One of the nice things of being off-site with colleagues is that you learn interesting life enhancing tricks. Vishal taught me the Ninja t-shirt technique. I will never fold a t-shirt the same way again.

Maarten

Integrity Levels result in surprising behavior. The other day I was looking at an accessibility application. Since accessibility applications need to be able to access applications that are potentially running with a MIC level of high, there is a setting in the manifest specifically for this purpose called uiAccess=true. If your application has this setting it will get a filtered token and a high MIC level, where normally it would get a filtered token and a medium MIC level.

Enumerating the ROT from an admin application (high MIC unfiltered token) will give me this:

E:\Code\Roguer\Roguer.sln

!DExplore.AppObj.8.0:5820

!{BA018599-1DB3-44F9-83B4-461454C84BF8} ProgID: VisualStudio.DTE.8.0

!{1B2EEDD6-C203-4D04-BD59-78906E3E8AAB} ProgID: VisualStudio.Solution.8.0

!{639F725F-1B2D-4831-A9FD-874847682010} ProgID: DExplore.AppObj.8.0

!VisualStudio.DTE.8.0:2644

Running it from a standard user token (filtered token, medium MIC) will give me

!{000209FF-0000-0000-C000-000000000046} ProgID: Word.Application.12

Document6

Document4

!{0006F03A-0000-0000-C000-000000000046} ProgID: Outlook.Application.12

!{FB50E079-F904-4833-B7C0-309366351F3A}

C:\Program Files\Microsoft Office\Templates\1033\Blog.dotx

Document3

!{000209FE-0000-0000-C000-000000000046} ProgID: Word.Basic.9

The list is completely different. And running it from a uiAccess=true application will give me:

Correct. Nothing. ROT is partitioned by user token and then again by MIC level. No application has registered itself with a filtered token with high IL.

Consequence of this is that accessibility applications need to use an intermediate process with filtered-medium-MIC token to get access to Word or other applications that are registered in the ROT.

Maarten

In some scenarios it might be necessary to know whether a process is actually being redirected or not. A case in point is for example a library that is loaded and needs to know whether the host process and the library have an identical view of the virtualized world. You can use GetTokenInformation with TokenVirtualizationEnabled to find that out.

The same API with TokenElevation instead of TokenVirtualizationEnabled will give you whether you run with an elevated token or not. Note that this does not guarantee you are running as administrator. You might very well be Backup Operator or standard user with a couple of manually added privileges.

Maarten

I had mentioned in a previous post about handy certification tools.  If that sparked your interest in getting your app certified, Microsoft is extending the offer for a refund for the cost of verification testing until the end of June.  You only get a refund if you pass - so, make sure your app meets the requirements of the test cases. ;-)

Pat

If you get    

error C2065: 'TOKEN_LINKED_TOKEN' : undeclared identifier    

when you try to compile a VC++ project that needs to get the linked token through GetTokenInformation, you need to get the Microsoft Windows SDK for Windows Vista. This is true for all the new Vista APIs of course. The SDK that shipped with Visual Studio is old and was built prior to Vista's existence.

You need to add the include, bin and lib directories of the platform SDK (default is C:\Program Files\Microsoft SDKs\Windows\v6.0) to Tools\Option\VC++ directories.

Maarten

In the lab we get a lot of questions about the Vista Certification logo program.  There are two different logos you can get for your product:

Works With Windows Vista

This one is easy to get and everyone is recommended to go for this logo.  Your app needs to pass the 30 minute compatibility check defined in the Application Compatiblity Cookbook. 

Certified For Windows Vista

This one requires you to make sure your app passes all the test cases defined for the program and then get your app tested at a testing authority for verification.  Even if you are not planning on getting the full certification, we recommend you check out the test cases.

For both programs, you can get all the details at http://www.innovateonvista.com

Getting back to the point of this post...  The test cases mention testing tools that are needed.  There is a download that bundles up most of the tools and can be downloaded in a single Logo Testing Tools package.  There are some handy tools in the package that let you test your app with Restart Manager and inject AV's to test Windows Error Reporting (WER).

Pat

In the LoRIE doc for developers, it is mentioned that you can register your application as a broker with Internet Explorer by adding entries to:

    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy

Unfortunately IE doesn't pick those up until IEUser.exe is restarted. You can use RestartManager APIs to cycle both IE and IEUser. Below is a code sample that shows how to accomplish this. Note that for demonstration purposes hardcoded paths are used and error handling is not as robust as it should be.

This will obviously work for other settings that are cached as well.

DWORD dwVal = ERROR_SUCCESS;

DWORD dwSessionHandle = (DWORD)-1;

WCHAR wszSessionKey[CCH_RM_SESSION_KEY+1];

UINT nProcInfo = 100;

UINT nProcInfoNeeded;

DWORD lpdwRebootReason = 0;

    //for demo purposes, hardcoded paths are used.

DWORD nFiles = 2;

LPWSTR rgsFiles[] = { L"c:\\program files\\internet explorer\\iexplore.exe",

L"c:\\program files\\internet explorer\\ieuser.exe" };

RM_PROCESS_INFO *rgProcs = new RM_PROCESS_INFO[nProcInfo];

if (NULL == rgProcs)

{

dwVal = ERROR_NOT_ENOUGH_MEMORY;

goto RM_END;

}

// Starting Session

dwVal = RmStartSession(&dwSessionHandle, 0, wszSessionKey);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Register items

dwVal = RmRegisterResources(dwSessionHandle, nFiles, (LPCWSTR*) rgsFiles,

0, NULL, 0, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Getting affected apps

dwVal = RmGetList(dwSessionHandle, &nProcInfoNeeded, &nProcInfo,

rgProcs, &lpdwRebootReason);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Apply filter to shutdown iexplore processes only

dwVal = RmAddFilter(dwSessionHandle, (LPCWSTR) rgsFiles[1],

NULL, NULL, RmNoShutdown);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Shutdown iexplore processes

dwVal = RmShutdown(dwSessionHandle, 0, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Remove previous filter & apply filter to shutdown ieuser only

dwVal = RmRemoveFilter(dwSessionHandle, (LPCWSTR) rgsFiles[1], NULL, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

dwVal = RmAddFilter(dwSessionHandle, (LPCWSTR) rgsFiles[0],

NULL, NULL, RmNoShutdown);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Shutdown ieuser process

dwVal = RmShutdown(dwSessionHandle, 0, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Remove filter applied to ieuser process

dwVal = RmRemoveFilter(dwSessionHandle, (LPCWSTR) rgsFiles[0], NULL, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Apply filter to restart ieuser process only

dwVal = RmAddFilter(dwSessionHandle, (LPCWSTR) rgsFiles[0],

NULL, NULL, RmNoRestart);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Restart ieuser

dwVal = RmRestart(dwSessionHandle, NULL, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Remove previous filter & add filter to restart iexplore only

dwVal = RmRemoveFilter(dwSessionHandle, (LPCWSTR) rgsFiles[0], NULL, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

dwVal = RmAddFilter(dwSessionHandle, (LPCWSTR) rgsFiles[1],

NULL, NULL, RmNoRestart);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

// Restart iexplore

dwVal = RmRestart(dwSessionHandle, NULL, NULL);

if (ERROR_SUCCESS != dwVal)

goto RM_END;

RM_END:

if (NULL != rgProcs)

delete [] rgProcs;

// Clean up session

if (-1 != dwSessionHandle)

RmEndSession(dwSessionHandle);

return dwVal;

Maarten