8

I need to make a exe that will be started from a Windows server share. As soon as the application is running it should disappear from the servers open files list.

For example I have this simple Delphi source as a test - it compiles to a small 28k exe file that simply waits for user input when invoked. While the application is running it appears on the servers open files list. I already tried PEFlags setting IMAGE_FILE_NET_RUN_FROM_SWAP and IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP:

program RunFromShare;
Uses
  Windows;

{$APPTYPE CONSOLE}

{$SetPEFlags IMAGE_FILE_NET_RUN_FROM_SWAP} // no exe file open on network share?
{$SetPEFlags IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP}

begin
  WriteLn('Waiting for [Enter] key');
  ReadLn;
end.
J. Steen
  • 15,470
  • 15
  • 56
  • 63
Peter Sawatzki
  • 173
  • 7
  • 3
    I really don't like programs that try to hide themselves... – Marjan Venema Jul 26 '11 at 12:03
  • @Marjan Venema, this will be a trayicon app started from a server share. Once the app is started it of course shows up in the process list of the client. But I really don't like 300 Clients still having a connection to the server open especially when I need to update my client app. – Peter Sawatzki Jul 26 '11 at 12:16
  • Ok, got it and thanks for the explanation. Got the picture a lot better in my mind now... – Marjan Venema Jul 26 '11 at 12:19
  • Those flags are telling loader to map (view of file, yes) using local paging file so commiting reserved pages will not fail in case of remote or removable medium going offline, they has nothing to do with closing file handle on remote server share. – Premature Optimization Jul 30 '11 at 18:21
  • @Downvoter step into the light: then why does the loader still have a file handle open with the server ? I'm looking for a means to cut this connection. – Peter Sawatzki Aug 02 '11 at 07:18

1 Answers1

1

It seems like IMAGE_FILE_NET_RUN_FROM_SWAP (or IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP) tells Windows that it should load the whole EXE into memory (backed by the swap file). This doesn't mean it is copied and then run from the local disk, it just prevents page faults from happening later which cause access to the share (possibly after dismount; see such a case here). Which in turn means, the file on the network share is still open as long as the share is connected and the file running.

MSDN says this about IMAGE_FILE_NET_RUN_FROM_SWAP:

If Image is on Net, copy and run from the swap file.

I would interpret copy as copy to memory, not as copy to disk.

So if nobody does the job for you just do it yourself: copy your file and run it :)

Community
  • 1
  • 1
Heinrich Ulbricht
  • 10,064
  • 4
  • 54
  • 85
  • I'm with you regarding the interpretation of the MSDN docs, but I was looking for a means to cut this last connection to the share (or the reason why the connection is still open). I tried all sort of things like CloseHandle(Application.Module). Doing the copying myself would of course work, but it adds some complications: I need to copy parameter files as well, I have to find a proper place where to copy the files (even for users with limited rights) etc. All problems that can be solved, but I wanted to use the OS features first before trying workarounds ;-) – Peter Sawatzki Jul 27 '11 at 08:16
  • Yep, sounds solvable. Get the right folder via `SHGetKnownFolderPath` with (for example) folder ID `FOLDERID_LocalAppData` and copy exe and config files there. Or pass config via command line parameter. User configuration has to be stored locally anyway. And regarding the handle: on my machine there is no handle open to an exe file started from the network share (at least Process Explorer says so). Maybe the server has the hands on the file - in this case you cannot do anything anyway. You would have to solve it on the server side. – Heinrich Ulbricht Jul 29 '11 at 12:39