In 64bit installer AccessControl fail to set registry permission

[rijukk]

I was using NSIS AccessControl plug-in to grant registry access permission

AccessControl::GrantOnRegKey HKLM "Software\Demo" "(S-1-5-20)" "FullAccess" ;"NETWORK SERVICE"

It was working perfect, now I upgraded my installer to 64bit using "x64.nsh"'s ${RunningX64}
and SetRegView 64

Now

AccessControl::GrantOnRegKey HKLM "Software\Demo" "(S-1-5-20)" "FullAccess"

it fail to grant permission; however i create a key in redirected node (Wow6432Node) like HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Demo. It providing proper grant permission.

Any help will be greatly appreciated

Thank you,
Riju

[T.Slappy]

Are you running 32bit application on x64 machine?
If yes then this situation is correct because 32bit applications use Wow6432Node in Registry.

Your assumption is wrong:

by I upgraded my installer to 64bit using "x64.nsh"'s ${RunningX64}

Creating 64bit installer is possible only by recompiling NSIS as 64bit application.

[rijukk]

Hi T. Slappy,

I am upgrading the installer script with guideline provided in this link
http://bojan-komazec.blogspot.com/20...t-windows.html



I am able to read\write registry from HKLM\Software\Demo after using "SetRegView 64".

; disable registry redirection (enable access to 64-bit portion of registry)
SetRegView 64

Only registry fails on

AccessControl::GrantOnRegKey HKLM "SOFTWARE\Demo" "(S-1-5-20)" "FullAccess"

my installer is working perfectly in 64bit PC without any other issues


Thank you,
Riju

[MSG]

Could it be that the AccessControl plugin cannot handle x64 registry yet?

[MSG]

Could it be that the AccessControl plugin doesn't support x64 registry yet?

[Afrow UK]

AccessControl plug-in needs updating to handle SetRegView. I will do it when I have some time (maybe tomorrow).

Stu

[rijukk]

Hi Stu,

So nice of you

Thank you,
Riju

[rijukk]

What i read from internet in order to accomplish this; we need to use advapi32.dll's RegSetKeySecurity in the AccessControl plugin.

[Afrow UK]

It took a little longer than expected due to SetNamedSecurityInfo/GetNamedSecurityInfo complete lack of support for KEY_WOW64_64KEY (as you pointed out) so a lot of the code had to be changed quite drastically. It may also mean the plug-in will no longer work on Windows 2000, but we may have to live with that.

v1.0.5.0 - 25th January 2012 ~ Afrow UK

• Removed IsUserTheAdministrator.
• Added NameToSid.
• Major code cleanup/rewrite.
• Proper Unicode build (with Unicode plugin API).
• Support for 64-bit registry (SetRegView 64).
• Functions now return "ok" on success or "error" otherwise. On "error", the next item on the stack will be the error description.
• Added version information resource.

Edit: I removed IsUserTheAdministrator because you can quite easily test for that yourself using the new NameToSid. Just check the result of NameToSid ends with -500.

Stu

[Anders]

Originally Posted by Afrow UK

It may also mean the plug-in will no longer work on Windows 2000, but we may have to live with that.

IMHO the Ansi version needs to support NT4/Win95 (I don't know what the old behavior was but it can just return ok on 9x) and the unicode build 2000+ (It is unclear at this point if NT4 will be supported as unicode)

[Afrow UK]

When was ConvertSidToStringSid/ConvertStringSidToSid added to Windows? The plug-in has been using those for some time. Now it's using RegOpenKeyEx as well.

Stu

[Anders]

RegOpenKeyEx was added in Win95/NT4 IIRC and I don't remember off the top of my head but I'm guessing ConvertSidToStringSid was added in 2000 (You cannot trust MSDN, you must check the dll exports)

[Afrow UK]

How about RegSetKeySecurity? I will look into writing replacements for ConvertSidToStringSid/ConvertStringSidToSid.

Stu

[Afrow UK]

v1.0.6.0 - 26th January 2012 - Afrow UK

• Wrote replacements for ConvertSidToStringSid/ConvertStringSidToSid for backwards compatibility with Windows NT4/ME (ANSI build only).
• Loads RegSetKeySecurity/RegGetKeySecurity functions at run-time for backwards compatibility with Windows NT4/ME (ANSI build only).
• Removed commented out legacy code.

Note that RegSetKeySecurity/RegGetKeySecurity is only used when SetRegView 64 is set.

http://nsis.sourceforge.net/AccessControl_plug-in

Stu

[MSG]

Hate to be a nagger, but... Wasn't NT4 also unicode? Not that I feel strongly about NT4 support one way or the other, but yeah.

[Afrow UK]

As Anders says I don't think Unicode NSIS supports below Windows 2000 anyway so there is no point the Unicode plug-in doing so.

Edit: If someone needs the Unicode build for NT4 they can just rebuild with ACCESS_CONTROL_NT4 preprocessor directive. Otherwise the Unicode build links to the native Windows 2000+ API's to save on code size.

Stu

[Anders]

I did not check out the code yet but I hope you are only going down the wow64 path on NT5.2+, I don't know what happens if you pass the WOW64 flag to older registry functions...

[Afrow UK]

According to MSDN KEY_WOW64_64KEY is ignored on 32-bit Windows (and Windows 2000) so I assume that means older versions of Windows too. The registry functions are only used if SetRegView 64 is set but I suppose a test for a 64-bit OS would be good too.

Stu

[rijukk]

Thank you Stu... i will test it tomorrow and let you know the feedbacks

Riju

[kalverson]

Originally Posted by T.Slappy

Are you running 32bit application on x64 machine?
If yes then this situation is correct because 32bit applications use Wow6432Node in Registry.

Your assumption is wrong:

Creating 64bit installer is possible only by recompiling NSIS as 64bit application.

Is there a NSIS 64 bit compiled engine/install available somewhere for download?

[Afrow UK]

No. Why do you need it?

Stu

[Anders]

Originally Posted by Afrow UK

No. Why do you need it?

Stu

Server Core