <<<<
; Class: Button
; Instance: 1
; ClassnameNN: Button1
; ID: 6
; Text: &Yes
; Position: 192, 60
; Size: 75, 23
; ControlClick Coords: 41, 6
; Style: 0x50030000
; ExStyle: 0x00000004
; Handle: 0x00160E4C
That is the info for the relevant controls. The dialog is part of the second exe. It's not any kind of special dialog spawned by some window's component. So if my thinking was if I can get the AutoIt exe to run at the same or higher integrity level than the second exe, then the AutoIt should be able to send messages to the second exe.
I think the reason it works standalone is because Run as Administrator also imparts one of the higher integrity levels. I kind of thought any processes spawned from the installer process would automatically Run as adminsitrator, since I ran the installer using "run as administrator".
AaronLS
15th April 2008 21:04 UTC
As it turns out, the AutoIt exe's manifest has "asInvoker" setting which means it runs at the same level as the process that creates it. So it has no problems sending ControlClicks or messages to other threads spawned by the isntaller.
The reason the AutoIt exe wasn't working from the installer on Vista, but did work when run standalone, was that the message box contained a path in it's text, which the AutoIt script used as a way to find the dialog. It just coincidentally happened that my test on Vista was also a test to a non-default install location, which meant that it couldn't find the dialog(this is why you only change one variable at a time in experiments ;). So the bug had nothing to do with Vista. The script I ran standalone had been edited in my efforts to find a solution, and worked when run as admin, as the result of not including that extra criteria, but did not work when not run as admin due to UIPI. So that completely mislead me, because then I assumed the one from the isntaller wasn't being run as admin, when it actually was just a buggy AutoIt script.
I realized I screwed up big time by hard coding the dialog text into the AutoIt script. Bad Aaron, BAD!
After I changed my AutoIt Exe to only match part of the dialog text(leaving off the directory path), and I recompiled it into my NSIS installer, all works well.
I just wanted to post this so that no one with a similar issue finds it and is mislead by my previous posts.