Vista Compatibility Team Blog

Moved

2008-06-19T01:50:00Z

As you might have noticed from the silence, we have moved on. Here are blogs for Vineet, Patrick, Yves and Maarten. We're working on OEM Ready lately and have our hands full.

For the original Vista AppCompat issues, you can keep going to Chris' blog.

Folding shirts

2007-06-07T23:57:16Z

One of the nice things of being off-site with colleagues is that you learn interesting life enhancing tricks. Vishal taught me the Ninja t-shirt technique. I will never fold a t-shirt the same way again.

Maarten

Let us Test and Debug Your Application

2007-06-05T17:24:39Z

If you happen to be at Teched (or you know someone who is) we have a room setup to test your application for Vista compatibility issues. You can bring your application and we can troubleshoot it for problems. We have the debug experts from SWAT team and from Application Experience team.

We're in room S329.

Maarten

Integrity Level and the ROT

2007-06-04T18:00:45Z

Integrity Levels result in surprising behavior. The other day I was looking at an accessibility application. Since accessibility applications need to be able to access applications that are potentially running with a MIC level of high, there is a setting in the manifest specifically for this purpose called uiAccess=true. If your application has this setting it will get a filtered token and a high MIC level, where normally it would get a filtered token and a medium MIC level.

Enumerating the ROT from an admin application (high MIC unfiltered token) will give me this:

E:\Code\Roguer\Roguer.sln

!DExplore.AppObj.8.0:5820

!{BA018599-1DB3-44F9-83B4-461454C84BF8} ProgID: VisualStudio.DTE.8.0

!{1B2EEDD6-C203-4D04-BD59-78906E3E8AAB} ProgID: VisualStudio.Solution.8.0

!{639F725F-1B2D-4831-A9FD-874847682010} ProgID: DExplore.AppObj.8.0

!VisualStudio.DTE.8.0:2644

Running it from a standard user token (filtered token, medium MIC) will give me

!{000209FF-0000-0000-C000-000000000046} ProgID: Word.Application.12

Document6

Document4

!{0006F03A-0000-0000-C000-000000000046} ProgID: Outlook.Application.12

!{FB50E079-F904-4833-B7C0-309366351F3A}

C:\Program Files\Microsoft Office\Templates\1033\Blog.dotx

Document3

!{000209FE-0000-0000-C000-000000000046} ProgID: Word.Basic.9

The list is completely different. And running it from a uiAccess=true application will give me:

Correct. Nothing. ROT is partitioned by user token and then again by MIC level. No application has registered itself with a filtered token with high IL.

Consequence of this is that accessibility applications need to use an intermediate process with filtered-medium-MIC token to get access to Word or other applications that are registered in the ROT.

Maarten

Signed Binaries in Non-trusted Locations

2007-06-04T17:31:00Z

When you inadvertently copy the complete cmd.exe to your quick launch bar instead of creating a shortcut, you get some interesting behavior on launching it elevated. Instead of good old trusted elevation prompt, we get the untrusted version.

Interesting. Surely the binary hasn't changed when copying it over? Let's check with sigcheck. Here is the original from system32:

C:\Windows\system32>sigcheck cmd.exe
Sigcheck v1.4
Copyright (C) 2004-2007 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\Windows\system32\cmd.exe:

Verified: Signed
Signing date: 4:14 AM 11/2/2006
Publisher: Microsoft Corporation
Description: Windows Command Processor
Product: Microsoft« Windows« Operating System
Version: 6.0.6000.16386
File version: 6.0.6000.16386 (vista_rtm.061101-2205)

And the copied version:

C:\Windows\system32>sigcheck "C:\Users\maartenb\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\cmd.exe"
Sigcheck v1.4
Copyright (C) 2004-2007 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\users\maartenb\appdata\roaming\microsoft\internet explorer\quick launch\cmd.exe:

Sure enough. Same version, same file, both signed by Microsoft. So something else must be going on.

It turns out that Vista only shows the trusted consent dialog if the application is launched from a safe location, in this case System32. Due to the changed probing path (a command line application would first look for dlls in the application's directory), it would be trivial to load a rogue dll instead of a trusted version. The dialog doesn't mention this explicitly but the warning is certainly justified.

Is my Process Virtualized or Redirected?

2007-05-01T02:49:22Z

In some scenarios it might be necessary to know whether a process is actually being redirected or not. A case in point is for example a library that is loaded and needs to know whether the host process and the library have an identical view of the virtualized world. You can use GetTokenInformation with TokenVirtualizationEnabled to find that out.

The same API with TokenElevation instead of TokenVirtualizationEnabled will give you whether you run with an elevated token or not. Note that this does not guarantee you are running as administrator. You might very well be Backup Operator or standard user with a couple of manually added privileges.

Maarten

Debugging LSASS

2007-04-25T22:15:28Z

For some reason I had to debug LSASS (Local Security Authority Process) recently. Considering that LSASS is rather involved in the functioning of the system with respect to authorization checks, it is cumbersome to debug. The system deadlocks immediately. Try for example attaching to lsass.exe from WinDbg and click the start button when the debugger is paused. Yep. Nothing.

Consulting with one of our security developer support gurus lead to a quick workaround. Do it remotely.

1) The server (debuggee where LSASS needs to be debugged) is started with the following command: (No need to restart anything)

dbgsrv -t tcp:port=1025

2) On the debugger, start WinDbg as a client with this command:

Windbg -premote tcp:server=<servername>,port=1025 -p <lsass pid>

Thanks Prab.

Maarten

Certification Freebie

2007-04-23T20:49:33Z

I had mentioned in a previous post about handy certification tools. If that sparked your interest in getting your app certified, Microsoft is extending the offer for a refund for the cost of verification testing until the end of June. You only get a refund if you pass - so, make sure your app meets the requirements of the test cases. ;-)

Pat

GetCurrentProcess fails on Net 1.1 on Vista

2007-04-18T04:34:30Z

This little snippet compiled with .Net 1.1:

using System;

using System.Diagnostics;

class Program

{

static void Main(string[] args)

{

try

{

Process c = Process.GetCurrentProcess();

Process[] p = Process.GetProcessesByName(c.ProcessName);

}

catch (Exception e)

{

Console.WriteLine(e.Message);

}

will fail on Vista as standard user and hence filtered admin with this error:

{"Couldn't get process information from remote machine."}

Compiling it under 2.0 will get you passed it.

Maarten

C2065: 'TOKEN_LINKED_TOKEN' : undeclared identifier

2007-04-18T04:15:10Z

If you get

error C2065: 'TOKEN_LINKED_TOKEN' : undeclared identifier

when you try to compile a VC++ project that needs to get the linked token through GetTokenInformation, you need to get the Microsoft Windows SDK for Windows Vista. This is true for all the new Vista APIs of course. The SDK that shipped with Visual Studio is old and was built prior to Vista's existence.

You need to add the include, bin and lib directories of the platform SDK (default is C:\Program Files\Microsoft SDKs\Windows\v6.0) to Tools\Option\VC++ directories.

Maarten