Check if ntuser.dat is in use

[jdeleon7010]

Hello,

Is there a plugin/action to check if ntuser.dat is in use? I would like to edit the file if not in use.

[FrancescoT]

Dear User,

Unfortunately, there isn't.

For what I know if an the user is logged in, the related ntuser.dat should be locked.

Anyway, manipulation of that file can cause system failure.

Regards

[jdeleon7010]

I imported the wise action to check in use, but am having issues, can you please take a look?

Code: Select all

~InstallAware Clipboard Data~
~MessageBox~
~{D17F8291-1573-4877-B103-DD56B1ABFDAD}~
~TEST~
~$_INUSE_VAR_$~
~0~
~1~
~~
~Comment~
~{AEDAFC0F-BEBC-442F-87EE-0865BF164EB9}~
~~
~End~
~{964E9467-99C2-4239-84C6-4467D2522479}~
~Set Variable~
~{233E82A9-C428-4737-A04B-818FD88E9912}~
~$_INUSE_VAR_$~
~Non-Existant~
~Else~
~{F4999BAB-3567-44A0-9530-BAD8229C2798}~
~End~
~{C8A1EF12-0E51-4DD0-B1D8-E8C99C8B80C4}~
~Set Variable~
~{D43B6EA8-A2DC-4FA8-8BE6-7B05D576D959}~
~$_INUSE_VAR_$~
~Not In-Use~
~Call DLL Function~
~{8CA6BAD2-FE7C-4615-9386-C43C69CEFB28}~
~$sys32$\kernel32.dll,CloseHandle,void,INUSE_RTN,"double word",$INUSE_RTN$,$~
~mDown.dll\mDownExec.dll~
~Else~
~{31E9D871-E0D6-427E-A00E-E2BE0F51B591}~
~End~
~{E3E33C17-C58F-4D1F-AC0F-09E48606F1F3}~
~Set Variable~
~{19B2D89A-AE81-4FD7-832D-5ED35A628688}~
~$_INUSE_VAR_$~
~In-Use~
~If~
~{E34B2A33-C76E-4B8C-B343-37DEB33417A7}~
~GET_FILE_RETURN~
~0~
~32~
~FALSE~
~If~
~{379AB57C-4A58-412E-BC21-BB2F687281B5}~
~INUSE_RTN~
~0~
~-1~
~FALSE~
~Call DLL Function~
~{831512CD-C982-4678-8DE0-9522BBDA5C21}~
~kernel32.dll,SetFileAttributesA,word,RETURN,"pointer to string",$_INUSE_PATH_$,long,OLD_ATTR,$~
~mDown.dll\mDownExec.dll~
~Call DLL Function~
~{90AA386F-0C67-4FDE-88F0-DC9CC23F9520}~
~kernel32.dll,CreateFileA,long,INUSE_RTN,"pointer to string",$_INUSE_PATH_$,"double word",0xc0000000,"double word",0,"double word",NULL,"double word",3,"double word",0x00000080,"double word",NULL,$~
~mDown.dll\mDownExec.dll~
~Call DLL Function~
~{05BEA11E-F830-41B8-84FD-5C2ED9D5A6E6}~
~kernel32.dll,SetFileAttributesA,word,RETURN,"pointer to string",$_INUSE_PATH_$,long,0x00000080,$~
~mDown.dll\mDownExec.dll~
~Call DLL Function~
~{E39CD12F-E797-44B3-94DD-171082128519}~
~kernel32.dll,GetFileAttributesA,long,GET_FILE_RETURN,"pointer to string",$_INUSE_PATH_$,$~
~mDown.dll\mDownExec.dll~
~If~
~{017CF31D-3F96-45C3-9C15-D1C01095007B}~
~DOESFILEDIREXIST~
~0~
~TRUE~
~FALSE~
~Does File/Folder Exist~
~{58E977B3-3F4A-46B9-BA45-853F0D51531E}~
~DOESFILEDIREXIST~
~$_INUSE_PATH_$~
~TRUE~
~Set Variable~
~{1946218E-DAB2-488E-9C80-A01EE9227BB8}~
~_INUSE_PATH_$MYAH$MYAH$FALSE~
~C:\Windows\notepad.exe~
~Set Variable~
~{3C5BC315-ED4C-40F6-AA98-A0D189C392B7}~
~GET_FILE_RETURN$MYAH$MYAH$FALSE~
~~
~Set Variable~
~{3387F3C4-7921-496C-9A40-C0718E9E6854}~
~RETURN$MYAH$MYAH$FALSE~
~~
~Set Variable~
~{C0758EE8-A860-41BD-8E52-B5400CC4FF70}~
~_INUSE_PATH_$MYAH$MYAH$FALSE~
~~
~Set Variable~
~{8A362509-6EB8-4DAA-BF50-954BB20B5616}~
~INUSE_RTN$MYAH$MYAH$FALSE~
~~


[FrancescoT]

Dear User,

I'm not quite sure what exactly is the purpose of your code.
Anyway, you have not used the correct paremeters type with the WIN API functions.
Also, when the function parameter require an hexadecimal value pass it as decimal.

Said that, your code should like as:

Code: Select all

~InstallAware Clipboard Data~
~MessageBox~
~{775614BF-46C8-4A26-ADF5-51EECB24BD4F}~
~TEST~
~$_INUSE_VAR_$~
~0~
~1~
~~
~Comment~
~{F304D2B4-D9A1-41B1-AC18-85DFC09AA6F7}~
~~
~End~
~{8BD6F36D-1B53-4084-A3CE-ACEED7CCEA9E}~
~Set Variable~
~{55E883A1-2B40-4617-B63F-511E316E2809}~
~$_INUSE_VAR_$~
~Non-Existant~
~Else~
~{7ECA4FCB-1DD8-477A-8C7F-3F5E7A044DC4}~
~End~
~{C7DBEF16-E591-4452-9D3B-CDA0DA322BB7}~
~Set Variable~
~{5E168790-99FD-4D8E-B1E6-D88963E10B05}~
~$_INUSE_VAR_$~
~Not In-Use~
~Call DLL Function~
~{DD033E01-471A-493C-BD2D-51240DE1A9C3}~
~kernel32.dll,CloseHandle,bool,INUSE_RTN,"double word",$INUSE_RTN$,$~
~mDown.dll\mDownExec.dll~
~Else~
~{CF320791-5ED3-4017-98E0-1627B0AA3899}~
~End~
~{6DC81754-8104-4C31-8C76-48AADC78295F}~
~Set Variable~
~{56FD14E8-F9A8-40E7-9AFF-448421C3BBAF}~
~$_INUSE_VAR_$~
~In-Use~
~If~
~{E92498EC-BD2B-469C-8022-3BF9E1748E13}~
~GET_FILE_RETURN~
~0~
~32~
~FALSE~
~If~
~{7334ED3E-0F38-4FF7-B8A9-9BD7B089B752}~
~INUSE_RTN~
~0~
~-1~
~FALSE~
~Call DLL Function~
~{9E4EE50F-1316-46E1-AECE-FD4C88165E9A}~
~kernel32.dll,SetFileAttributesA,bool,RETURN,"pointer to string",$_INUSE_PATH_$,"double word",OLD_ATTR,$~
~mDown.dll\mDownExec.dll~
~Call DLL Function~
~{FDF603C7-D7E3-4EB1-857B-B93FE319F7E5}~
~kernel32.dll,CreateFileA,"double word",INUSE_RTN,"pointer to string",$_INUSE_PATH_$,"double word",3221225472,"double word",0,long,0,"double word",3,"double word",128,"double word",0,$~
~mDown.dll\mDownExec.dll~
~Call DLL Function~
~{717F311D-B042-4937-9C5D-11167400D245}~
~kernel32.dll,SetFileAttributesA,bool,RETURN,"pointer to string",$_INUSE_PATH_$,"double word",128,$~
~mDown.dll\mDownExec.dll~
~Call DLL Function~
~{96882B4E-53A4-4125-AEBB-28FE37E1464F}~
~kernel32.dll,GetFileAttributesA,"double word",GET_FILE_RETURN,"pointer to string",$_INUSE_PATH_$,$~
~mDown.dll\mDownExec.dll~
~If~
~{DFBA37A3-5D40-433F-B3AD-82E9A512CE8D}~
~DOESFILEDIREXIST~
~0~
~TRUE~
~FALSE~
~Does File/Folder Exist~
~{E02EBC0B-0F80-4484-952D-9BE61CE4E3A1}~
~DOESFILEDIREXIST~
~$_INUSE_PATH_$~
~TRUE~
~Set Variable~
~{4EAE1AAD-D8AB-46AC-993C-EFDF01FAF77A}~
~_INUSE_PATH_$MYAH$MYAH$FALSE~
~C:\Windows\notepad.exe~
~Set Variable~
~{C6470027-D143-434A-A871-149AEB32B3C4}~
~GET_FILE_RETURN$MYAH$MYAH$FALSE~
~~
~Set Variable~
~{A499C1A2-9650-4138-962D-B346239E6653}~
~RETURN$MYAH$MYAH$FALSE~
~~
~Set Variable~
~{432E1B77-D371-4E68-9B64-2FDF24EF07F2}~
~_INUSE_PATH_$MYAH$MYAH$FALSE~
~~
~Set Variable~
~{72624C80-29CC-4086-8573-65EFAC46B556}~
~INUSE_RTN$MYAH$MYAH$FALSE~
~~


Please note, that with the code you used (last call to SetFileAttributesA) a variable (OLD_ATTR) that is not declared.

Finally, the way you used to verify the file handle retuned by "CreateFileA" is not correct, that should be:

Code: Select all

~InstallAware Clipboard Data~
~End~
~{812AAEFA-2F4C-42A2-96C9-5BE46342A618}~
~End~
~{46257F50-5414-4C9F-BFCE-8DC4CC9DAFA7}~
~Call DLL Function~
~{A347E536-9942-4370-A5FF-2B255A0C2A86}~
~Kernel32.dll,CloseHandle,bool,RESULT,"double word",$FILE_HANDLE$,$~
~~mIDEFunc.dll\mEXEFunc.dll~~
~Comment~
~{70A747D2-544C-4C17-B594-767554F0E0CE}~
~~
~If~
~{A388EFEE-40F9-46D2-9C28-6DC902D11A84}~
~FILE_HANDLE~
~4~
~4294967295~
~TRUE~
~If~
~{7553A990-262F-4B41-B349-BCB3D321305E}~
~FILE_HANDLE~
~2~
~0~
~FALSE~


The same as redable text:

Code: Select all

if Variable FILE_HANDLE Greater Than 0
 if Variable FILE_HANDLE not Equals (Ignore Case) 4294967295
   Call DLL Function Kernel32.dll->CloseHandle (get result into variable RESULT)
 end
end


*The returned FILE HANDLE is valid if greater then 0 and not Equal to 4294967295.
In C++ is checked as:

Code: Select all

if(FILE_HANDLE != INVALID_HANDLE_VALUE)

Hope this helps you.

Regards

[jdeleon7010]

The whole purpose of the routine is to retrieve the return value of the GetLastError function when calling CreateFileA.

If the return value is ERROR_SHARING_VIOLATION or 32 (0x20), I can determine the file is being used.

I have tried the new code you posted and it doesnt look like its working for me.

In Wise, when calling CreateFileA, there is a GetLastError variable that is generated, it then tells me the error code. HEre is a screenshot.



We use thise routine heavily in our wrappers and I'm hoping there is a work around with Installaware.

[FrancescoT]

Dear User,

In this case call "GetLastError" WIN API for that.
It should work as you used with Wise.

Regards

[jdeleon7010]

Can you post an example on how i will call that?

Code: Select all

~InstallAware Clipboard Data~
~Call DLL Function~
~{A8ADF66B-44C3-4662-A11F-65C7E322EC74}~
~kernel32.dll,GetLastError,"double word",RETURN,$~
~mDown.dll\mDownExec.dll~


[FrancescoT]

Try this:

Code: Select all

~InstallAware Clipboard Data~
~Call DLL Function~
~{18C59BFC-73E5-4C41-B364-DFC2956A2643}~
~Kernel32.dll,GetLastError,"double word",LAST_ERROR,$~
~~mIDEFunc.dll\mEXEFunc.dll~~
~Set Variable~
~{CB06ED50-5A4A-4B90-882C-EAAE8FA2E7D6}~
~LAST_ERROR$MYAH$MYAH$FALSE~
~FALSE~


Obviously call it only if CreateFileA fails and it must be called just after.

From MSDN documentation about CreateFile return value:
If the function succeeds, the return value is an open handle to the specified file, device, named pipe, or mail slot.
If the function fails, the return value is INVALID_HANDLE_VALUE. To get extended error information, call GetLastError.

Regards

[jdeleon7010]

So I decided to right a vbscript to trap the error, here is the code in VBS. Will IA have built in routines for this in the future?

Code: Select all

On Error Resume Next
Const ForAppending = 8

Dim Arg, IN_USE_PATH

Set Arg = Wscript.Arguments
IN_USE_PATH = Arg(0)

Set oFSO = CreateObject("Scripting.FileSystemObject")
Set OutPut = oFSO.OpenTextFile("C:\_TMP\In-Use-Check.txt", ForAppending, True)

Finished = False


   Set InUseFile = oFSO.OpenTextFile(IN_USE_PATH, ForAppending, True)
   If Err.Number = 70 Then
      OutPut.Writeline("In-Use")

   Else
      OutPut.Writeline("Not-In-Use")

   End If
   Err.Clear




[FrancescoT]

Dear User,

happy that you solved.

I will put your suggestion in our list. Actually, I can't say if it will be available and when.

Regards