Delphi on Remko's Blog

RAD Studio Tokyo 10.2(.2) Data Collection

Mon, 18 Dec 2017 12:10:51 +0000

Just a very quick note: I was just installing RAD Studio 10.2.2 when I noticed the installer has an Options button:

So I clicked it to see what options are available and noticed that the "Embarcadero Customer Experience Program" is opted-in by default:

Returning a string from unmanaged dll to .net

Wed, 13 Mar 2013 10:01:31 +0000

I write most of my code in unmanaged languages such as Delphi and C/C++. Sometimes customers ask me to interface my code to their .net code in which case I create a dll for them.

A recurring thing is that I need to return string to .net.

There are many ways to do this of course but in all cases we need to manage memory: who will allocate the memory for the string and who is responsible for freeing it?

Get Process Id of a running Service

Wed, 28 Nov 2012 12:20:40 +0000

Sometimes you need to know the Process Id (PID) of a running service. Since Windows 2003 you can use the tasklist.exe tool with the /SVC switch. But how to do this programmatically?

The QueryServiceStatusEx API returns a SERVICE_STATUS_PROCESS structure that contains the PID.

Decoding Citrix IMA Datastore Password

Tue, 29 May 2012 21:46:30 +0000

This morning Arjan Beijer sent me an interesting link to a youtube video about obtaining the Citrix IMA Datastore password using Windbg.

The video shows a method, discovered by Denis Gundarev to obtain the IMA Datastore password. Basically he uses DSMaint.exe and set’s a breakpoint on the call to CryptUnprotectData and then reads the password from memory.

I tried to call the CryptUnprotectData API with the data read from the registry directly but this failed with error NTE_BAD_KEY_STATE, this is defined in winerror.h and it means “Key not valid for use in specified state”.

Citrix Launcher Progress Update 1

Thu, 17 May 2012 23:19:12 +0000

After figuring out how to encode and decode the Citrix passwords my next step for the upcoming Citrix Launcher is experiment with config.xml and authenticating to the Citrix Web Interface.

I imported the NFuse.dtd from the Citrix Web Interface into Delphi with the XML Data Binding Wizard. The results in an NFuse Unit so I can easily create the XML data.

To create an authentication packet I use the following code:

Switching to the Services Session

Fri, 24 Feb 2012 14:49:21 +0000

Just read a tweet from @andyjmorgan about Interactive Service Detection. This made me remember that it's possible to switch to the Session 0 with an undocumented api in winsta.dll.

For this API to work you must have the Interactive Services Detection (UI0Detect) service running.

GetUserObjectInformation fails with Access Denied

Tue, 16 Aug 2011 21:11:01 +0000

Today I was reusing some old (pre vista) code the retrieves the Logon SID that I wrote a few years ago. The Logon SID is a special SID that identifies a logon session that has the form S-1-5-5-X-Y.

You can view your Logon SID with Process Explorer, right click a GUI process, select Properties and goto the Security Tab:

Programmatically Check if User Account Control is Enabled

Thu, 11 Aug 2011 11:27:13 +0000

Snippet below can be used to programmatically determine if User Account Control is enabled:

objectpascal Download

uses
 JwaWinbase, JwaWinNt;

function IsUACEnabled: Boolean;
var
 hToken: THandle;
 tet: TOKEN_ELEVATION_TYPE;
 dwSize: DWORD;
begin
 Win32Check(OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, hToken));
 // TokenElevationType class only available on Vista+
 Win32Check(GetTokenInformation(hToken, TokenElevationType, @tet, SizeOf(tet), dwSize));

 Result := tet <> TokenElevationTypeDefault;
end;

1 Comments

GetTokenInformation with TokenLinkedToken returns error 1312 Aug 11, 2011
[...] specified logon session does not exist. It may already have been terminated.”So you should check if User Account Control is enabled in such cases (or make this error non critical).share: Bookmark on Delicious Digg this post [...]

Delphi TSaveDialog doesn’t work on Windows PE

Tue, 21 Jun 2011 15:03:07 +0000

In my SATA Controller Identification tool I was using the TSaveDialog (Delphi 2010) but I got a report that under Windows PE the dialog is never shown.

There’s no exception and I didn’t really bother to check why it fails. Instead I decided to replace it with the GetSaveFileName API which does work under Windows PE.

Determining stack size

Fri, 27 May 2011 15:10:00 +0000

I just read an answer on StackOverflow with this code:

objectpascal Download

var
 eu:DWORD;
begin
 asm
 mov eax,[fs:$4]
 mov ebx,[fs:$8]
 sub eax,ebx
 mov eu,eax
 end;

 ShowMessage(IntToStr(eu));
end;

Unfortunately it lacked explanation, so what does this code do?

How Outlook and Exchange handle Timezones

Wed, 18 May 2011 19:53:27 +0000

Again an old war story, this time about timezone handling in Outlook/Exchange.

I am not sure which year it was but I had just started to work for a new company and inherited an Exchange 5.5 Server.

The mail had been migrated from an earlier version and calendar data was migrated from Schedule+.

On the first change to Daylight Savings (DTS) all recurring appointments where shown one hour later (or earlier can't remember) in Outlook. A manual change was not an option: there were over 2000 mailboxes each with a lot of appointments.

We first tried a workaround by disabling DTS on the the workstations and then manually change the time when changing from and to DTS.

But this influenced the timestamps on externals mails and of course appointments with external parties.

After a lot of (and I really mean a lot) of researching I found that Outlook stores all times in an appointment as relative (UTC) time.

Upon display it uses an undocumented TimeZone descriptor field to convert to Local Time.

Programmatically determine if we run server core

Tue, 17 May 2011 21:32:22 +0000

If you want to check if you are running on a Server Core edition of Windows you can use the GetProductInfo API.

GetProductInfo takes 4 input parameters that can be obtained using GetVersionEx and the OSVERSIONINFOEX structure:

objectpascal Download

var
 osvi: OSVERSIONINFOEX;
begin
 ZeroMemory(@osvi, SizeOf(osvi));
 osvi.dwOSVersionInfoSize := SizeOf(osvi);
 Win32Check(GetVersionEx(osvi));

No we call GetProductInfo:

objectpascal Download

var
 dwProdType: DWORD;
begin
 Win32Check(GetProductInfo(osvi.dwMajorVersion, osvi.dwMinorVersion,
 osvi.wServicePackMajor, osvi.wServicePackMinor, dwProdType));

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 3 (implementation details)

Thu, 03 Mar 2011 13:00:46 +0000

In the previous parts (part 1 part 2) i’ve described the theoretical part and implementation problems. So, now we can write the code:

In case we login the user, we just call LsaLogonUser to get the token:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 2 (problems and workarounds)

Wed, 02 Mar 2011 00:10:02 +0000

In part 1 I’ve described the theoretical parts needed for a custom autologon application implementation.

But there are some practical problems which I will describe here.

I use the LsaLogonUser function to log in the user. However, if I do not pass not null for the LocalGroups parameter, msgina.dll fails to process the logon.

Why? Because it looks for the SE_GROUP_LOGON_ID SID and treat it as logon SID. So we have to add the logon SID manually:

Autologon user on Windows XP/2003 using AutoReconnect pipe - part 1 (theory)

Mon, 28 Feb 2011 10:46:29 +0000

Windows XP introduced the ability to use Fast User Switching (FUS from here on), which is implemented using Terminal Services.

But in some cases (i.e. when FUS is not enabled, or when you connect to the console in Windows 2003 server), the Winlogon process in an RDP session needs to transfer credentials to Session 0.

Although not documented in MSDN, the process of transferring credentials is described by Keith Brown in the June 2005 issue of MSDN magazine: Customizing GINA, Part 2.

WlxQueryConsoleSwitchCredentials and WlxGetConsoleSwitchCredentials are used in the transfer with the semi-documented WLX_SAS_TYPE_AUTHENTICATED SAS code constant.

Internally, winlogon.exe uses a Named Pipe, \.\Pipe\TerminalServer\AutoReconnect, to implement both of these functions.

The pipe format is described in this structure:

Querying a user token under 64 bit version of 2003/XP

Sat, 29 Jan 2011 22:17:52 +0000

If you want to obtain a user’s token in a Terminal Server or Citrix session (eg to launch a process in a session) you can call the WTSQueryUserToken function.

On the x64 versions of Windows XP and Server 2003 this function fails however and returns ERROR_INSUFFICIENT_BUFFER ("The data area passed to a system call is too small.") when called from a 32 bit process.

Internally WTSQueryUserToken calls the undocumented function WinstationQueryInformationW with the WinStationUserToken class (14) and passing a WINSTATIONUSERTOKEN struct, filled with caller ProcessId and ThreadId.

But on x64 Windows the size of this structure is 24 bytes, while on 32 bit Windows the size of the structure is 12 bytes!

Determine the System Page Size

Mon, 24 Jan 2011 15:46:58 +0000

Just a quick note: if you want to determine the page size of the OS (Windows) you can use the GetSystemInfo function.

Example:

objectpascal Download

var
 SystemInfo: SYSTEM_INFO;
 PageSize: DWORD;
begin
 GetSystemInfo(SystemInfo);
 PageSize := SystemInfo.dwPageSize;

Note that MSDN recommends to use the GetNativeSystemInfo function when running in a 32 bit app on an x64 OS (and you can use the IsWow64Process function to determine that).

Enumerating Session Processes with NtQuerySystemInformation

Thu, 20 Jan 2011 15:34:23 +0000

As you may know, you can enumerate processes of a specific Terminal Server or Citrix session using the NtQuerySystemInformation function.

On x86 system the code below works fine:

objectpascal Download

var
 Status : NTSTATUS;
 RetLength : DWORD;
 SessionInfo : SYSTEM_SESSION_PROCESS_INFORMATION;
 CurrentProcess : PSystemProcesses;
begin

 SessionInfo.SessionId := SessionId;
 SessionInfo.Buffer := nil;
 SessionInfo.SizeOfBuf := 0;

 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 while (Status = STATUS_INFO_LENGTH_MISMATCH) do
 begin
 SessionInfo.SizeOfBuf := RetLength;
 SessionInfo.Buffer := GetMemory(RetLength);
 try
 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 if NT_SUCCESS(Status) then
 begin
 CurrentProcess := SessionInfo.Buffer;
 while True do
 begin
 // Your code here

 if (CurrentProcess^.NextEntryDelta = 0) then
 Break;

 Cardinal(CurrentProcess) := Cardinal(CurrentProcess) + CurrentProcess^.NextEntryDelta;
 end;

 Exit;
 end;
 finally
 FreeMemory(SessionInfo.Buffer);
 end;
 end;

 SetLastError(RtlNtStatusToDosError(Status));
 RaiseLastOSError;
end;

While this works fine on Windows XP and 2003 x86, it fails to work correctly on the x64 versions of Windows XP and 2003 (or maybe even higher).

The problem is that RetLength is always SizeOf(SYSTEM_SESSION_PROCESS_INFORMATION) and thus we are in an endless loop!

Convert Drive Bitmask to Drive Letter

Fri, 14 Jan 2011 11:06:03 +0000

I was writing a test program that will perform some actions when a USB Memory Stick is inserted.

When this happens Windows send a Broadcast a WM_DEVICECHANGE message.

The wParam member of this Message contains a (pointer to) a DEV_BROADCAST_HDR structure.

if the dbch_devicetype member of this structure is of type DBT_DEVTYP_VOLUME then we can cast the structure to DEV_BROADCAST_VOLUME.

Cannot Access Files, But Need the Origin?

Mon, 03 Jan 2011 09:52:20 +0000

Have you developed an application that accesses files and may stop because a file cannot be accessed but you need to?

Since Windows Vista it is possible to find out the name of the application which holds open a file.

Packaging an Application that uses the BDE

Tue, 14 Dec 2010 21:12:58 +0000

Today I needed to package an application that uses the Borland Database Engine (BDE).

The BDE is a database engine/connectivity component commonly used in Delphi and C++ Builder applications. It has been deprecated since 2000 when it was replaced by dbExpress.

But it’s still widely used so you may still find applications that require the BDE.

In my environment I already have a package for the BDE itsself. But the application I needed to package today, needs to have an Alias addded.

This is usually done manually by going into the BDEADMIN control panel applet or by copying the file where BDE saves the aliases (IDAPI32.CFG).

Here is a screenshot of the Alias my application needs (it uses an Interbase database):

I didn’t like the copy approach and didn’t even consider the manual option so I wrote 2 little tools.

Altiris Job Builder

Tue, 23 Nov 2010 10:26:34 +0000

I have created a little tool for myself that I have call Altiris Job Builder, it retreives the Jobs from the Altiris database and shows them in a Treeview.

Then I can assemble a Master Build Job by dragging the needed Jobs to another Treeview on the right. Since it’s just for me it doesn’t have a fancy gui:

So why did I write it? Well I have divided my Jobs into Prerequisites and Packages, for instance IIS and Terminal Server and Java are prereqisuites for Citrix. But many prereqisuites are required for one or more other packages, eg Java is also used for certain applications.

The case of the VMware vSphere Client

Wed, 27 Oct 2010 21:59:32 +0000

Today I connected with my laptop to VMWare Virtual Center using vSphere client. Because I had an older version of the client I needed to update and the installer failed with this message:

I remembered this error from the last install of this client (about a year ago), it happens because Microsoft Visual J# was already installed (in my case it was previously installed by Embarcadero’s Rad Studio).

Last year I “fixed” it by modifying the msi file but I remembered that Assarbad posted an easier solution on his Blog a while ago.

His solution was to set a public property in the MSI (USING_VIM_INSTALLER) but it means we need to unpack the installer exe first to obtain the MSI file.

Compatibility Issue with RAD Studio XE

Thu, 02 Sep 2010 19:50:42 +0000

After launching the newly installed RAD Studio XE for the first time it tried to install something. This failed because I didn't run it elevated which makes Windows 7 fire the Program Compatibility Assistant:

It would be better for Embarcadero to detect if we run elevated and only run the installer when we are (or request elevation).

RAD Studio XE destroys RAD Studio 2010?

Thu, 02 Sep 2010 19:46:08 +0000

Just noticed this is my Start Menu after installing RAD Studio XE:

Luckily Clicking Delphi XE launches 2010...

2 Comments

Chris Sep 10, 2010
It seems harsh to state it 'destroys" RAD Studio 2010 when a shortcut label changes, but points to the right place.

Fun with asm

Fri, 18 Jun 2010 12:02:00 +0000

Today just some fun stuff with ASM, probably not the most recommended way to do things but for sure the most geeky way :P

Get the Current Session Id:

objectpascal Download

function GetCurrentSessionId: DWORD;
asm
 mov eax,fs:[$00000018]; // Get TEB
 mov eax,[eax+$30]; // PPEB
 mov eax,[eax+$1d4]; // PEB.SessionId
end;

Get the Current Console Session Id:

Obtain Fully Qualified Domain Name from Netbios Domain Name

Thu, 17 Jun 2010 14:34:42 +0000

I needed to obtain the Fully Qualified Domain Name (FQDN) for a given NetBios domain name. Eg from MYDOMAIN to dc=mydomain,dc=local.

I did some tests with the TranslateName API and if you append a \ to the domain name it returns the FQDN.

Here is a short example:

Memory Leaks when using the Virtual TreeView Component

Wed, 09 Jun 2010 09:50:49 +0000

Again a about post about using the Virtual TreeView component (did I mention it’s brilliant?), this time I will talk about memory leaks.

I often use Records to hold the treedata, and usually the record holds some string data (eg a caption) and an (a reference to) an Interface or Object(List) that holds more data.

If you are familiar with Virtual Tree then you know that you must can the NodeData in the OnFreeNode event.

Setting ChildCount in a Virtual Tree

Tue, 08 Jun 2010 17:39:57 +0000

When working with the Virtual TreeView component the most optimized way of adding (or removing child nodes is by changing the ChildCount.

I often make the mistake of change the ChildCount of a Node using:

objectpascal Download

Node^.ChildCount := Count;

If you look into the source you will see why this will not work, the proper way is:

Random Active Directory Notes #4

Tue, 30 Mar 2010 15:04:51 +0000

Previously I discussed IDirectoryObject, today I will show how to change a user’s password with IDirectoryObject.

I didn’t find any documentation except a kb article describing how to use pure ldap to do it. Of course I could have used IADsUser::SetPassword but I decided not to because of the following reasons:

IADs interfaces are terribly slow (although for one use you probably wouldn't really notice).
IADsUser::SetPassword tries 3 different methods to set the password (ldap over ssl, kerberos and finally NetUserSetInfo) which makes it even slower (most domain controllers do not have an ssl certificate) and unpredictable.

All example code I found was .NET based using the .NET wrappers for Active Directory and seemed to be meant for use in Adam rather than full Active Directory (it set port number to 389 and password mode to cleartext).

In the end it’s not very difficult but nonetheless it took me a while before I got it right.

We can write to the unicodePwd attribute which wants the password as a double quoted unicode string. If you look at this attribute with AdsiEdit you’ll see that the type is Octet String and that it can be written only.

I was tricked with Delphi’s QuotedStr function for a while because it doesn’t return a double but single quoted string ;-)

Below a small snippet from the upcoming JwsclActiveDirectory that shows how to use it:

Using Windows Resource Strings

Sun, 28 Mar 2010 10:45:05 +0000

A few days ago I wrote about Using Windows Dialogs in your own programs, wouldn’t it be nice to be able to use Windows Resource Strings for the same reasons?

Loading a resource string is not difficult, let’s look at some examples:

Using Windows Dialogs from Delphi

Wed, 24 Mar 2010 11:48:41 +0000

Today I reused a unit I wrote a long time ago for TSAdminEx that shows Resource Dialogs from DLL’s or Executables. I wrote it for a couple of reasons:

Reusing existing dialogs is conventient since the user already knows it.
Windows takes care of translating it into the user's language.
I am too lazy to recreate them ;-)

The code is hardly rocket science and could probably be improved and made more sophisticated but it works for me. I decided to share it since you may find it usefull.

Here is a small usage example that shows the Reset Password dialog from Active Directory Users & Computers. This dialog is in dsadmin.dll (on Windows Vista/7 you will find it in ds.admin.dll.mui in the language subfolder eg %systemroot%\system32\en-US but you can load it using just the dll name).

It looks like this:

c Download

215 DIALOGEX 0, 0, 252, 139
STYLE DS_MODALFRAME | DS_CONTEXTHELP | WS_POPUP | WS_CAPTION | WS_SYSMENU
EXSTYLE WS_EX_CONTEXTHELP
CAPTION "Reset Password"
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
FONT 8, "MS Shell Dlg"
{
 CONTROL "&New password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 10, 79, 10
 CONTROL "", 220, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 7, 153, 14
 CONTROL "&Confirm password:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 28, 79, 10
 CONTROL "", 222, EDIT, ES_LEFT | ES_PASSWORD | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 92, 25, 153, 14
 CONTROL "&User must change password at next logon", 261, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 7, 46, 237, 10
 CONTROL "The user must logoff and then logon again for the change to take effect.", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 14, 61, 231, 8
 CONTROL "", 8327, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 7, 76, 238, 16
 CONTROL "Unlock the user's &account", 8328, BUTTON, BS_AUTOCHECKBOX | BS_LEFT | BS_TOP | BS_MULTILINE | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 14, 96, 230, 10
 CONTROL "OK", 1, BUTTON, BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 140, 118, 50, 14
 CONTROL "Cancel", 2, BUTTON, BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 195, 118, 50, 14
}

Random Active Directory Notes #3

Mon, 22 Mar 2010 22:57:30 +0000

Last time I talked briefly about IDirectoryObject and IDirectorySearch, let’s go into a little more detail today.

IDirectoryObject is an Interface that we can use to query anything in Active Directory, users, groups, organizational units, containers and so on.

I thought the best explanation would be to build a very small sample project, so let’s do that!

First we need some units, so please add the following units to your uses clause:

ComObj (for EOleException and it calls CoInitialize for us)
JwaWindows for the proper Adsi declarations

Next declare the following types:

objectpascal Download

type
 // For Delphi < 2009 use WideString
 UString = {$IFDEF UNICODE}UnicodeString{$ELSE}WideString{$ENDIF};

 // Array of ADS_ATTR_INFO records
 TAdsAttrInfoArray = array[0..ANYSIZE_ARRAY-1] of ADS_ATTR_INFO;
 PAdsAttrInfoArray = ^TAdsAttrInfoArray;

Random Active Directory Notes #2

Fri, 12 Mar 2010 16:57:32 +0000

If you have ever used Adsi you have probably used the IADs interface or derived interfaces such as IADsUser or IADsGroup (maybe even without realising this).

What you need to know is that these interfaces were created to support scripting languages such as VBScript. The reason is that these scripting language have no support at all for structures such as ADSVALUE and don’t work with Pointers.

Random Active Directory Notes

Wed, 10 Mar 2010 11:19:29 +0000

I am working on an Customer Management Console that will present all adminstrative tasks that customers will need in their environment in a single console.

It will handle Active Directory, Terminal Server and Citrix, Printers and will offer specific Views and Reporting. For the Active Directory stuff I decided to create some classes that enabled me to work with AD in a more Delphi OOP way.

Random Active Directory Notes #1

Wed, 10 Mar 2010 11:11:13 +0000

If you are going to use the Active Directory Service Interface (ADSI) in Delphi, the first thing you will need is the typelibrary (TLB). This TLB is in the windows\system32 folder and has the name activeds.tlb.

We can import this tlb in Delphi (the procedure differs somewhat, depending on the Delphi version), but there are quite some problems with the resulting pas file of this import:

Ugly and non meaningfull names such as __MIDL___MIDL_itf_ads_0000_0000_001.
Record sizes are sometimes (read: usually) wrong due to alignment errors.
Some Interfaces have wrong declarations resulting in Access Violations or just hard to use (eg using var for input parameters).
Delphi works with Typed Pointer but since it has no clue on the proper name it uses PUserTypexx (eg PUserType1 = ^_ADS_CASEIGNORE_LIST). It's hard to recognise later on what the real type is.

A version of the imported tlb is also in the Jedi Apilib (JwaAdsTLB) and basically it had the same errors. Because I was wondering how this would work in c++ I checked the SDK and found the header file Iads.h.

Did you make a SasLibEx enquiry? And... news!

Mon, 22 Feb 2010 14:07:28 +0000

My hoster has had some problems with the simulatesas.com domain that I use for SasLibEx enquiries. If you have sent mail to that has not been answered I kindly request you to send it again.

I would also like to briefly tell you about an upcoming new release of SasLib, version 2.0. There is so much I would like to tell you about it but I will limit it to a few highlights here and save the rest for the upcoming website on SimulateSAS.com.

displayNotification: Out of memory error when starting Delphi 2010

Wed, 17 Feb 2010 11:16:29 +0000

Delphi 2010 crashed when starting, it was clear that this was happening when opening the welcome page.

Just before the crash an error message "Message from webpage, displayNotification: Out of memory" was displayed.

This post on the Embarcadero Developer Network which was one of the first hits in Google showed that the solution was to clear Internet Explorer's Browsing History (Temporary Internet Files). This fixed it for me.

Reading accountExpires attribute from Active Directory (in Delphi)

Wed, 10 Feb 2010 15:11:48 +0000

I am writing a class that wraps Active Directory into Objects that live in an Objectlist, much like my Terminal Server class in the Jedi Windows Security Library.

One of the classes is TJwADUser that represents an Active Directory user with all kinds of properties. So while I was implementing them I stumbled upon the accountExpires attribute which is implemented as an 8 byte integer so I figured I could read it as Int64, cast this to TFileTime (FILETIME) and convert to TDateTime.

Small LaunchRDP Update

Fri, 06 Nov 2009 22:44:27 +0000

For a long time now people have asked for a version of LaunchRDP that includes the Connection Bar. The original version was originally written for a very specific purpose and I never anticipated so many people would want to use it. But it seems that a lot of people like the Connection Bar (I hate it, especially with sessions in sessions, so that’s why I am using RDPWithLocalTaskbar).

Sending WM_KEYDOWN or WM_KEYUP

Mon, 30 Mar 2009 22:57:28 +0000

If you read the MSDN documentation of WM_KEYDOWN and WM_KEYUP you can see that those message require us to interpret lParam as a bitfield:

lParam Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag, as shown in the following table.
0-15
Specifies the repeat count for the current message. The value is the number of times the keystroke is autorepeated as a result of the user holding down the key. The repeat count is always one for a WM_KEYUP message.
16-23
Specifies the scan code. The value depends on the OEM.
24
Specifies whether the key is an extended key, such as the right-hand ALT and CTRL keys that appear on an enhanced 101- or 102-key keyboard. The value is 1 if it is an extended key; otherwise, it is 0.
25-28
Reserved; do not use.
29
Specifies the context code. The value is always 0 for a WM_KEYUP message.
30
Specifies the previous key state. The value is always 1 for a WM_KEYUP message.
31
Specifies the transition state. The value is always 1 for a WM_KEYUP message.

I was looking for a convenient way to get and read the bits and this is what I made up:

Reading physical memory size from the registry

Fri, 20 Mar 2009 13:15:46 +0000

I’m working on a new build of TSAdminEx for which I need to query the total amount of physical memory. Locally we can use the GlobalMemoryStatusEx API but there’s no API to do this remotely. It would be possible using WMI but I decided not to use that because I dislike it because of it’s slowness and I need support for older OS versions which might not have WMI.

So I found in the registry the following key:

HKLM\HARDWARE\RESOURCEMAP\System Resources\Physical Memory

It has a value .Translated of type RES_RESOURCE_LIST which seems undocumented besides stating that it exists. Regedit knows how to handle it though. If you doubleclick on the key you will see something like this:

Accessing kernel objects in other sessions part 2

Tue, 03 Feb 2009 14:36:53 +0000

In part 1 I showed how to create and open objects in Terminal Server Sessions. However, these are not all of the possible places where you can place objects via documented kernel32.dll functions.

If we look into Winobj again, we notice, that every BaseNamedObjects directory has a subdirectory named Restricted. To be honest, I do not know why it’s created; it’s security allows object creation for LocalSystem and RESTRICTED special user (in windows 2000, Everyone can also create objects in it). So, we can use it as prefix for object creation, for example, Restricted\MyAppEvent:

Of course, you can still use Global, Local, or Session links

Accessing kernel objects in other sessions part 1

Tue, 27 Jan 2009 19:43:52 +0000

As you know, many kernel32.dll functions, which are working with named objects, like OpenEvent, can be used to work with global and local objects. So what are global and local objects? Global objects are created in session 0 and are actually located in the \BaseNamedObjects directory, while local objects are created in the caller’s session (for example in the \Sessions\5\BaseNamedObjects directory (for session 0, global and local has no meaning since they point to the same object)). MSDN says that you can access only the objects in your own session(via the Local</strong> prefix) and in session 0 (via the Global</strong> prefix). But what if you need to access an object in another session?

Locking a workstation - part 2

Tue, 23 Dec 2008 17:13:37 +0000

In part 1 I showed how winlogon.exe registers its process and main window handle.

In the SasCreate function, winlogon.exe registers hotkeys like this:

objectpascal Download

const MOD_SAS = $8000; RegisterHotKey(SasWindow, 0, MOD_SAS or MOD_CONTROL or MOD_ALT, VK_DELETE); {$IFDEF CHECKED_BUILD} RegisterHotKey(SasWindow, 1, MOD_ALT or MOD_CONTROL or MOD_SHIFT, VK_DELETE); // handler just calls NtShutdownSystem if EnableDesktopSwitching then RegisterHotKey(SasWindow, 2, MOD_ALT or MOD_CONTROL, VK_TAB); // handler switches default and winlogon desktops if WinlogonInfoLevelFlag then RegisterHotkey(SasWindow, 3, MOD_ALT or MOD_CONTROL or MOD_SHIFT, VK_TAB); // handler just calls DebugBreak {$ENDIF} RegisterHotKey(SasWindow, 4, MOD_CONTROL or MOD_SHIFT, VK_ESCAPE); // handler executes task manager {$IFDEF WINXP_OR_LATER} RegisterHotKey(SasWindow, 5, MOD_WIN, Byte('L'); // handler locks the workstation RegisterHotkey(SasWindow, 6, MOD_WIN, Byte('U'); // handler executes utilman on current desktop {$ENDIF}

Did you notice the MOD_SAS constant?

Locking a workstation - part 1

Sat, 13 Dec 2008 23:13:08 +0000

Win32 API provides only 1 function for locking workstation, named LockWorkstation. What does it do and how we can use it?

When a new session is started, smss.exe invokes winlogon.exe. It registers its process id in win32k.sys by calling RegisterLogonProcess. It has this prototype:

Converting a volume name to a device name

Wed, 10 Dec 2008 15:41:42 +0000

Windows has a couple of different formats for volume names but it is unclear how to convert a Volumename (example: \?\Volume{GUID}) to a DeviceName (example: \Device\HarddiskVolume1).

I found at that you can use the QueryDosDevice function but you need to remove the preceeding \?\ and the trailing \ of the VolumeName:

Executing a Fast User Switch programmatically - part 2

Wed, 26 Nov 2008 16:45:46 +0000

Part1

Let’s write our own Credential Server implementation.

At first, we need to create a named pipe with a unique name. Let’s construct the pipe name using a GUID - this should be unique, but we can do it in a cycle to be absolutely sure:

Executing a Fast User Switch programmatically - part 1

Wed, 26 Nov 2008 15:23:37 +0000

I think many of you have got experience with multiple Terminal Server Sessions in windows XP, also called Fast User Switching (FUS). Let’s get inside this cool feature.

How does FUS work? Each session has its own winlogon.exe. It draws the same interface which looks like the screenshot below:

Terminal Server Internals

Wed, 19 Nov 2008 17:55:39 +0000

Hello, my name is Danila Galimov and i will write here sometimes :-)

My first post is about communications between Terminal Server sessions and Terminal Server service process (termsrv.exe/dll). Terminal Server service needs to communicate with each session for many tasks, such as sending window message, getting message reply and so on. So, on init, Terminal Server creates a SmSsWinStationApiPort port in global namespace and runs a few WinStationLpcThread threads, which are listening on port and are used to process port messages. When csrss.exe is started, it parses its command line, which usually looks like:

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=4096,4096,1024 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
and loads the required dlls (winsrv.dll in our case). Initialization of winsrv.dll creates a thread, which connects to SmSsWinStationApiPort port and does the loop for processing Terminal Server messages until it receives WinStationTerminate message.
We’ll try to fool Terminal Server

Working with bitfields in Delphi

Thu, 01 May 2008 23:06:00 +0000

Recently I needed to convert a C header file to Delphi which contained bitfields. Let’s take a look at a sample structure that contains bitfields:

cpp Download

typedef struct _BITFIELDSTRUCTURE { DWORD dwValue1; ULONG BitValue1: 1; ULONG BitValue2: 1; ULONG BitValue3: 1; ULONG BitValue4: 1; } BITFIELDSTRUCTURE, * BITFIELDSTRUCTURE;

It means that there is a DWORD (Cardinal) dwValue1 followed by a bitfield with the size of a ULONG (32 bits). In this bitfield 4 values are defined (BitValue1..4) which are used as boolean’s because the value can offcourse be 0 or 1. Since Delphi doesn’t know a bitfield type the question is how to translate it. Usually it would mean that we simply treat the whole bitfield value as a ULONG and extract the required properties by applying a bitmask (shl/shr). Starting from BDS2006 we can define a record with propertes and use getters and setters. Using this technique we can present boolean values to the user:

Vista SP1 changes to Terminal Server API

Sun, 02 Mar 2008 15:31:55 +0000

In a previous article I wrote about changes in utildll in vista that breaked compatibality for Terminal Server. Even though release notes for Service Pack 1 don’t indicate changes or fixes in this area my testing shows that Microsoft has taken over the Windows 2008 implementation of utildll to Vista.

Supporting for in loop in TObjectList descendants

Sun, 02 Mar 2008 15:08:19 +0000

For my Terminal Server unit in the Jedi Security library I use 2 TObjectList descendants to hold a list of Terminal Server Sessions and Processes. Consider the sample below which connects to a server and enumerates all sessions:

objectpascal Download

var ATerminalServer: TJwTerminalServer; i: Integer; begin ATerminalServer := TjwTerminalServer.Create; ATerminalServer.Server := 'TS001'; try if ATerminalServer.EnumerateSessions then begin // Now loop through the list for i := 0 to ATerminalServer.Sessions.Count - 1 do begin Memo1.Lines.Add(ATerminalServer.Sessions[i].Username); end; end; except on E: EJwsclWinCallFailedException do begin // Handle Exception here end; end; // Free Memory ATerminalServer.Free; end;

In the sample I loop through the sessions with a for loop. Even though Delphi supports the for in loop since Delphi 2005 it's not possible to use this in TObjectList descendants, so we cannot use this:

objectpascal Download

// Now loop through the list for Session in ATerminalServer.SessionList do begin Memo1.Lines.Add(Session.Username); end;

To make this possible we need to implement GetEnumerator and an Enumerator class:

objectpascal Download

TJwSessionsEnumerator = class private FIndex: Integer; FSessions: TJwWTSSessionList; public constructor Create(ASessionList: TJwWTSSessionList); function GetCurrent: TJwWTSSession; function MoveNext: Boolean; property Current: TJwWTSSession read GetCurrent; end; constructor TJwSessionsEnumerator.Create(ASessionList: TJwWTSSessionList); begin inherited Create; FIndex := -1; FSessions := ASessionList; end; function TJwSessionsEnumerator.GetCurrent; begin Result := FSessions[FIndex]; end; function TJwSessionsEnumerator.MoveNext: Boolean; begin Result := FIndex < FSessions.Count - 1; if Result then Inc(FIndex); end;

Now we add a function with the name GetEnumerator in the SessionList class:

objectpascal Download

function TJwWTSSessionList.GetEnumerator: TJwSessionsEnumerator; begin Result := TJwSessionsEnumerator.Create(Self); end;

And that's really all!

1 Comments

  Remko shows us how to use the Terminal Server feature of JWSCL by JEDI Windows API Mar 3, 2008
[...] Go and learn more about it here. [...]

TSAdminEx Progress

Sun, 27 Jan 2008 23:04:07 +0000

I just wanted to show some of the progress that I made in development of TSAdminEx. I thought the best way would be to show some screenshots. Which reminds me I installed a nice Javascript to enlarge the thumbnails, click to see it…

Using WTSWaitSystemEvent

Fri, 25 Jan 2008 18:02:13 +0000

If you develop an application for Terminal Server you might want to react on session events. This means that your application is notified when a user logs on, logs off or becomes idle. This can be done with the WTSWaitSystemEvent function. Implementing it is rather simple and could look something like this:

Undocumented API's from Utildll

Sun, 09 Dec 2007 11:05:04 +0000

Several of Microsoft’s Terminal Server tools use undocumented API’s from Utildll.dll. For instance Terminal Server Admin uses it to get a localised connect state string and to format time strings like idle time, logon time etc.

Functions below seems to be the most usefull ones, I will add those to the JwaWinsta unit:

Delphi and Terminal Server Aware

Sat, 24 Nov 2007 23:21:37 +0000

When an application is not Terminal Server aware (also known as a legacy application), Terminal Server makes certain modifications to the legacy application to make it work properly in a multiuser environment. For example, Terminal Server will create a virtual Windows folder, such that each user gets a Windows folder instead of getting the system’s Windows directory. This gives users access to their own INI files. In addition, Terminal Server makes some adjustments to the registry for a legacy application. These modifications slow the loading of the legacy application on Terminal Server and require up to 8 MegaBytes extra memory. This behaviour can be avoided if the TSAware flag is present in the PE header of an executable as can be read here at MSDN.

JEDI Apilib and JEDI Windows Security Code Library

Thu, 08 Nov 2007 12:35:32 +0000

It has been a little silent on the JEDI Apilib project lately, but this will change!

We had some change in the team members: Marcel van Brakel, founder and large contributor of the project has signed off because he no longer actively uses Delphi. Christian Wimmer has joined the team and he is a very promising member.

Christian has been working on a new include model (optional) of the Jedi Apilib which has the advantage that you only need to use one unit (JwaWindows) for the whole library.

Chris has also published the JEDI Windows Security Code Library (Jwscl). This is library that tremendously simplifies using Win32 API calls from Delphi. At this point the library contains:

Windows Version

Token

Impersonation

Login

SID

Access Control List

Security Descriptor

Owner, Group, DACL, SACL

WindowStation

Desktop

LSA

Rights mapping

Secured Objects Files, Registry (+Inheritance), etc.

Credentials (Login Dialog)

Encryption (MS Crypto API)

Well Known SIDs

Privileges

Security Dialogs (The "ACL Editor" you see on the security yab when you rightclick object in Explorer)

Terminal Sessions

Unicode + Ansicode

Vista Elevation

Vista Integrity Level

Although Jwscl is in beta stage it is already very well useable.

How to get Client IP Address?

Wed, 31 Oct 2007 11:10:10 +0000

When a client is connected to a Terminal Server Session you can use the Terminal Server API to retrieve the client’s local IP address.

Start by enumerating all sessions with WtsEnumerateSessions and then for each session get the ClientAddress with a call to WTSQuerySessionInformation with the WTSClientAddress parameter. Sound simple, no?

WTSQuerySessionInformation returns a pointer to a WTS_CLIENT_ADDRESS structure. You need to know that the IP address is located at on offset of 2 bytes in the Address member of WTS_CLIENT_ADDRESS.

So here’s a sample:

TSAdminEx

Tue, 23 Oct 2007 19:48:50 +0000

You will probably know Microsofts Tool to Manage Terminal Server, it’s called Terminal Services Manager (you will probably know it as TSAdmin). It can be used to view information about terminal servers including all sessions, users, and processes for each terminal server.

I’m currently working on a TSAdmin replacement (codename TSAdminEx). Purpose is to show how to use the Terminal Server API’s and as a little bonus we will add some extra functionality to TSAdminEx.

How to launch a process in a Terminal Session

Sat, 20 Oct 2007 22:45:24 +0000

This is an often asked question but the solution is simple:

So how does it work?
First we obtain the user’s primary access token with the WtsQueryUserToken API call. To call this function successfully, the calling application must be running within the context of the LocalSystem account and have the SE_TCB_NAME privilege (LocalSystem has this privilege by default). Since the function returns a primary acces token we can just pass this to CreateProcessAsUser and voila!