Why does my IL generated Assembly, ilasm.exe called by C#, need UAC?

Question

I'm trying to compile an IL Code to an Assembly. The ilasm.exe should get called by my C# Application. I'm invoking the ilasm.exe through an ProcessStartInfo Instance. The generation of the PE works fine and my Assembly is working.

My problem is that the files that were created by my application, afterwards need administrator privileges to be executed.

If I call ilasm.exe manually from command line, no admin rights are needed.

Used ilasm.exe command: ilasm.exe /qui /output="c:\test\newFile.exe" <path to il file>

My Application calling the ilasm.exe:

ProcessStartInfo startInfo = new ProcessStartInfo();
startInfo.CreateNoWindow = false;
startInfo.UseShellExecute = false;
startInfo.FileName = @"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe";
startInfo.WindowStyle = ProcessWindowStyle.Hidden;
startInfo.Arguments = ilFilePath + " /qui /output=" + outputPath + "testFile.exe";


try
{
    using (Process exeProcess = Process.Start(startInfo))
    {
        exeProcess.WaitForExit();
    }
}
catch
{
    // Log error.
}

Am I doing anything wrong? Do I need to specify anything else when calling another Process from C#?

I'm running my Application and the commandline without admin rights.

What is the error you receive as non-admin? What is patchFile? You are not calling it identically to how you said you call it from the command line. — Chris Benard, Apr 04 '12 at 00:24
Sorry I forgot to mention some things. patchFile is in this case the path to the file containing the il code. I'm not getting any errors. The Error is that ilasm.exe calls through c# code, afterwards needs admin rights to get executed, while ilasm.exe calls through cmd don't need them. — Patrick Trautmann, Apr 04 '12 at 00:36
If I understand you, you are saying both generate valid EXEs, but the one generated from `Process.Start` makes your computer go *BOOP* and pop the UAC prompt. If that's the case, it sounds like the one from code is embedding the `highestAvailable` `requestedExecutionLevel` explained [here](http://msdn.microsoft.com/en-us/library/bb756929.aspx). If so, I have no clue why it would be different. — Chris Benard, Apr 04 '12 at 00:40

score 4 · Accepted Answer · answered Apr 04 '12 at 00:27

4

It's requiring UAC because you're not supplying a path to a writable location in output, so it's trying to write to the same folder ilasm is in (or the current folder for your app).

A non-admin user doesn't have write access to anything under %WINDIR% (the Windows folder) or %ProgramFiles%, so it's asking for elevation to a user that does have write access to the folder.

answered Apr 04 '12 at 00:27

Ken White

123,280
14
225
444

1

yes I'm sorry. I forgot to declare my variables. An complete generated call from C# would be `ilasm.exe C:\Test\myilcode.il /qui /output=C:\Test\testFile.exe`. The exact called command called by my application needs admin rights afterwards, while the one called manualy from cmd don't. So actually I'm not writing to an System Folder :( – Patrick Trautmann Apr 04 '12 at 00:40
2

OK. I'll leave my answer for now, because it does address the original question as asked and might be useful to someone in the future. (And for future reference, when you have problems it helps get you answers if you provide all of the pertinent information. :) It means people have all the facts before they post answers, which means there's less chance they'll have to delete it afterward when you add details that invalidate the answer.) – Ken White Apr 04 '12 at 00:47
'all of the pertinent information' is relevant, you'll have a howl at my answer :) – Hans Passant Apr 04 '12 at 04:46
I'm sorry. Next time I will be more precise ;) But thank you all for trying to help. – Patrick Trautmann Apr 04 '12 at 11:54

score 1 · Answer 2 · answered Apr 04 '12 at 04:43

What is patchFile?

This comment by @Chris is relevant to this puzzle, I don't see it in the question. You are probably dealing with a difficult problem that Microsoft needed to solve with UAC. Supporting old programs that need UAC privileges but don't ask for it because they were written before Vista. Like installers. And patch programs.

My crystal ball says that your actual program name is not newFile.exe like your question says but has a name like "update.exe" or "patch.exe". And furthermore, it isn't obvious either, that you don't include a manifest in the program you generated. A manifest that says that the program is Vista aware with the <requestedExecutionLevel> element. And furthermore, also not obvious, that when you run this from the command line by hand that you use another name for the .exe.

That's a lot of guesses, but put them together and it makes sense: Windows goes "aha! Old program, sounds like it is going to want to write to .exe files in a restricted directory. Better display the UAC prompt".

Ah, nice catch! I'd forgotten the `update`, `setup`, and `install` filename issues! +1, because you're probably 100% on the money with this "psychic" answer. (I really wish people would post actual code and var contents, anonymising only the absolute minumum, instead of fictionalizing meaningless things to be overprotective. It would make it much easier to catch things like this, I think.) :) — Ken White, Apr 04 '12 at 10:57

Why does my IL generated Assembly, ilasm.exe called by C#, need UAC?

2 Answers2