无法从TCL脚本执行NSIS安装应用程序

Question

Running tcl 8.4.13 , I have a tcl script to execute my NSIS installation application (duly signed by microsoft) that used to work but now fails (windows 7 and 10), maybe because of windows security update or something? The same tcl script works fine when the target is a local/renamed copy of notepad.exe. The NSIS application works fine when run from from the command line.

The tcl script looks like the following, run via tclkit-win32 tclmnu.tcl , where tclmnu.tcl looks like this:

#! /bin/sh -x
# \
    exec wish "$0" "$@"
#

package require Tk

#set runcmd notepad_local_copy.exe
set runcmd my_nsis_app.exe  # this doesn't work

# this works with the notepad_local_copy.exe (above) but not my_nsis_app.exe
set catchcode [ catch { exec ${runcmd} } result ]

# also tried this, doesn't work either
#set catchcode [ catch { exec "runas /usr:administrator: ${runcmd}" } result ]

tk_messageBox -type ok -icon error -message "DEBUG: catchcode=${catchcode}"
# catchcode is 0 when runas=notepad_local_copy.exe, 1 when it's my_nsis_app.exe

Answer 1

Well, I solved it by adding cmd /c, as in

set catchcode [ catch { cmd /c exec ${runcmd} } result ]

I don't know why it needs that, nor why it seemed to work before and not now.

Answer 2

I don't know anything about TCL but I'm assuming that exec calls CreateProcess . When UAC was added to Vista it seems Microsoft deemed CreateProcess too low-level to be able to perform elevation.

Dealing with Administrator and standard user's context:

CreateProcess and CreateProcessWithLogonW do not have new flags to launch the child process as elevated. Internally, CreateProcess() checks whether the target application requires elevation by looking for a manifest, determining if it is an installer, or if it has an app compat shim. If CreateProcess() determines the target application requires elevation, it simply fails with ERROR_ELEVATION_REQUIRED(740). It will not contact the AIS to perform the elevation prompt or run the app. If CreateProcess() determines the application doesn't require elevation, it will spawn it as a new process.

ShellExecute[Ex] however is able to contact the UAC service and display the UAC elevation dialog:

To programmatically launch a child process as an elevated process, two things must occur: first, the executable of the child process needs to be identified as needing elevation, and second, the parent process needs to use ShellExecute() or ShellExecuteEx().

It seems there are multiple ways to get TCL to call ShellExecute :

eval exec [auto_execok start] {""} [list [file nativename $filename]] ;# http://wiki.tcl.tk/2809

or

twapi::shell_execute -path filename.exe ;# http://www.magicsplat.com/blog/how-do-i-exec-thee/

You can also request elevation of executables even if they are not marked as requiring elevation:

twapi::shell_execute -path filename.exe -verb runas 

(The runas verb is not the same thing as runas.exe )

NSIS scripts use the RequestExecutionLevel attribute to mark the executable with the desired UAC elevation level.

Using cmd /c is a bit of a hack and will probably display a console window for a brief period of time. cmd /c first tries CreateProcess and then falls back to ShellExecuteEx if elevation was required. I'm not sure if this is documented behavior.