hi,

altought i know elicz coded a dll for do things like that, i just discovered own easy can be made a program that self-delete before exiting.

here's the code...



ExitProcessAndDelete:
sub esp,(MAX_PATH+stack_code_size)
mov edi,esp ;alloc buffer in stack

mov ebx,edi
mov ecx,stack_code_size
mov esi,ofs stack_code
rep movsb ;copy code to stack buffer

push MAX_PATH
push edi ;copy EXE name to stack buffer (after code)
push ecx ;0
call GetModuleFileNameA

;to push the real API address, we get...
mov eax,ofs ExitProcess ;the offset of the JMP in end of .CODE...
mov eax,[eax+2] ;to the import table...
push dwo [eax] ;and get the real address of the API

push edi ;parameter to DeleteFileA()

mov eax,ofs DeleteFileA
mov eax,[eax+2]
push dwo [eax]

push 0
call GetModuleHandleA

push eax ;paramter to FreeLibrary()

mov eax,ofs FreeLibrary
mov eax,[eax+2]
push dwo [eax]
jmp ebx ;jmp to code in stack

stack_code:
pop eax
call eax ;call FreeLibrary()
pop eax
call eax ;call DeleteFileA()
ret (MAX_PATH+stack_code_size)-4
stack_code_size equ $-stack_code



just call ExitProcessAndDelete(), without parameters, in place of ExitProcess(), and you're done

ancev

ps: forgot to said that I tested in w98 only :grin:
Posted on 2002-03-13 15:54:37 by ancev
not working on xp (guess it will not work on 2k either, now who would have thought? ;) )
this kind of code is highly unreliable and incompatible in most cases, better find another way to achieve it.
Posted on 2002-03-13 15:59:58 by Tola
:( on 2k too. But it was a good idea, nice. Would be awesome if it worked.
Posted on 2002-03-13 16:02:09 by stryker
Try unmapping your ImageBase as well. Will still only work on some
windows versions. I have found no reliable and non-dirty ways to
delete my own executable execept "that ini file" or a key in the registry.
Posted on 2002-03-13 17:09:35 by f0dder
There is also another tried and true method that works on all Win variants, that is to use your self-deleting .exe to create a .bat file that loops till it deleted your .exe, then the .bat deleted itself.

.bat files can do that yaknow. It does leave a WinOldApp stuck in your task list, but it can be made to run in a very low priority thread, and it will die on the next reboot anyway.
Posted on 2002-03-13 18:57:09 by Ernie
Why not just copy yourself to the temp directory, run it with different args, and close.

Then the one in the temp folder can perform the uninstall.

Pseudo-code:


{
if( IsInTempDirectory( GetModuleFileName() ) )
DeleteTheOtherMe();
else{
CopySelfTo( "%TEMP%\\me.exe" );
RunProcess( "%TEMP%\\me.exe" );
}
Exit();
}
Posted on 2002-03-13 19:24:46 by iblis
Hi iblis,

that way you leave an exe in the temp folder, but the problem is not solved yet.
It seems that there is no clean way to perform this task on all win-version.

Bye Miracle

P.S. This topic should get an own thread container near the heap section :grin:
Posted on 2002-03-14 03:59:50 by miracle
I've never really liked the idea of using a batch file... sure, batch
files can delete themselves, but you're stuck with winoldap, and
unless you run the .bat minimized, a console window. Sure the
winoldap will be gone on next reboot, but some boxes have weeks or even
months inbetween reboots...

The solution that works best for me is to drop a small "cleanup" app
in the current user temp folder that handles final cleanup (exe and
main-app removal). In my case I actually drop the entire uninstaller
there, since it's only some thirty kilobyte. A registry or "that ini
file" entry can then be set up which removes the cleanup app from the
temp folder.
Posted on 2002-03-14 04:18:18 by f0dder
M$ have actualy published a proper method for doing this. I remeber reading about it a while ago but I cant find the link or page. From memory its quite simple

1) create a tempory file with FILE_FLAG_DELETE_ON_CLOS
2) write enough code to it to check when your app exits
3) once your app exits, delete your programs file and any dlls, etc


Then all it has to do is exit, and windows will do the rest. :)


EDIT: I would image that windows installer, which is now required by M$ to be used for 'Windows 2000 logo M$ certified product' would make your job much easier anyway?
Posted on 2002-03-14 21:05:01 by huh
The FILE_FLAG_DELETE_ON_CLOSE doesn't do the trick either.
I've messed a lot with this since I had to write an installer and a
uninstaller :).
Posted on 2002-03-14 21:13:00 by f0dder
I was digging up my pile of C progs and I luckily found this full source by Jeffrey Richter

Posted on 2002-03-14 21:29:37 by stryker
Hi,
// The system will delete the clone EXE automatically
// because it was opened with FILE_FLAG_DELETE_ON_CLOSE


tested it several month ago on 95/98/NT/2000 without success :(

There is only one solution that works. Using the batch file mechanism. xx_DELETE_ON_CLOSE and all the other stuff fails atleast under 9x or NT even if M$ recommend it.

Probably this is the last challenge for our civilization in addition to a travel to the mars :grin:

Bye Miracle
Posted on 2002-03-15 04:44:51 by miracle
Here are some nice (working!) routines ->
http://freespace.virgin.net/james.brown7/tuts/selfdel.htm
Posted on 2002-03-15 04:52:50 by bazik
The only ways of deleting your own executable:
*) batch file method (ugly)
*) wininit.ini (better, 9x only)
*) MoveFileEx (better, NT only)
*) registry (sorta ok, but problems on NT with non-adming accounts)

Why is the batch file ugly? Because it leaves a "winoldap" running
until next reboot. I feel it's more acceptable to leave a 4k executable
in %temp% until next reboot than it is to leave a winoldap running.

The trick is the following... your regular deinstallion program removes
everything but it's own executable. Then it spawns the small "final
cleanup" stub, which is put in %temp% (well, better grab the temp
folder from HKCU, defaulting to HKLM if there's no HKCU temp folder).
A event handle is passed on the cmdline (like in the non-working
FILE_FLAG_DELETE_ON_CLOSE example), or alternatively via a named mmf.
When the event is signalled, the main uininstaller has termianted,
and the small cleanup can delete the main uninstaller and program
folder (in the typical non-recursive RemoveDirectory way, so that
any data files the user might have put in the program directory aren't
lost).

Finally, the cleanup detects 9x/NT and uses wininit.ini or MoveFileEx
accordingly to the system.

The result is a working, clean, efficient uninstaller.
Posted on 2002-03-15 06:55:41 by f0dder
Hmm... when does a batch file leave a WINOLDAP process? I noticed this on Win9x/NT, when a console box crashed. But when I write a batch file just with


del %0


and run it, there's no WINOLDAP process left (using Win2K here).
Does it depend on the way, you start the batch file? (I just dblclicked in explorer)

regards,
bAZiK
Posted on 2002-03-15 07:03:21 by bazik
NT-based windows versions usually close console windows after
the execution is done, while 9x leaves them be until you click the
close button. winoldap is a 9x thing anyway (at least I haven't seen
it under 2k... then again, I very rarely run 16bit crudd these days :)).
Posted on 2002-03-15 07:19:49 by f0dder
Ah ok, thanks f0dd3r (<- makes you more l3t0 :) ) !

I've read somewhere, that Bo2K uses a special technique, to copy itself completly into memory. You can move/rename/delete the executable, and it keep's running until you reboot your machine. And this technique works both, under Win9x and NT.

Because Bo2K is open source, someone with a better C++ knowledge than me could take a closer look at this code to search for this function....?!

regards,
Sven
Posted on 2002-03-15 07:49:22 by bazik
I assume you might be able to copy yourself into the memory of
another process, then unmap your executable (etc etc etc), but
this seems *very* dirty and hackish to me...
Posted on 2002-03-15 07:52:47 by f0dder
Dirty is by far the more fun ... just gotta find a way that'll run cross-windows.

Fake
Posted on 2002-03-15 07:56:30 by Fake51

...just gotta find a way that'll run cross-windows.


Fake,
exactly! :alright:
Posted on 2002-03-15 07:59:07 by bazik