Brandon Live!

Desktop Search FAQ   |   Start++   |   Contact Me

Getting the shell to run an application for you - Part 2: How

April 27, 2008 at 2:07 am
Windows Shell, Windows Vista

The key to getting Explorer to do your dirty work lies in the IShellDispatch2 interface.  Particular, the ShellExecute method

IShellDispatch2 is one of the shell automation objects used to support scripting languages.  However, that doesn’t mean you have to use VBScript to gain some value from it.  In this case, IShellDispatch2::ShellExecute is exactly what we want, because it wraps the normal ShellExecute call but runs it from the context of the object implementing the interface - in this case, we want the IShellDispatch2 associated with the desktop shell.

Knowing this is only half the battle, though.  The next trick is to figure out just how to get to the right IShellDispatch2 object (the one for the desktop shell instance of Explorer.exe).

Fortunately, one of our architects, Chris Guzak (seen on C9 here), was able to point me in the right direction and connect up all the dots.

Our hunt begins with the IShellWindows interface, which can be used not only to reliably find the HWND for the desktop shell window, but also to get an IDispatch interface for it:

IShellWindows *psw;
    HRESULT hr = CoCreateInstance(CLSID_ShellWindows, NULL, CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&psw));
    if (SUCCEEDED(hr))
    {
        HWND hwnd;
        IDispatch* pdisp;
        VARIANT vEmpty = {}; // VT_EMPTY
        if (S_OK == psw->FindWindowSW(&vEmpty, &vEmpty, SWC_DESKTOP, (long*)&hwnd, SWFO_NEEDDISPATCH, &pdisp))
        {

Next, we need the IShellBrowser interface, and we get that by querying for IServiceProvider and asking the SID_STopLevelBrowser service for an IShellBrowser interface.  And from there we can get the IShellView.

IShellBrowser *psb;

hr = IUnknown_QueryService(pdisp, SID_STopLevelBrowser, IID_PPV_ARGS(&psb));
if (SUCCEEDED(hr))
{
    IShellView *psv;
    hr = psb->QueryActiveShellView(&psv);

From there we need to get to that IShellDispatch2 interface that started this whole adventure. 

IDispatch *pdispBackground;
HRESULT hr = psv->GetItemObject(SVGIO_BACKGROUND, IID_PPV_ARGS(&pdispBackground));
if (SUCCEEDED(hr))
{
    IShellFolderViewDual *psfvd;
    hr = pdispBackground->QueryInterface(IID_PPV_ARGS(&psfvd));
    if (SUCCEEDED(hr))
    {
        IDispatch *pdisp;
        hr = psfvd->get_Application(&pdisp);
        if (SUCCEEDED(hr))
        {
             IShellDispatch2 *psd;
             hr = pdisp->QueryInterface(IID_PPV_ARGS(&psd));

At this point you should be able to figure out where to go from here.

If that’s not easy enough, watch out for Part 3 of this series in the next day or two.  It will contain a sample and describe how the Start++ installer makes use of it.


Getting the shell to run an application for you - Part 1: Why

April 26, 2008 at 5:39 pm
Windows Shell, Windows Vista

Some people seem to think that calling ShellExecute or ShellExecuteEx and passing the path to an executable will have the effect of telling the shell to launch an application for you.  However, that’s not quite what happens.  These functions simply allow your application to take an action (like launching a process) in the manner the shell typically would (for instance, recreating the behavior of using the Run box).

What’s the difference?  Well, child processes inherit several things from their parents.  They inherit processor affinity, for example.  Most important these days, it seems, is the fact that processes inherit Integrity Level from the process that started them.  That is, except in the case of elevation from medium to high IL (the operation that causes the UAC dialog to appear).

So let’s say you write an installer, and you want to run the application installed at the end of the installation process.  Or heck, maybe you just want to call the application once with a special “/setup” parameter that tells it to do something you couldn’t do from your chosen setup utility.

Where do problems begin?  Well, installers typically run with admin rights.  When your installer launches your application as a convenience to the user, it’s now running with admin rights.  The primary concern here isn’t even the security implications of running at high IL.  After all, the next time your program starts it will run at its normal privilege level.

The problem is that your program is now running in a manner you may not have accounted for when writing it.  For example, users won’t be able to drag-and-drop anything to your application from normal processes.  If your program interacts with other non-admin processes, you may face other problems.  My own Start++ application faced this problem, as it needs to inject a small amount of code into Explorer.exe and then communicate with that code to coordinate its magic.  It can’t do this when running as an admin.

The recent 0.8.x release of Start++ solved this issue, and Start++ now runs immediately after install, in the proper non-admin context.  This is accomplished by having Explorer launch the application on the installer’s behalf. 

Others have addressed this problem in the past.  However, the proposed solutions always seem to take one of these forms:

  1. Write an invoker process that runs with non-admin privileges, starts the elevated installer, and then runs your app at the end.
  2. Use the task scheduler to launch the app.
  3. Inject some code into Explorer and launch from there.

I don’t like #1 because it’s cumbersome and limits how you can name your installer.

#2 also seems cumbersome to me, and is a bit hacky.

#3 is totally hacky, and not something I trust people to do without accidentally destabilizing Explorer (there’s a reason the code Start++ injects into Explorer is incredibly tiny and very carefully crafted).  It can also introduce complications when dealing with multiple target platforms (x86 versus x64).  For example, the CodeProject sample linked to above doesn’t even restrict its WH_CALLWNDPROCRET hook to the thread that it’s targetting.  That means this hook code is immediately going to be loaded by every process on the desktop with a window.  Yuck.

Fortunately, there is a better way.

In Part 2, I describe a better way to get Explorer to run code for you, without having to inject anything into Explorer or use cumbersome workarounds like those described above.


Tech journalism is dead to me

April 11, 2008 at 5:38 pm
Apple, Microsoft, Windows Vista

Gary Morgenthaler of Business Week is the latest in a series of tech journalists to really disappoint me.  Why?  Just look at his latest rubbish posted on Business Week’s website today.

Consider the following paragraph and tell me that bias and sensationalism haven’t taken over tech “journalism.”

With last year’s arrival of Vista, Windows has swollen to 1 billion bytes (a gigabyte) or more of software code. The “Mach” kernel of the Mac OS X, however, requires less than 1 million bytes (a megabyte) of data in its smallest configuration, expanding modestly with the sophistication of the application.

So the iPhone kernel is smaller than all of Vista and its included applications.  Sound the alarm, get the president on the line, this is huge news.

What Gary forgets is that the CPU of my Dell workstation is hundreds if not thousands of times smaller than an entire Mac Pro.  I think, advantage Dell.

Of course I’m joking, these comparisons are absurd.  Yet in the very next sentence Gary piles on the bull crap.

This bloating has saddled Vista users with increased costs and poor performance on average computers.

If you look at Apple’s own website, they state that Leopard requires 9GB of available disk space to install.  Not surprisingly, this is almost exactly the same amount of space required for Windows Vista.  But how can that be?  Windows is bloated!  OS X is not!  We know these things, and working backward from this knowledge we can’t possibly come to the conclusion that they’re both just about the same size.  So why bother with the facts at all when you can work backward from what you want to be true?

The facts, in fact, are even worse for Gary’s argument than you might think.  You see, while Leopard and Vista require about the same amount of disk space to install to, one of them does have a far larger kernel image than the other.

The more portly of which is by far OS X.  I just rebooted my Macbook into Leopard to see just how large the kernel was.  The Mach kernel alone, which is only part of the OS X kernel, is 10MB in size.

So how big is the 64-bit Vista kernel on my desktop machine?  4.5MB

But this is hardly a fair comparison.  After all, that’s the size of a 64-bit Windows kernel.  We can’t reasonably compare it to a 32-bit Mac OS kernel (there is no 64-bit Mac OS kernel at the time of this writing).  So what about the 32-bit Vista one?  That weighs in at a massive 3.4MB.

Alright, the sensationalist “journalists” have won me over.  Come on NT guys, 3.4MB?  In 2008?  What’s with all the bloat?


Windows Search Indexer Status Gadget

April 9, 2008 at 8:10 pm
Desktop Search, Life of Brandon, Microsoft, News, WS4, Windows Vista

I’m pleased to announce that the second tool to join the BrandonTools.com collection is now available!  It’s a new Sidebar Gadget for those who want to see what the indexer is up to and to easily control its behavior.

Click here for details.

 

Note that the screenshot depicts the gadget running on WS4.  The "index now" button is not available on versions prior to Windows Search 4.


Joe Wilcox says Vista is failing (again)

March 31, 2008 at 11:00 pm
Microsoft, News, Windows Vista

In this morning’s article, Windows: A Monopoly Shakes, Joe Wilcox paints a grim picture for Windows.  Apparently, about 90% of surveyed enterprises adopted Windows XP in 2007, and about 6.3% adopted Vista, mainly taking away from Windows 2000 adoptions.  I don’t know about yours, but my boots are shaking.

Is anybody really surprised?  Enterprise IT isn’t exactly a new thing, and this isn’t the first time Windows has shipped.  These guys refresh their PCs in cycles.  Lots of all-Windows 2000 shops who never started rolling over to XP are now beginning their early rounds of rolling out Vista boxes.  They’re in more of a hurry, since Windows 2000 is pretty ancient.  So much so that it originates from a time when we appended “2000″ after product names and thought it sounded cool and futuristic.

The Windows XP guys sticking with it through 2007 doesn’t shock me.  Most of the XP-based enterprises I’m familiar with are in the pilot stages for moving to Vista.  Lots of them have been working closely with Microsoft to make sure that updates like SP1 and Windows Search 4.0 address their deployment issues.  This is just how it goes.

Some number will even decide to “skip” Vista.  I’m sure it’s not a prospect Microsoft likes to acknowledge, but just look at how many companies held onto Windows 2000.  Throughout the entire (long) lifetime of XP!

Joe says that Windows adoption on the whole declined 3.7 percent over the course of the year (98.6% in January to 94.9% in December).  I have no idea what that means.  Is there some comparison to the year before that might put those numbers in context?  Or are we saying that all months of the year are equal?  Did anyone consider that the impending release of Vista SP1 might have led some Windows-based companies to hold off purchasing for a few months?

I don’t mean to belittle the apparent gains made by the Apple and Linux camps in the last three months of 2007.  I just think it’s silly to make a big deal about three months of “decline” for Windows in light of those other factors.  Joe says that “Vista is in real trouble.”

And yet it looks like last year more companies bought Vista machines than Macs and Linux PCs combined.  I’d say that’s pretty darn good for an OS that was released at the beginning of the year.

Well, that’s my take anyway.


Remote Search in Windows Search 4.0

March 29, 2008 at 4:56 pm
Desktop Search, Microsoft, Search, WS4, Windows Shell, Windows Vista

Following up on the Windows Search 4.0 Preview release, I will be writing several posts about some of the new features and changes enabled by this release.  One such feature, and this first one I will dive into here, is the capability to remotely search the index of another Windows PC.

This features isn’t entirely new.  Windows Vista shipped nearly a year and a half ago with the ability to query the index of another Vista machine when searching file shares.  The same capability extends to and from Windows Server 2008.

Windows Search 4.0 brings this capability to Windows XP machines, as well as Server 2003 - and perhaps more importantly, Windows Home Server.

So how does it work?  First let’s take a look at how the user sees it.  Let’s say I have a folder on Machine A called “Cool Stuff” that I want to share out.  One simple way to do that is to browse to the folder in Explorer, select it, and click “Share.”

sharecoolstuff

You’ll then get a friendly dialog that asks you who you’d like to share with.

 ShareCoolStuff2

“Everyone” is a simple answer for information you want to be accessible to everyone.  Select it from the drop-down and click “Add” to add Everyone to the list of people the folder is shared with.

ShareCoolStuff3

What else do I have to do on Machine A?  Nothing!  Windows Search 4.0 will automatically index any folders you share out, on both XP and Vista.

On Machine B, you simply navigate to the share as you normally would.  That could mean typing a UNC like \\MachineA\Cool Stuff\ or it could mean using a mapped drive, redirected User folders, the Network browser, etc.  Once there, just type a query in the Search box (or on XP, click the “Search” button to bring up the Search Pane) and you’re off!

  SearchMachineA

Unfortunately I don’t have any XP machines to get a screenshot from, but I’ll try to add one soon.


Windows Search 4.0 Preview release

March 27, 2008 at 6:21 pm
Desktop Search, Microsoft, News, Search, WDS Development, Windows Shell, Windows Vista

Today we made available the WS 4.0 preview release for Windows XP, Vista, and Server 2003/2008.  You can read details about WS 4.0 at the following sites:

Vista Team Blog - Announcing the Windows Search 4.0 Preview

KB Article describing Windows Search 4.0 (with download links)

This release is mainly an update to the Windows Search indexer, and provides countless performance improvements, bug fixes, and reliability / recoverability features.

The XP/2003 version has been updated with more features previously exclusive to Vista - such as the ability to search remote indexes for network shares, and the ability to host Vista-style preview handlers in the preview pane.

WS4 also provides some cool new query capabilities for developers, which I will describe and give some examples of in future posts.

The most noticeable difference is probably how fast it is.  Those geniuses down the hallway in indexer land really pulled off some impressive feats with this release.

Since there are six different downloads depending on your OS, I’ll just refer you to the KB article for downloading the preview release.

Let us know what you think!


Trend Micro thinks your PC is too secure (UPDATED)

March 23, 2008 at 11:51 am
The worst ever, Windows Vista

Update 2: Trend Micro has sent a new response to the guy with the original problem, viewable here.  It seems that you can uninstall the build discussed below and install a new Vista-friendly one at this link.

Update: Apparently I misunderstood the timing of this e-mail, and it is actually from last year.  I’ve updated the post a bit to make that clearer and to be a little less harsh, since I don’t know that they’re still sending mails like this.  But the user is still having the same problem, and their web site still suggests the same solution, so it’s likely they are.  If you’ve received one like it, please let me know!

A Neowin forum member brought up what they believed was a conflict between UAC and Trend Micro Internet Security 2007.  After some discussion about it, they received this e-mail from Trend Micro’s support team:

Dear Lexonex,
Hello there! A pleasant day to you! My name is John from Consumer Escalation Team and I will be assisting you on this issue. To keep our records up-to-date, it is very important to RESPOND to this e-mail.

I have carefully read your email and have understood your concern.
Regarding Turning-off User Account Cotrol of WIndows Vista. This feature of Windows Vista is the same as the Suspicious Software Alarm System of Trend Micro Internet Security 2007. Turning-it off really does not harm your computer since you have this kind of feature working in your Trend Micro program. It even allows you not to have that annoying pop-up each time you install or open other programs.

Right-now we don’t have any information yet if there will be a patch for that problem since it’s really about WIndows Vista’s permissions on the programs running in your computer. It’s like Trend Micro not being allowed by Windows Vista to work normally. And for the feature to run, it’s either we turn-off User Account Control or set some exceptions for other programs in User Account Control which right-now; WIndows’ Vista does not give an option.

If ever a patch should be created for this problem, it should be a patch from Microsoft so they can allow valid programs to run normally when User Account Control is on.

But we are not closing our options and are still testing if there is a way that the whole Trend Micro program as a whole can be permitted by WIndows Vista to run normally.
I hope I have answered your inquiries clearly.
I will patiently wait for your reply.
Please let me know if I can close this case already.
VERY IMPORTANT: In order for me to have a history of our correspondence, please do not delete the subject and the contents of this email.
Hope this proves useful and have a nice day
Best Regards,
Consumer Support Team
TrendLabs HQ, Trend Micro Incorporated

Apr 12 2007, 04:12 AM

Did he really just say that?!?  Let’s count the problems with this message:

  1. Turning off UAC has a substantial impact on your PC security.
  2. Trend Micro’s “Suspicious Software Alarm” is nothing like UAC.  It doesn’t even have the same goal!  That feature, as its name implies, is about preventing malware from getting on your machine.  UAC has nothing to do with malware.
  3. It’s impossible for a third-party application or service to do what UAC does.
  4. He blames their crappy software design on Vista!  If their developers think this way, you should run as fast you possibly can away from Trend Micro.
  5. Every other virus scanner developer has gotten along just fine with UAC.  You know, because they actually know how to write software. 
  6. “Either we turn off UAC or set some exception” - you don’t set any exceptions!!! You show an elevation dialog.  Or you run as a service like everybody else.  If your virus scanner is running in user mode, you’ve already failed.

Update: Now it’s been nearly a year since that e-mail was sent.  Have they fixed the problem?  It doesn’t look like it.  They still tell you the same thing on their knowledge base site!

My advice?  Get OneCare, AVG, eTrust, or another offering.  Just make sure it’s from someone who understands security and software development.


Indexed folders rely on the index being complete

March 16, 2008 at 3:54 pm
Desktop Search, Microsoft, Search, WDS FAQ, Windows Shell, Windows Vista

Let’s say you want to optimize your system by only indexing certain data.  For example, a reader recently e-mailed me and said “I only want to index my media files.”  Seems like a valid choice.  At first glance, it might seem like you could achieve this by telling Windows to only index files with extensions like .mp3 and .avi.  Ultimately, this is a very bad idea.

First, let me tell you why this is a bad idea.  Second, I’ll tell you the right way to achieve what you want.

Let’s begin by looking at how the Windows Vista shell and the indexer work together.

The indexer maintains a list of “start paths” - which are locations in the shell namespace that it cares about.  By default, it is set up to index the x:\Users directory - and thus all of the default Documents / Music / Pictures folders of all user accounts on the system.  When you install Outlook, it sets up a start path for your mail accounts.  OneNote sets one up for your OneNote data.  And so on.  This means that the indexer will try to index all items under that path*, and ignore everything else.

When you browse to a folder in Explorer, the shell asks the indexer if the current path is covered by the index.  If it is, Explorer will use the index exclusively for search / filter / grouping operations against that location.  It does not ask the index if it covers all the file types in that location.  It assumes the index is the authoritative source for information about that part of the namespace.

On the other hand, if the path is not covered by the index, Explorer walks the entire namespace starting at that location (so, the current folder and all subfolders) and enumerates every single item, performing all operations like filtering / sorting / grouping in-memory.  By default, it does not crack open any files being enumerated - so all filtering operations happen only against the basic properties like file name.  You can then click the “Search in File Contents” button (what some of us call the “try harder” button), and it will repeat the operation - stopping at every file and cracking it open with the appropriate IFilter and property handlers, doing essentially the same thing that happens when a file is indexed.  It loads the file, cracks it open, extracts all the properties and content, checks to see if it matches the current filter, and then decides whether or not to add that item to the view or ignore it.  If you change the filter, the whole process starts over again.  Needless to say, this is rather slow if you have to do it for more than a few files.  That’s why the “Search in File Contents” button is there, since in most unindexed locations (like C:\windows) you are probably only searching for a filename.

Armed with this information, let’s take another look at the original question.  Let’s say you go into the Advanced options for the indexer and tell it not to index .doc files at all.  Then you go save a new document called Something.doc inside of your Documents folder, which is still indexed.  The indexer will be notified that a new file was created there, but since you disabled indexing of that extension, it will ignore it.  Then when you go to your user folder or the Documents folder and search for “something” - you don’t find the document.  Even though it’s right there in the name.  The folder said “Hey, I’m indexed” and the file is not in the index, so as far as Explorer is concerned, it doesn’t exist.

A much better approach, if you really don’t care about indexing your .doc files, is to tell Windows not to index the Documents folder (or wherever you keep your .doc files).  That way it will fall back to slow GREP search when you look there, which will at least find what you’re looking for, albeit more slowly.

You can do this from the Indexing Options control panel, and it’s pretty easy to do.  Only want your music and videos indexed?  Then tell the indexer to only crawl the places where you store those files.  That it’s, mission accomplished.

The end result is the same.  The indexer isn’t doing any additional work, unless you mix .doc files and media files in the same folder.  And even then, at least you’ll be able to find them.

Another option available to you is to set certain extensions to “Index File Properties only.”  That way you’ll at least be able to find the item by its name.  Why would you want to do that?  I have no idea.  It’s not like indexing files incurs a significant overhead on any reasonably modern PC.  The option is mainly there because there are some file types the indexer can’t search inside.  So instead it indexes all the basic stuff that applies to every file (like name, date modified, and size).

* = It’s actually more complicated than that, as there can be nested inclusion/exclusion rules, files or folders excluded based on attributes, etc.  But that’s not particularly relevant to this discussion


Don’t write gadgets with Flash or Silverlight

March 11, 2008 at 10:51 am
Microsoft, Windows Vista

Because I, and millions of others, will not be able to use them.  That’s because we use 64-bit versions of Windows.

You see, the Windows Sidebar uses Internet Explorer to host the HTML and script that make up a gadget.  On 64-bit versions of Windows, the Sidebar is a 64-bit process, and so it uses the 64-bit version of IE.

There is no Flash or Silverlight for the 64-bit version of IE.

About a week ago I encountered a gadget offering from MSNBC having to do with the presidential primary results.  I added it, only to find that the gadget’s UI was totally missing.  It didn’t take long to figure out they were hosting Flash.

I’m actually quite disappointed at the lack of 64-bit Silverlight support, as I believe it would be a compelling solution for gadget authors.  .NET already works great in gadget situations because it gets compiled at runtime for the appropriate platform - and thus works on both 32-bit and 64-bit versions of Vista.  I had hoped that since Silverlight is based on .NET that it would include similar write-once deploy-anywhere support, including 64-bit platforms.

I hope that is something they fix in the near future.

Update: Yes, you can install both Flash and Silverlight (1.0 and 2.0) on Vista x64 systems.  I assume that everybody knows that, but perhaps they do not.  The caveat, and point of this post, is that you are installing the 32-bit version of Flash / Silverlight, and thus it only works in 32-bit applications.  The default browser on 64-bit Windows is the 32-bit version of IE, so these plug-ins work fine for web browsing.  But they don’t work in the sidebar, or any 64-bit applications that host IE.


[powered by WordPress.]

Hi. I'm Brandon. I'm a geek, and I work on Search technology for Windows at Microsoft. This is my blog.

RSS Button

Picture

categories:

archives:

May 2008
M T W T F S S
« Apr    
 1234
567891011
12131415161718
19202122232425
262728293031  

search this site:

The views expressed within my blog are my own - and are not in any way indicative of those of the company I work for, Microsoft, or it's employees. No warranties or other guarantees will be offered as to the quality of the opinions or anything else offered here.

Xbox Live GamerCard

Most popular searches that brought people here today:

search (11)start++ (9)an expression
contains an inva
(2)windows desktop
search rebuild
(2)trackpad driver
macbook pro
(2)brandon live (2)itunes 64 bit
download
(2)brandontools.com (2)Paths regedit wds (2)windows desktop
search shared
(2)