Code Monkey home page Code Monkey logo

Comments (2)

malxau avatar malxau commented on July 26, 2024

This is crazy. I was expecting to write some kind of "there's no way Yori could do that and I've never seen it" reply, but after reverting to classic Notepad on Windows 11, I saw the same behavior.

To be very clear, this is a Windows problem, not a Yori problem. Yori called CreateProcess with correct parameters. CreateProcess failed randomly. Due to the random nature of the failures, there's not much Yori can do with it.

What's happening: notepad.exe on a Windows 11 system is the traditional, Win32 notepad. When invoked, it launches the new, modern Notepad. This would normally be done with a reparse point, except it can't do that because the file location that would house it contains the Win32 notepad. So instead, the registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe instructs CreateProcess to do something unique rather than execute the program. It goes off searching...for something...the registry key doesn't actually tell it where to look.

Removing the modern notepad application doesn't undo the registry key, so the Win32 notepad is left searching for something it can't find.

Running under the debugger shows this happen. I put a breakpoint when the code starts to complain about not finding things, which ended here:

00 00000082`a859c1f0 00007fff`e1aaa984     KERNELBASE!OutputDebugStringW
01 00000082`a859c1f0 00007fff`e1aaab94     apisethost_appexecutionalias!wil::details::LogFailure+0x324
02 00000082`a859c270 00007fff`e1aa8db4     apisethost_appexecutionalias!wil::details::ReportFailure_NoReturn<0>+0x5c
03 00000082`a859d770 00007fff`e1aa8dd4     apisethost_appexecutionalias!wil::details::ReportFailure_GetLastError<0>+0x64
04 00000082`a859d7c0 00007fff`e1aaf688     apisethost_appexecutionalias!wil::details::in1diag3::_Throw_GetLastError+0x1c
05 00000082`a859d7d0 00007fff`e1aad538     apisethost_appexecutionalias!AppExecutionAliasMetadata::FromFile+0x270
06 00000082`a859d940 00007fff`e1aa5774     apisethost_appexecutionalias!AppExecAliasData::AppExecAliasData+0x80
07 00000082`a859dbe0 00007fff`e1aad9e4     apisethost_appexecutionalias!OpenAppExecutionAliasForUserEx+0x44
08 00000082`a859dc20 00007fff`e1aa5608     apisethost_appexecutionalias!ExtendedAppExecutionAliasInfo::Load+0x54
09 00000082`a859dcb0 00007fff`e1aa7d80     apisethost_appexecutionalias!<lambda_2ca039d371c8e450a7302617fcb08c3c>::operator()+0x430
0a 00000082`a859dda0 00007fff`e1aa51ac     apisethost_appexecutionalias!wil::ResultFromException<<lambda_2ca039d371c8e450a7302617fcb08c3c> >+0x18
0b 00000082`a859ddc0 00007fff`f07e2f08     apisethost_appexecutionalias!LoadAppExecutionAliasInfoEx+0x2c
0c 00000082`a859de00 00007fff`f080d784     KERNELBASE!LoadAppExecutionAliasInfoForExecutable+0xc8
0d 00000082`a859de50 00007fff`f0864a64     KERNELBASE!CreateProcessInternalW+0x24e4
0e 00000082`a859f840 00007fff`f4d73edc     KERNELBASE!CreateProcessW+0x44
0f 00000082`a859f870 00007ff6`0542b310     KERNEL32!#CreateProcessWStub+0x1c
10 00000082`a859f890 00007ff6`053ebcf4     ONEYORI!YoriLibShCreateProcess+0x1d8 [C:\src\Yori\libsh\exec.c @ 558] 
11 00000082`a859f9a0 00007ff6`053eb064     ONEYORI!YoriShExecuteSingleProgram+0x294 [C:\src\Yori\sh\exec.c @ 193] 
12 00000082`a859fa10 00007ff6`053eb7b8     ONEYORI!YoriShExecExecPlan+0x1dc [C:\src\Yori\sh\exec.c @ 436] 
13 00000082`a859fa50 00007ff6`053f4958     ONEYORI!YoriShExecuteExpression+0x160 [C:\src\Yori\sh\exec.c @ 780] 
14 00000082`a859fba0 00007ff6`053f9fc0     ONEYORI!ymain+0xe8 [C:\src\Yori\sh\main.c @ 796] 
15 00000082`a859fbe0 00007fff`f4d023f0     ONEYORI!ymainCRTStartup+0x58 [C:\src\Yori\lib\ep_yori.c @ 64] 
16 00000082`a859fc10 00007fff`f4f1301c     KERNEL32!BaseThreadInitThunk+0x30
17 00000082`a859fc50 00000000`00000000     ntdll!RtlUserThreadStart+0x3c

I don't know why the failure code is random - under the debugger it seems consistent, although I saw the same behavior you did without a debugger.

I suggest you file a feedback item with the Windows folks. There's really two issues here in my opinion: first, the redirection logic isn't removed when the Notepad app is uninstalled; second, the redirection logic seems to have very erratic and inconsistent failures.

That said, removing the registry key should enable it to work correctly.

from yori.

bzzrak avatar bzzrak commented on July 26, 2024

Interesting find, thanks!

Instead of deleting the whole key, it seems like you can just toggle this value, which is cleaner. Either way, works like a charm now.
image

EDIT: filed in the Feedback Hub here

from yori.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.