How to compare between two executable files?

Question

I have a file which doesn't require UAC Warning. I copied the file to another location using C#.NET

 File.Copy("Original.exe", "Copy.exe");

Now i see that Copy.exe require UAC warning to run under windows 7/Vista.

How can i compare between Original.exe and Copy.exe to see exactly what happened to the file and change it manually so that it doesn't require UAC anymore. Which tool can i use to achieve that ?

enter image description here

BOTH EXECUTABLE ARE THE SAME FILE : How to know the difference between these two files ?

Is "Copy.exe" the real target file name? Windows uses _Installer Detection_ which marks some files with updater/setup/install keywords in file name as requiring administrator privileges. — max, Jul 15 '12 at 22:35
No it's just an example. The original name is UpdatePriv.exe — Rafik Bari, Jul 15 '12 at 22:35
Than it is the case. Try removing "Update" part from file name. — max, Jul 15 '12 at 22:36
related question: http://stackoverflow.com/questions/4133337/how-do-i-avoid-uac-when-my-exe-file-name-contains-the-word-update — max, Jul 15 '12 at 22:37

score 6 · Accepted Answer · answered Jul 16 '12 at 08:21

Windows Installer Detection Technology is the reason of such behavior. There is a set of conditions which force executable file to be considered as requiring administrator privileges:

32 bit executables

Applications without a requestedExecutionLevel

Interactive processes running as a Standard User with LUA enabled

Before a 32 bit process is created, the following attributes are checked to determine whether it is an installer:

Filename includes keywords like "install," "setup," "update," etc.

Keywords in the following Versioning Resource fields: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name.

Keywords in the side-by-side manifest embedded in the executable.

Keywords in specific StringTable entries linked in the executable.

Key attributes in the RC data linked in the executable.

Targeted sequences of bytes within the executable.

Related MSDN article: http://technet.microsoft.com/en-us/library/cc709628%28WS.10%29.aspx

Possible solutions:

If you are the author of executable, include manifest with specified requestedExecutionLevel
If you don't have access to source code - try to add or modify manifest using appropriate utilities (mt for example or maybe some generic resource editor)
Avoid keywords update, install and setup in executable file name

score 1 · Answer 2 · answered Jul 16 '12 at 07:32

Afte copying the file try to set the file's acl like that:

var file = new FileInfo("copy.exe")
 var fileSecurity = file.GetAccessControl();
 fileSecurity.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid, null),
                                                                FileSystemRights.FullControl,
                                                                AccessControlType.Allow));
 file.SetAccessControl(fileSecurity);

score 0 · Answer 3 · answered Jul 15 '12 at 22:32

0

You may find that the problem is to do with the location rather than the file. Win 7 is very fussy, especially if you try and change anything under Program Files.

Have you tried putting the original file in the new location to check if that also required UAC approval?

answered Jul 15 '12 at 22:32

DeanOC

7,142
6
42
56

Yes, tried that ! Whenever i use File.Copy() method the copied file require UAC approval ! – Rafik Bari Jul 15 '12 at 22:33
So, am I correct in assuming that if you manually rename and copy the file to the new location, then you don't need UAT approval? – DeanOC Jul 15 '12 at 22:38

How to compare between two executable files?

3 Answers3