Help deleting a file in System32 dir

[whertz]

Is there a way in PB to delete a file in the Windows\System32 in Vista/7? Windows won't let you even access it. You can do it with the takeown/cacls method mentioned here: http://www.howtogeek.com/howto/windows- ... ows-vista/ but I want to do it with PB only.

It's not for anything malicious, it's for my own use (a program I'm using puts junk in the system32 folder and I want to get rid of it using my program).

I've searched the forums but can't find anything. Any help would be appreciated, thanks.

[jassing]

Have you tried using a manifest to elevate your code?

[whertz]

Have you tried using a manifest to elevate your code?

I don't know how to do that, but would that work?

I forgot to mention as well, I'm running windows 7 64bit, with UAC turned off completely.

[whertz]

Never mind, I've found the problem.

My stupid mistake, I was running the code in the x86 version of PB, but in x64 PB it works and deletes files. It seems windows 64bit doesn't let 32bit programs delete files from the system32 directory.

[Zach]

That's because on 64-bit Windows the System32 folder actually stores 64-bit files, and the SysWOW64 stores 32 bit files.

Retarded, I know

[whertz]

That's because on 64-bit Windows the System32 folder actually stores 64-bit files, and the SysWOW64 stores 32 bit files.

Retarded, I know

I know, and it seems 32bit programs can't even 'see' files in the System32 directory.

[C64]

I know, and it seems 32bit programs can't even 'see' files in the System32 directory.

Great. We need a thread that explains what 32bit programs can (and can't) do on a 64bit system. I code in 32bit and this thread has me worried now. What do I tell my 64bit users? I was expecting my program to run on their systems.

[whertz]

I know, and it seems 32bit programs can't even 'see' files in the System32 directory.

Great. We need a thread that explains what 32bit programs can (and can't) do on a 64bit system. I code in 32bit and this thread has me worried now. What do I tell my 64bit users? I was expecting my program to run on their systems.

32bit programs run fine on 64bit, but if they try and access files in the System32 directory, they get redirected to the SysWow64 directory. Try this in PureBasic x86, on 64bit Windows:

CreateFile(0,"C:\Windows\System32\Test.txt")
CloseFile(0)

Now go to the System32 folder in explorer and notice the file is not there, it is in the SysWow64 folder.

The same applies to the registry as well. Create a key in HKEY_LOCAL_MACHINE\SOFTWARE and it will create it in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node

[Barney]

Hmm.. The real question here is: "Who in his right mind would try to do anything in any of the systems folders?". Unless, of course one is creating an utility program, which would imply that one has enough knowledge about the inner workings (and differences) between Win32 and Win64.

Barney

[C64]

Now go to the System32 folder in explorer and notice the file is not there, it is in the SysWow64 folder

Yuck. So the program I'm writing (which does file searches) will not return true results now. Again, great.

[GoodNPlenty]

I know, and it seems 32bit programs can't even 'see' files in the System32 directory.

Great. We need a thread that explains what 32bit programs can (and can't) do on a 64bit system. I code in 32bit and this thread has me worried now. What do I tell my 64bit users? I was expecting my program to run on their systems.

This should work for you. Be sure to set compiler options to "Set Request Administrator mode for Windows Vista" and "Create unicode executeable".

Code: Select all

;# Compiler Options
;# Create unicode executeable
;# Set Request Administrator mode for Windows Vista

;#================================================================================================#
;{=#Prototypes#===================================================================================#
;#================================================================================================#
Prototype.i IsWow64Process(hProcess, *Wow64Process)
Prototype.i Wow64DisableWow64FsRedirection(*OldValue)
Prototype.i Wow64RevertWow64FsRedirection(*OldValue)

;#=#Procedure#====================================================================================#
;#  Name ..........: wpeIsWow64Process                                                            #
;#  Description....: Determines whether the specified process is running under WOW64              #
;#  Parameters.....:                                                                              #
;#  Returns........:                                                                              #
;#  Date ..........:                                                                              #
;#  Authors .......:                                                                              #
;#================================================================================================#
Procedure.i wpeIsWow64Process()
  Protected IsWow64Process_.IsWow64Process
  Protected libKernel32.i, iReturnValue.i 
  libKernel32 = OpenLibrary(#PB_Any, "kernel32") 
  If libKernel32 
    IsWow64Process_ = GetFunction(libKernel32, "IsWow64Process") 
    If IsWow64Process_ 
      IsWow64Process_(GetCurrentProcess_(), @iReturnValue) 
    EndIf 
    CloseLibrary(libKernel32) 
  EndIf 
  ProcedureReturn iReturnValue 
EndProcedure 
;#=#EndProcedure wpeIsWow64Process ===============================================================#

;#=#Procedure#====================================================================================#
;#  Name ..........: wpeDeleteFile                                                                #
;#  Description....:                                                                              #
;#  Parameters.....: bool wpeFileExists(FileName$)                                                #
;#  Returns........:                                                                              #
;#  Date ..........: 12-05-2008                                                                   #
;#  Authors .......:                                                                              #
;#================================================================================================#
Procedure.i wpeDeleteFile(FileName$) 
  Protected Wow64RevertWow64FsRedirection_.Wow64RevertWow64FsRedirection    
  Protected Wow64DisableWow64FsRedirection_.Wow64DisableWow64FsRedirection
  Protected iResult.i
  Protected *OldValue = #Null
  
  If wpeIsWow64Process()
    If OpenLibrary(0, "kernel32.dll")
      Wow64DisableWow64FsRedirection_ = GetFunction(0, "Wow64DisableWow64FsRedirection")
      If Wow64DisableWow64FsRedirection_
        Wow64DisableWow64FsRedirection_(*OldValue)
      EndIf
      CloseLibrary(0)
    Else  
      Debug "Unable to Open kernel32.dll"
      ProcedureReturn #False
    EndIf
  EndIf
  
iResult = DeleteFile(Filename$)
  
  If wpeIsWow64Process()
    If OpenLibrary(0, "kernel32.dll")
      Wow64DisableWow64FsRedirection_ = GetFunction(0, "Wow64RevertWow64FsRedirection")
      If Wow64DisableWow64FsRedirection_
        If Wow64DisableWow64FsRedirection_(*OldValue) = #False
          Debug "Error : Wow64DisableWow64FsRedirection_"
          ProcedureReturn #False
        EndIf
        CloseLibrary(0)
      Else
        CloseLibrary(0)
        Debug "Unable to Open Wow64RevertWow64FsRedirection"
        ProcedureReturn #False
      EndIf
    Else  
      Debug "Unable to Open kernel32.dll"
      ProcedureReturn #False
    EndIf
  EndIf

  ProcedureReturn iResult 
EndProcedure
;#=#EndProcedure wpeDeleteFile ===================================================================#

Debug wpeDeleteFile("C:\Windows\System32\testfile.txt")

[whertz]

Nice solution GoodNPlenty, but does disabling redirection affect programs outside your program? If so this could be dangerous if something happened and your program crashed before it had time to re-enable redirection.

[Rook Zimbabwe]

Save yourself SERIOUS trouble and heartache and just quit messing in the System Folders!!!

[GoodNPlenty]

Nice solution GoodNPlenty, but does disabling redirection affect programs outside your program? If so this could be dangerous if something happened and your program crashed before it had time to re-enable redirection.

Redirection is only enabled in the calling thread, as other programs redirection will still be disabled. I originaly wrote the function to check if a system file exists and some file version information. Rook is right on point with this being dangerous. I did want to show that file direction could be enabled, but I never advise writing to or deleting files from the system directory. The 'AppData' and 'ProgramData' directories are used for this purpose.

[whertz]

Save yourself SERIOUS trouble and heartache and just quit messing in the System Folders!!!

Aww, you're no fun. I like messing with files in my System32 folder.