Skip to content
⌘ NSIS Forum Archive

In 64bit installer AccessControl fail to set registry permission

22 posts

rijukk#

In 64bit installer AccessControl fail to set registry permission

I was using NSIS AccessControl plug-in to grant registry access permission

AccessControl::GrantOnRegKey HKLM "Software\Demo" "(S-1-5-20)" "FullAccess" ;"NETWORK SERVICE"
It was working perfect, now I upgraded my installer to 64bit using "x64.nsh"'s ${RunningX64}
and SetRegView 64

Now
AccessControl::GrantOnRegKey HKLM "Software\Demo" "(S-1-5-20)" "FullAccess"
it fail to grant permission; however i create a key in redirected node (Wow6432Node) like HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Demo. It providing proper grant permission.

Any help will be greatly appreciated

Thank you,
Riju
T.Slappy#
Are you running 32bit application on x64 machine?
If yes then this situation is correct because 32bit applications use Wow6432Node in Registry.

Your assumption is wrong:
by I upgraded my installer to 64bit using "x64.nsh"'s ${RunningX64}
Creating 64bit installer is possible only by recompiling NSIS as 64bit application.
rijukk#
Hi T. Slappy,

I am upgrading the installer script with guideline provided in this link
Here are some tips for creating (32-bit) NSIS installer which installs 64-bit application on 64-bit Windows. There is no 64-bit NSIS Insta...




I am able to read\write registry from HKLM\Software\Demo after using "SetRegView 64".

; disable registry redirection (enable access to 64-bit portion of registry)
SetRegView 64
Only registry fails on
AccessControl::GrantOnRegKey HKLM "SOFTWARE\Demo" "(S-1-5-20)" "FullAccess"
my installer is working perfectly in 64bit PC without any other issues


Thank you,
Riju
Afrow UK#
AccessControl plug-in needs updating to handle SetRegView. I will do it when I have some time (maybe tomorrow).

Stu
rijukk#
What i read from internet in order to accomplish this; we need to use advapi32.dll's RegSetKeySecurity in the AccessControl plugin.
Afrow UK#
It took a little longer than expected due to SetNamedSecurityInfo/GetNamedSecurityInfo complete lack of support for KEY_WOW64_64KEY (as you pointed out) so a lot of the code had to be changed quite drastically. It may also mean the plug-in will no longer work on Windows 2000, but we may have to live with that.

v1.0.5.0 - 25th January 2012 ~ Afrow UK
  • Removed IsUserTheAdministrator.
  • Added NameToSid.
  • Major code cleanup/rewrite.
  • Proper Unicode build (with Unicode plugin API).
  • Support for 64-bit registry (SetRegView 64).
  • Functions now return "ok" on success or "error" otherwise. On "error", the next item on the stack will be the error description.
  • Added version information resource.
Edit: I removed IsUserTheAdministrator because you can quite easily test for that yourself using the new NameToSid. Just check the result of NameToSid ends with -500.

Stu
Anders#
Originally Posted by Afrow UK View Post
It may also mean the plug-in will no longer work on Windows 2000, but we may have to live with that.
IMHO the Ansi version needs to support NT4/Win95 (I don't know what the old behavior was but it can just return ok on 9x) and the unicode build 2000+ (It is unclear at this point if NT4 will be supported as unicode)
Afrow UK#
When was ConvertSidToStringSid/ConvertStringSidToSid added to Windows? The plug-in has been using those for some time. Now it's using RegOpenKeyEx as well.

Stu
Anders#
RegOpenKeyEx was added in Win95/NT4 IIRC and I don't remember off the top of my head but I'm guessing ConvertSidToStringSid was added in 2000 (You cannot trust MSDN, you must check the dll exports)
Afrow UK#
How about RegSetKeySecurity? I will look into writing replacements for ConvertSidToStringSid/ConvertStringSidToSid.

Stu
Afrow UK#
v1.0.6.0 - 26th January 2012 - Afrow UK
  • Wrote replacements for ConvertSidToStringSid/ConvertStringSidToSid for backwards compatibility with Windows NT4/ME (ANSI build only).
  • Loads RegSetKeySecurity/RegGetKeySecurity functions at run-time for backwards compatibility with Windows NT4/ME (ANSI build only).
  • Removed commented out legacy code.
Note that RegSetKeySecurity/RegGetKeySecurity is only used when SetRegView 64 is set.



Stu
MSG#
Hate to be a nagger, but... Wasn't NT4 also unicode? Not that I feel strongly about NT4 support one way or the other, but yeah.
Afrow UK#
As Anders says I don't think Unicode NSIS supports below Windows 2000 anyway so there is no point the Unicode plug-in doing so.

Edit: If someone needs the Unicode build for NT4 they can just rebuild with ACCESS_CONTROL_NT4 preprocessor directive. Otherwise the Unicode build links to the native Windows 2000+ API's to save on code size.

Stu
Anders#
I did not check out the code yet but I hope you are only going down the wow64 path on NT5.2+, I don't know what happens if you pass the WOW64 flag to older registry functions...
Afrow UK#
According to MSDN KEY_WOW64_64KEY is ignored on 32-bit Windows (and Windows 2000) so I assume that means older versions of Windows too. The registry functions are only used if SetRegView 64 is set but I suppose a test for a 64-bit OS would be good too.

Stu
kalverson#
Originally Posted by T.Slappy View Post
Are you running 32bit application on x64 machine?
If yes then this situation is correct because 32bit applications use Wow6432Node in Registry.

Your assumption is wrong:

Creating 64bit installer is possible only by recompiling NSIS as 64bit application.
Is there a NSIS 64 bit compiled engine/install available somewhere for download?