Windows 10 App Certification

Hi,

I have been using Nullsoft 2.46 for years, and have been able to work out most things by doing searches. I was trying to get my app certified for Windows 10, but I was getting the following errors.

File C:\Program Files\App\uninstall.exe has failed the DBCheck check.
File C:\Program Files\App\uninstall.exe has failed the NXCheck check.
File C:\Program Files\App\uninstall.exe has failed the SafeSEHCheck check.

I noticed in the release notes for 3.0b1:
Changed default DllCharacteristics to TS_AWARE+NO_SEH+NX_COMPAT+DYNAMIC_BASE


So I upgrade to 3.0b1 but I am still getting the error:
File C:\Program Files\App\uninstall.exe has failed the DBCheck check.


I have also tried 3.0b2 with the same result.
If anyone has any ideas on how to fix this last error, your help would be appreciated.

I assume you have seen this thread where someone was certified?

https://msdn.microsoft.com/library/w.../hh920280.aspx & https://msdn.microsoft.com/en-us/lib.../JJ657973.aspx says "This test is performed on only apps written in managed code, such as by using C# or .NET Framework" for DBCheck but who knows if this is actually true.

If you have the ability to compile NSIS then I would suggest trying to add /FIXED:NO to the linker parameters, this should ensure that the .exe has a relocations-table so the file can actually be loaded at a different address (The flag we added in beta1 is basically a lie).

Is it possible that it is complaining about a plugin and not the main exe? Could you try a simple installer that does not use any plugins nor MUI?

I'm able to run Windows App Certification Kit and get the "PASSED WITH WARNINGS" result, is this not enough?

Windows App Certification Kit - Test Results
OS Version: Microsoft Windows 10 Pro (10.0.10240.0)
Kit Version: 10.0

Overall result: PASSED WITH WARNINGS
WARNING Install signed driver and executable files
WARNING Binary analyzer ...failed the DBCheck check.

by running

"%ProgramFiles%\Windows Kits\10\App Certification Kit\appcert" reset&"%ProgramFiles%\Windows Kits\10\App Certification Kit\appcert" test -apptype desktop -setuppath %cd%\WinWACKTest.exe -setupcommandline /S -appusage permachine -reportoutputpath %cd%\WACK%random%.xml

NSI:

Name "Windows WACK Test"
RequestExecutionLevel admin
ManifestSupportedOS Win7 Win8 Win8.1 Win10
InstallDir "$ProgramFiles32\Microsoft\OldApplets"
OutFile WinWACKTest.exe

Page Directory
Page InstFiles

Section
SetShellVarContext all
SetOutPath $InstDir
!if /FileExists "$%WinDir%\SysWoW64"
!define SrcSysDir32 "$%WinDir%\SysWoW64"
!else
!define SrcSysDir32 "$%WinDir%\System32"
!endif
File "${SrcSysDir32}\Calc.exe" ; Pick something else if compiling on Windows 10
WriteRegStr SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" InstallLocation "$InstDir" ; WACK:Required
WriteRegStr SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" Publisher "Acme Corporation" ; WACK:Required
;WriteRegStr SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" DisplayVersion "1.0" ; WACK:Optional? | WACK incorrectly? calls this "ProductVersion"?
WriteRegDWORD SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" VersionMajor 1 ; WACK:Required
WriteRegDWORD SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" VersionMinor 0 ; WACK:Required
; WriteReg?MultiSZ? ... "ProductCodes" ? WACK looks for this...
WriteRegStr SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" DisplayName "$(^Name)" ; Windows&WACK:Required
WriteRegStr SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" UninstallString '"$InstDir\Uninst.exe"' ; Windows&WACK:Required
WriteRegStr SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)" QuietUninstallString '"$InstDir\Uninst.exe" /S' ; Not used by WACK?
WriteUninstaller "$InstDir\Uninst.exe"
CreateShortcut /NoWorkingDir "$SMPrograms\$(^Name).lnk" "$InstDir\Calc.exe"
SectionEnd

Section Uninstall
SetShellVarContext all
DeleteRegKey SHCtx "Software\Microsoft\Windows\CurrentVersion\Uninstall\$(^Name)"
Delete "$InstDir\Uninst.exe"
Delete "$InstDir\Calc.exe"
GetFullPathName $0 "$InstDir\.."
RMDir "$InstDir"
RMDir "$0"
Delete "$SMPrograms\$(^Name).lnk"
SectionEnd

This fails the DBCheck check but there is not much you can do about it. Adding stub_env.Append(LINKFLAGS = ['/FIXED:NO']) to the NSIS build script produces a uninstaller that passes the DBCheck check but the uninstaller does not actually work because the WriteUninstaller instruction does not handle relocations correctly.

Edit:

makensis "-X!error '${NSIS_VERSION}/${NSIS_PACKEDVERSION} PA=%PROCESSOR_ARCHITECTURE% PAW6432=%PROCESSOR_ARCHITEW6432%'"&ver
!error: v3.0b2/0x03000050 PA=x86 PAW6432=%PROCESSOR_ARCHITEW6432%

Microsoft Windows [Version 10.0.10240]

See Also:
* https://github.com/wixtoolset/issues/issues/5171
* https://social.msdn.microsoft.com/Fo...icate-kit-acks
* https://wpdev.uservoice.com/forums/1...4393-33-automa
* https://msdn.microsoft.com/en-us/lib...ersibleInstall

Thanks Anders,

I had seen the other thread you referenced, but this is just setting the bits, as with 3.0b1.

I tried building your sample project but I get a fail on the DBcheck not a warning. I could live with a warning.

I have had my app certified on Windows 7, 8, & 8.1. for both 32 and 64bit. With these I had the same issue with the DBcheck but it was just a warning, with Windows 10 I get it as a fail.

I'm trying to certify using Windows 10 64bit, looking at the path you used you had a 32bit version of Win10, maybe that is the difference or there is some other issue with my Nullsoft environment. I'm still looking into this.

Getting the Dynamic Base working correctly would be the desirable.

Thanks again
Anthony

To certify for Win10 64 bit, I thought you had to use a 64 bit installer? You can compile NSIS v3 for 64 bit but it's not officially supported yet.

Originally Posted by JasonFriday13 View Post

To certify for Win10 64 bit, I thought you had to use a 64 bit installer? You can compile NSIS v3 for 64 bit but it's not officially supported yet.

You don't need a 64bit installer to install a 64bit application, you just need to check if you are running on a 32 or 64 bit version of windows and setup the installer to use the correct registry and to place the files in the correct paths. I have been using version 2.46 to do this for over 4 years and had it Microsoft Certified.

Having a 32bit installer also allows you to give clean error messages if someone tries to install the 64bit version of your app on a 32bit OS. You can direct them to your web site to download a 32bit version.

Maybe they want you to set IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA as well on 64-bit? I don't think you are supposed to set this flag on 32-bit files but you can try by adding PEDllCharacteristics 0x0020 0 to your .nsi...

Originally Posted by Anders View Post

Maybe they want you to set IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA as well on 64-bit? I don't think you are supposed to set this flag on 32-bit files but you can try by adding PEDllCharacteristics 0x0020 0 to your .nsi...

I added "PEDllCharacteristics 0x0020 0" to your sample project but this made no difference and this is a 32 bit app installing on a 64bit OS.

I will try to setup a 32bit version of Windows 10 today and see if I get a different result.

Originally Posted by anthony.m View Post

I will try to setup a 32bit version of Windows 10 today and see if I get a different result.

The 32-bit version should not care about that flag at all but you should at least be able to pass with warnings...

Sorry for the delay in getting back, I setup a 32bit version of Windows 10 and did the Cert test and I also got a Pass with Warnings.

I then decided to build a new 64bit version of Windows 10 and did the Cert test test again and it also Passed with Warnings. All I can put this down to is some buggy MS tools that reported a fail instead of an warning. I also want back to the setup I was having issues with and recheck for updates and everything was up to date.

It would still be better if Dynamic Base was fully supported in Nullsoft so it can pass without warnings. If Microsoft tighten the requirements then we are just back here again.

I'm now building a Server 2012 R2 to see if I can get it to pass the Server Cert, I had issues with this a while back and just hadn't had time to revisit.

Thanks for your help.

DEP and ASLR is first and foremost important in programs that communicate over a network/internet (to make it harder for exploits to escape by using ROP chains etc), this is usually not a likely scenario in a uninstaller.

I doubt MS is going to make it a requirement for all applications, there are probably some old VB apps out there that they want to pass to get certified...