Running ImgBurn from Command Line via AT Command on XP

[dgurrol]

When scheduling a job from the command line via the AT command, the scheduled job runs in the SYSTEM context. When the job fires you are presented with ImgBurn's application error handling window - nice work by the way!

 

The command I am using to schedule the job is:

at 04:00 /interactive /every:M,T,W,Th,F,S,Su "C:\ADMIN\RECORDINGS.cmd"

See bugreport1.txt

 

The /interactive allows me to logon as any administrative user and see what is actually happening by having any UI called from the script to be displayed. ImgBurn.exe version I am using is 2.5.8.0

 

This can QUICKLY be reproduced by using SysInternals psexec command:

PSEXEC -i -s -d "%programfiles%\imgburn\imgburn.exe"

See bugreport2.txt

 

This is reproducible on several Windows XP SP3 machines I have tested on. I am to begin testing my script on Windows Vista SP2, 7, 8, 8.1, Server 2003, 2008, 2008 R2, 2012, and 2012 R2 where I belive the scheduler's options on all but server 2003 will handle this quite nicely, but the XP system with it's low overhead is my true target.

 

I know XP is out the door - truly not an issue as long as ImgBurn will run on it. Once complete the VM will be configured in a non-persistent mode.

I also know there are other script methods and tools I can use, I am familiar and adept with most of them.

The requirements demand the smallest resource utilization footprint as possible, nothing additional installed beyond critical and recommended updates for XP as well as anything required for ImgBurn to function properly. My only hiccup is this error.

 

I do have a workaround that is acceptable, but not preferred - run the job as a local user. There are a few drawbacks to this though, none of which are pertinent to this bug report, but I would be happy to share if needed/desired.

bugreport1.txt

bugreport2.txt

Edited February 24, 2014 by dgurrol

[LIGHTNING UK!]

I believe this is the issue here (and I've seen it before, see links below)...

 

http://forum.imgburn.com/index.php?/topic/19660-2560-abnormal-program-termination/?hl=%2Bpotentialmappeddrive&do=findComment&comment=139298

http://forum.imgburn.com/index.php?/topic/17352-please-i-need-help/?hl=%2Bpotentialmappeddrive&do=findComment&comment=129311

 

00891148 +024 ImgBurn.exe MPShellUtilities              PotentialMappedDrive
0089cef5 +03d ImgBurn.exe MPShellUtilities              TNamespace.GetValid
009c5326 +012 ImgBurn.exe Virtualexplorertree           TCustomVirtualExplorerTree.ValidRootNamespace

It's not ImgBurn itself that's crashing, it's the explorer style component used on the 'Disc Layout Editor' window.

 

I have no idea why it's crashing though, I can only assume (based on the function names) it's something to do with the drives (mapped?) on the machine.

[dgurrol]

The funny thing about XP and mapped drives is that they are per session not per system and this is likely true with Windows in general. Here I am logged in as the local adminstrator on a domain connected machine. I open my computer and via the address bar type \\server press enter and then authenticate with domain\user and password. I am now able to see this "mapping" via the net use command.

 

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

 

C:\Documents and Settings\Administrator>net use

New connections will not be remembered.

 

 

Status       Local     Remote                    Network

-------------------------------------------------------------------------------
OK                     \\server\IPC$             Microsoft Windows Network
The command completed successfully.

 

 

C:\Documents and Settings\Administrator>

 

 

 

Now I run the command prompt as SYSTEM via psexec -i -s -d cmd and in the command prompt running as SYSTEM type net use and press enter.

 

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

 

C:\WINDOWS\system32>net use

New connections will not be remembered.

 

There are no entries in the list.

 

 

C:\Documents and Settings\Administrator>

 

 

Launching ImgBurn as SYSTEM via psexec -i -s -d "%programfiles%\imgburn\imgburn.exe" results in that crash I sent in bugreport2.txt previously.

Now I go back to the local administrator's command prompt window and do a net use * /delete /yes to remove that \\server\IPC$ "mapping". At this point explorer is running under the local administrator's permissions and shows C: (XP boot drive), I: (second physical drive) and D: (the physical optical drive).

 

Flip back to the SYSTEM command prompt and redo the imgburn as system command...and...same application error window appears.

 

Just a reminder here, the psexec thing is being done so someone else can follow along and emulate what it would be like for the Task Scheduler job that was created via the AT command. When you mentioned the mapped drives thing it triggered my brain to think "...well hey the job may be running in the SYSTEM context, but that /interactive switch may come into play with what that 'ol lighning bug said..." no offense intended, it's just how this crazy head of mine works ;-)

 

So I fired up the SysInternals diskmon tool under the local administrator context and then fired up ImgBurn as SYSTEM - all reads and writes shown were against disk 0 (that would be C:). I then fired up diskmon as SYSTEM and tried ImgBurn as SYSTEM again...same results. Hmmm...lets try procmon.

 

I can see ImgBurn enumerating through devices listed in the registry, including my disabled and not running Virtual Clone Drive (VCDDaemon.exe not running, removed from starting up with system and number of drives set to disabled - I turn this on and off as needed only).

Tried again after uninstalling Virtual Clone Drive...same.

Uninstalled anything that may emulate or play with drive mappings - RealVNC 5.1.0...Avast 8 Endpoint Protection...same.

 

I then used task manager to close everything running under the local admin's context (except for the command prompt) - sometimes explorer gets fussy when another tries to open (only one explorer.exe at a time regardless of what user context it is running under). I was not sure how/what your drive tree creation used for the form so I just played it safe and killed explorer. I then stopped EVERY service that I could. I also disabled the network interface as well.

 

Same...

attached is the bugreport.txt file and the procmon data (7zip compressed to meet your upload requirements) captured from start (just after all administrator processes were killed and every service possible stopped) to finish, closing the application error window by clicking the close application button. If you have procmon I did not use any fancy filters - it's all there using the default settings. I really hope this helps you.

 

For what it is worth, it really looks like something is not visible or accesible or enumerated for the SYSTEM account, but I just cannot tell what. It may be somewhere in the device tree of the device manager which get enumerated by ImgBurn via the registry (i.e. an old USB drive not properly disconnected or configured, or even some sort of Dell virtual hardware).

Logfile.7z

bugreport.zip

Edited February 28, 2014 by dgurrol