Trying to make SQL Profiler with TraceServer() C# - c#-4.0

When debug program in line:
reader.InitializeAsReader(ci, #"D:\trace2\trace3.trc");
Exception: FileNotFoundException: Could not load file or assembly 'file:///C:\Program Files (x86)\Microsoft SQL Server\110\Tools\Binn\pfclnt.dll' or one of its dependencies. The system cannot find the file specified.
I try to add references from sql 2012 but still get the error
TraceServer reader = new TraceServer();
ConnectionInfoBase ci = new SqlConnectionInfo();
(ci as SqlConnectionInfo).ServerName = "localhost";
((SqlConnectionInfo)ci).UseIntegratedSecurity = true;
reader.InitializeAsReader(ci, #"D:\trace2\trace3.trc");
int eventNumber = 0;
while (reader.Read())
{
Console.Write("{0}\n", reader.GetValue(0).ToString());
eventNumber++;
if (eventNumber == 10) break;
}

Related

How to solve the driver hanging on sending IRPs to delete EXE files which require Administrator authority?

I want to delete files by sending IRP via a WDK driver. It works well for deleting all files no matter *.pdf or *.pptx, except some EXEs which require Administrator to run, such as EXE installer and setup.exe etc. I don't know why it hangs on IoCallDriver once I try to delete EXE installers. I have also tried to set a timeout for KeWaitForSingleObject but no luck, the driver keeps hanging on IoCallDriver.
Does Windows limit drivers to remove these Administrator authority EXEs? How to solve this? Thanks a lot.
NTSTATUS send_delete_file_irp(PFILE_OBJECT file_object) {
KEVENT event;
PDEVICE_OBJECT device_object = IoGetBaseFileSystemDeviceObject(file_object);
PIRP irp = IoAllocateIrp(device_object->StackSize, false);
// Set the complete routine that will free the IRP and signal the event
KeInitializeEvent(&event, SynchronizationEvent, false);
IoSetCompletionRoutine(
irp,
io_complete,
&event,
true,
true,
true);
FILE_DISPOSITION_INFORMATION file_disposition;
file_disposition.DeleteFile = true;
IO_STATUS_BLOCK io_status_block;
irp->AssociatedIrp.SystemBuffer = &file_disposition;
irp->UserEvent = &event;
irp->UserIosb = &io_status_block;
irp->Tail.Overlay.OriginalFileObject = file_object;
irp->Tail.Overlay.Thread = (PETHREAD)KeGetCurrentThread();
irp->RequestorMode = KernelMode;
IO_STACK_LOCATION* stack_location = IoGetNextIrpStackLocation(irp);
stack_location->MajorFunction = IRP_MJ_SET_INFORMATION;
stack_location->DeviceObject = device_object;
stack_location->FileObject = file_object;
stack_location->Parameters.SetFile.Length = sizeof(FILE_DISPOSITION_INFORMATION);
stack_location->Parameters.SetFile.FileInformationClass = FileDispositionInformation;
stack_location->Parameters.SetFile.FileObject = file_object;
IoCallDriver(device_object, irp);
KeWaitForSingleObject(&event, Executive, KernelMode, true, nullptr);
return STATUS_SUCCESS;
}

Azure Linux App Service with .Net Core Stack. Unable to use NodeJS

I am hosting a .NET Core Application on MS Azure (on a Linux Service Plan) and I want to run some NodeJS code in the .NET Core Application. I did this a while ago on a Windows Service Plan, there it was working. Now I am trying with a Linux Plan and it is not working.
First I was trying to use "Jering.Javascript.NodeJS" and then also "INodeServices" from Microsoft (which is obsolete). But "node" was not found. I also tried to start directly a Process (Code below), but also not working. "node" is not found.
var proc = new System.Diagnostics.Process
{
StartInfo = new System.Diagnostics.ProcessStartInfo
{
FileName = "node",
Arguments = " -v",
RedirectStandardOutput = true
}
};
result += "RUN: " + proc.StartInfo.FileName;
proc.Start();
var reader = proc.StandardOutput;
NodeJS is installed on the server and also the command works there but it seems that the .NET Core app is hosted as docker and does not have any access outside to run NodeJS. Image
I found a useful information here.
The problem is that Node is not present in the container so it is
necessary to have a script to install and start it before starting the
app itself.
Reproduce:
Here is my script:
//using System.Diagnostics;
ProcessStartInfo startinfo = new ProcessStartInfo();
startinfo.FileName = "bash";
//startinfo.FileName = "/etc/opt/nodejs/14.15.0/bin/node"; //it's no use even node package located here.
Process process = new Process();
process.StartInfo = startinfo;
process.StartInfo.UseShellExecute = false;
process.StartInfo.RedirectStandardInput = true;
process.StartInfo.RedirectStandardOutput = true;
process.Start();
//install and start nodejs
process.StandardInput.WriteLine("apt-get install curl");
process.StandardInput.WriteLine("curl -sL https://deb.nodesource.com/setup_12.x | bash");
process.StandardInput.WriteLine("apt-get install -y nodejs");
//Run "node -v"
process.StandardInput.WriteLine("node -v");
string line = string.Empty;
while (!process.StandardOutput.EndOfStream)
{
line = process.StandardOutput.ReadLine();
_logger.LogInformation(line);
}
process.WaitForExit();
return string.Empty;
It works on my .net Core app based on Linux.
I think I found a better solution ;)
In an app service you can mount a storage. In my case I mounted a storage, which contains the nodeJS lib.
Azure Portal Screenshot
Now i can execute the following code:
string result = "";
var proc = new System.Diagnostics.Process
{
StartInfo = new System.Diagnostics.ProcessStartInfo
{
FileName = "/externallibs/node/bin/node",
Arguments = " -v",
RedirectStandardOutput = true
}
};
result += "RUN: " + proc.StartInfo.FileName;
proc.Start();
var reader = proc.StandardOutput;
return result + reader.ReadToEnd();
You can create on azure portal an environment var named POST_BUILD_COMMAND with a command to fix your environment path.
Linux Service Plans runs on Oryx which is documented here
POST_BUILD_COMMAND=PATH=/usr/bin/node:$PATH

Windows UWP CreateFIle2 cannot read file in ApplicationData.LocalFolder

I am trying to build UWP app in C#. My app has a native library written in C++. Whenever the app tries to read a file in ApplicationData.LocalFolder, CreateFile2 api is returning ERROR_NOT_SUPPORTED_IN_APPCONTAINER. The file exists in the path specified to this api.
This is the sequence of operation in my app.
Launch app. App creates file & writes some data
Later on based on user input app tries to read data in this file
Step 1 is working fine. App is able to create the file & write data in it. Only when app tries to access it later on, does it get this error.
I get the path to ApplicationData.LocalFolder using
Windows.Storage.ApplicationData.Current.LocalFolder.Path
This is the actual path I see in the app:
C:\Users\xxxxx\AppData\Local\Packages\ac7a11e4-c1d6-4d37-b9eb-a4b0dc8f67b8_yyjvd81p022em\LocalState\temp.txt
My code is as below:
CREATEFILE2_EXTENDED_PARAMETERS ms_param = {0};
ms_param.dwSize = sizeof(CREATEFILE2_EXTENDED_PARAMETERS);
ms_param.dwFileAttributes = FILE_ATTRIBUTE_READONLY;
ms_param.dwFileFlags = FILE_FLAG_NO_BUFFERING;
ms_param.dwSecurityQosFlags = SECURITY_DELEGATION;
ms_param.lpSecurityAttributes = NULL;
ms_param.hTemplateFile = NULL;
g_hfile = CreateFile2(filename, GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE, OPEN_EXISTING, &ms_param);
if (g_hfile == INVALID_HANDLE_VALUE)
{
return GetLastError();
}
I tried CreateFile2 with both OPEN_EXISTING & OPEN_ALWAYS option for dwCreationDisposition parameter, but I see the same error in either case.
I had similar issue with CreateFile2 earlier. But that was an problem with my app & I have fixed that issue. This time though the file is available within the LocalFolder, still I get the error.
The problem here is related to the dwSecurityQosFlags you've set in CREATEFILE2_EXTENDED_PARAMETERS.
When called from a Windows Store app, CreateFile2 is simplified. You can open only files or directories inside the ApplicationData.LocalFolder or Package.InstalledLocation directories. You can't open named pipes or mailslots or create encrypted files (FILE_ATTRIBUTE_ENCRYPTED).
The dwSecurityQosFlags parameter specifies SQOS information. In Windows Stroe app, we can only set it to SECURITY_ANONYMOUS. Using other flag will raise ERROR_NOT_SUPPORTED_IN_APPCONTAINER exception. This indicates that it is not supported in UWP app.
Following is the code I used to test:
StorageFolder^ localFolder = ApplicationData::Current->LocalFolder;
String^ path = localFolder->Path;
path += L"\\MyFile.txt";
CREATEFILE2_EXTENDED_PARAMETERS ms_param = { 0 };
ms_param.dwSize = sizeof(CREATEFILE2_EXTENDED_PARAMETERS);
ms_param.dwFileAttributes = FILE_ATTRIBUTE_READONLY;
ms_param.dwFileFlags = FILE_FLAG_NO_BUFFERING;
ms_param.dwSecurityQosFlags = SECURITY_ANONYMOUS;
ms_param.lpSecurityAttributes = NULL;
ms_param.hTemplateFile = NULL;
HANDLE g_hfile = CreateFile2(path->Data(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, OPEN_EXISTING, &ms_param);
DWORD error = GetLastError();
If I don't have "MyFile.txt" under LocalFolder, I will get ERROR_FILE_NOT_FOUND exception, otherwise it will be ERROR_SUCCESS.

Bootstrap Uno LibreOffice exception

With the following code:
static void Main()
{
try
{
var context = uno.util.Bootstrap.bootstrap();
}
catch (Exception ex)
{
Console.WriteLine(ex.toString());
}
}
This code works fine in win 7 but getting "SEH Exception handled by user code External component has thrown an exception".
Lastest Version:Libreoffice 5.0.3.2..Please help me to resolve this problem immediately.
Look the response of another topic:
Bootstrap Uno API LibreOffice exception
var unoPath = #"C:\Program Files\LibreOffice 5\program"
// when running 32-bit LibreOffice on a 64-bit system, the path will be in Program Files (x86)
// var unoPath = #"C:\Program Files (x86)\LibreOffice 5\program"
SetEnvironmentVariable("UNO_PATH", unoPath, EnvironmentVariableTarget.Process);
SetEnvironmentVariable("PATH", GetEnvironmentVariable("PATH") + #";" + unoPath, EnvironmentVariableTarget.Process);````

how to use ssdt hook tech to intercept the operations of creating new folders?

I hooked native api ZwCreateFile, and wdk doc says windows use ZwCreateFile to create or open a directory. I can detect the operation of opening testdir, but i failed to stop the open directory operation.
My code of my own FakeZwCreateFile like this:
NTSTATUS FakeZwOpenFile(
OUT PHANDLE FileHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG ShareAccess,
IN ULONG OpenOptions
)
{
NTSTATUS rtStatus = STATUS_SUCCESS;
UNICODE_STRING test = RTL_CONSTANT_STRING(L"\\??\\c:\\testdir");
if (!RtlCompareUnicodeString(ObjectAttributes->ObjectName, &test, TRUE))
{
DbgPrint("%wZ\n", &test);
FileHandle = NULL;
IoStatusBlock->Status = rtStatus = STATUS_ACCESS_DENIED;
goto exit;
}
Orig:
OrigZwOpenFile = (NTOPENFILE)oldServiceAddr[SYSTEM_INDEX(ZwOpenFile)];
rtStatus = OrigZwOpenFile(
FileHandle,
DesiredAccess,
ObjectAttributes,
IoStatusBlock,
ShareAccess,
OpenOptions
);
exit:
return rtStatus;
}
Why i failed to stop opening the c:\testdir directory?? And what shoud i do to intercept the operations of creating new folders????
In this case is better to use File System Filter Drivers instead of SSDT hooking, Because FS Filter Drivers work correctly in 64Bit version of windows but SSDT only can use in 32Bit (If you can bypass windows Patch Guard then you can use SSDT hook in 32Bit) !

Resources