Javascript Windows Logoff - logoff.exe

Question

I'm developing an HTA file and i"m trying to create a link in wich the user will be logged off when clicked.

My function:

function fn_fecha()
{
WshShell = new ActiveXObject("WScript.Shell");
WshShell.Run("C:\\Windows\\System32\\logoff.exe");
}

and the call:

<tr>
<td WIDTH=300>
</td>            
<td>
<a id=hsair href="#" onclick="javascript:fn_fecha"  >SAIR</a>
</td>               
</tr>

I've tried both the function with just one "\" (c:\windows\system32\logoff.exe) and the function with fn_fecha(), but it does not find the file when i do this. The HTA file is hosted on a server (but is not open via IIS).

I am not sure if any ActiveXObject can access C:\Windows\System32 subsystem. Try copying logoff.exe out of it — WooDzu, Jul 10 '13 at 21:50
Which OS you're using, it seems `logoff.exe` doesn't exist in Windows7. In `onclick` you need `fn_fecha()` though... @WooDzu There's no problem when accessing said folder using HTA. — Teemu, Jul 10 '13 at 21:57
@Teemu logoff.exe does exist in Windows7. I think it must be some privilege problem. — , Jul 11 '13 at 02:03
@ChiChou I can't find `logoff.exe` from my machine. If it was a privilege problem, you would get `Access denied` error instead of `File not found`. Have you tried to write the same _path_ straight to the Commandline? — Teemu, Jul 11 '13 at 08:00
@ChiChou I'd rather wait your answer : ). Anyway, OP is trying to open `logoff.exe` from `System32`, not from `SysWOW64`, though this is something he probably should do. Though there's not `logoff.exe` in my `SysWOW64` folder either. — Teemu, Jul 11 '13 at 13:38

score 1 · Accepted Answer · edited May 23 '17 at 11:45

In Windows 7 x64 you can find the folder "C:\Windows\SysWOW64", which contains some 32-bit applications and libraries to create a 32-bit compatible environment.

(See also: Why do 64-bit DLLs go to System32 and 32-bit DLLs to SysWoW64 on 64-bit Windows?)

In this case, you meant to invoke C:\Windows\System32\logoff.exe, but somehow the path had been redirected to C:\Windows\SysWOW64\logoff.exe, which does not exist. So here you got a file-not-found error.

You can do a experiment to prove it. Just copy an executable to C:\Windows\SysWOW64\test1.exe, and try run the following code with mshta. See the magic?

    <script>new ActiveXObject("WScript.Shell").Run(
"C:\\Windows\\System32\\test1.exe");</script>

P.S. To my surprise, both mshta.exe and wshom.ocx are 64-bit, then why does Windows direct the path to SysWOW64?

You can run 32-bit mshta.exe on 64-bit system. I'm not aware how this can be configured, though I'd recall I've read about it here at SO, you can search some answers. But still, I can't find `logoff.exe` from my Win7 computer... + we even don't know, if OP is using Win7, he hasn't given any response. — Teemu, Jul 11 '13 at 14:00

score 0 · Answer 2 · answered Mar 23 '16 at 20:08

Solution

Instead of specifying the path C:\Windows\System32 use the special alias %WINDIR%\Sysnative

function fn_fecha()
{
WshShell = new ActiveXObject("WScript.Shell");
WshShell.Run("%WINDIR%/Sysnative/logoff.exe");
}

Explanation

Your 32-bit application is trying to access code in the %Windir%\System32 folder which is reserved for 64-bit code. Windows is silently redirecting your request as explained by this Microsoft KB article:

On a computer that is running a 64-bit version of Windows...a 32-bit application cannot access the following folder:

%WinDir%\System32

Therefore, the 32-bit application cannot start any 64-bit applications in the System32 folder. Additionally, the 32-bit application cannot retrieve file information about any files in the System32 folder or in the subfolders of the System32 folder....

This behavior occurs because Windows on Windows 64-bit (WOW64) provides file system redirection. In a 64-bit version of Windows...the %WinDir%\System32 folder is reserved for 64-bit applications. When a 32-bit application tries to access the System32 folder, access is redirected to the following folder:

%WinDir%\SysWOW64

By default, file system redirection is enabled.

In your case logoff.exe doesn't exist in the SysWOW64 folder, producing the file not found error. The article explains that the special alias %WinDir%\Sysnative bypasses the unwanted file redirection:

WOW64 recognizes the Sysnative folder as a special alias. Therefore, the file system does not redirect access away from the Sysnative folder. This mechanism is flexible and easy to use. You can use the Sysnative folder to bypass file system redirection.

Note that the hotfix mentioned in the article only applies to Windows Server 2003/XP. This functionality is built in to later versions of Windows.

Javascript Windows Logoff - logoff.exe

2 Answers2

Solution

Explanation