How to make a exe that is removed from the servers open files list when running (started from a share)

8
votes

I need to make a exe that will be started from a Windows server share. As soon as the application is running it should disappear from the servers open files list.

For example I have this simple Delphi source as a test - it compiles to a small 28k exe file that simply waits for user input when invoked. While the application is running it appears on the servers open files list. I already tried PEFlags setting IMAGE_FILE_NET_RUN_FROM_SWAP and IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP:

program RunFromShare;
Uses
  Windows;

{$APPTYPE CONSOLE}

{$SetPEFlags IMAGE_FILE_NET_RUN_FROM_SWAP} // no exe file open on network share?
{$SetPEFlags IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP}

begin
  WriteLn('Waiting for [Enter] key');
  ReadLn;
end.
1
windowsdelphiexe
I really don't like programs that try to hide themselves... – Marjan Venema
@Marjan Venema, this will be a trayicon app started from a server share. Once the app is started it of course shows up in the process list of the client. But I really don't like 300 Clients still having a connection to the server open especially when I need to update my client app. – Peter Sawatzki
Ok, got it and thanks for the explanation. Got the picture a lot better in my mind now... – Marjan Venema
Those flags are telling loader to map (view of file, yes) using local paging file so commiting reserved pages will not fail in case of remote or removable medium going offline, they has nothing to do with closing file handle on remote server share. – Premature Optimization
@Downvoter step into the light: then why does the loader still have a file handle open with the server ? I'm looking for a means to cut this connection. – Peter Sawatzki

1 Answers

1
votes

It seems like IMAGE_FILE_NET_RUN_FROM_SWAP (or IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP) tells Windows that it should load the whole EXE into memory (backed by the swap file). This doesn't mean it is copied and then run from the local disk, it just prevents page faults from happening later which cause access to the share (possibly after dismount; see such a case here). Which in turn means, the file on the network share is still open as long as the share is connected and the file running.

MSDN says this about IMAGE_FILE_NET_RUN_FROM_SWAP:

If Image is on Net, copy and run from the swap file.

I would interpret copy as copy to memory, not as copy to disk.

So if nobody does the job for you just do it yourself: copy your file and run it :)