projector cannot launch .exe under Vista

[svillee]

I have a Flash CS3 application that tries to launch an executable (setupreia14.exe). The application is published as a projector using Flash Player 9. It works fine under XP and 2000, but fails under Vista where it does nothing.

I'm using ActionScript 3.0. Here is the call that tries to launch the executable:

flash.system.fscommand("exec", "setupreia14.exe");

I have looked at several Northcode blog entries that discuss fscommand bugs, but none of them are applicable to this case. I want to emphasize that I'm trying to launch a .exe, not a .bat. I haven't been able to figure out which specific version of Flash Player 9 I'm using. But I don't think it could be the known problem in v9.0.115.0 (http://kb.adobe.com/selfservice/view...alId=kb403072), because it works fine under XP and 2000.

I can't use externalInterface because that doesn't work in a projector.

If anyone has any ideas on what the problem could be, or how to solve it, I would love to hear from you. Thanks.

[Northcode]

The problem is with the name of the EXE that you're trying to laucn, "setupreia14.exe". Vista sees the "setup" part of the name and assumes that this is some kind of setup/installer application and that it's going to require admin rights. If you look at the icon on the EXE it should have a little security shield that Vista adds. You can solve your problem immediately by renaming the EXE and avoiding special strings in the name like "setup" and "install".

[svillee]

Thanks for the reply. Actually, the program I'm trying to launch really is a setup application, and really does need to run as administrator. The name of my Flash projector program is setup.exe, and I originally thought that would be enough to get Vista to run it as administrator.

But I found the problem. Flash includes a manifest in the projector with requestedExecutionLevel=asInvoker. This overrides the name "setup.exe". I don't know how to get Flash not to include this manifest, or to include one that says requestedExecutionLevel=asAdministrator instead. However, there are some manifest editor utilities out there, so I'll try one of those.

[Northcode]

You can always use something like Resource Hacker to remove the manifest from the Flash projector to make sure it will inherit the callers privilege level.

If your application is running elevated then the applications it launches should be elevated as well. No matter what you do, you won't be able to start an app that requires admin rigths from one that doesn't have admin rights.

That's not entirely true, but true enough. If you really care about the "why" then read on...

The EXEC fscommand uses the Win32 CreateProcess API which won't display UAC prompts, so apps that require elevation will fail. You don't ever want to allow a child process to have a higher privilege level than the caller, it leaves the door open for elevation hacks.

If you use the Win32 ShellExecute API then a UAC prompt will be displayed because the new process is not a chilld of the caller and the user HAS to confirm the elevation of the new process. The only way you can do this from Flash would be to put the call to launch your EXE in a BAT file and start that from Flash.

[svillee]

Resource Hacker did the trick. The level actually needs to be "requireAdministrator" instead of "asAdministrator". Anyway, thanks for the pointer.

[marklett]

Hi Guys,

Can you please copy and paste the full manifest?

I've got my projector and subsequent EXE file stored in the "fscommand" directory working fine under Win 2k and XP, but really need it working in Vista too.

[Northcode]

This is a pretty generic manifest file (it's XML) that sets the requested privilege level to "requireAdministrator" instead of the more commonly used "asInvoker". Replace the bold items (application name and description) with your own values.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

  <assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="application.exe" type="win32" /> 

  <description>your description goes here</description> 

  <dependency> 
    <dependentAssembly> 
      <assemblyIdentity
        type="win32" 
        name="Microsoft.Windows.Common-Controls" 
        version="6.0.0.0" 
        processorArchitecture="X86" 
        publicKeyToken="6595b64144ccf1df" 
        language="*" /> 
    </dependentAssembly> 
  </dependency> 

  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">  
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>

</assembly>

[bhwong]

UAC (User Access Control) is a very frustrating security enhancement for Vista (and above) that execute applications using standard user rights even if you login as administrator.

Since Adobe Flash publish it's projector without administrator rights in it's manifest, it won't be able to launch installers that require administrator rights.

Amending the manifest of the flash projector to request for administrator rights execution level is a good workaround. Unfortunately and the funny thing is, some installers that do not need administrator rights to execute may fail to run or even hang up when launched with administrator rights from the flash projector!

If a flash projector has 2 installers to launch whereby one require administrator rights and the other don't, how can we resolve the problem?

Administrator rights is easily passed on to the installer using elevated mode in vista. But is it possible to UN-elevated a installer (run without administrator rights) launched from flash with administrator rights? Is there any alterative apart from using the non-UAC compatible fscommand actionscript?

Since Adobe Flash is not UAC compatible. It can no longer be used as interface to launch installer for Windows Vista and Windows 7, isn't it?