[Installer] Offer to end running Cockatrice immediately when auto-close fails (#7675)

* [Installer] Offer to end running Cockatrice immediately when auto-close fails

* [Installer] Keep the way out that costs nothing in the first prompt

The prompt now offers to end Cockatrice, so what the deleted close-again text
said has to survive in it: an instance the probe reports as waiting for an
answer to a question of its own has been brought forward, and answering that
window is the way out that ends nothing. Say so, and say where to go when Yes
leaves it listed - Task Manager - so an end that cannot take effect does not
loop on the same dialog.

* [Installer] Bring the comments back in line with the code

GuardCloseTried no longer counts closes, and the file header, CloseHolders and
GuardAppsNotRunning still described an escalation after a second close, as did
the probe's --end-holders note.

* [Installer] End Oracle and Servatrice too when the guard's end answer is confirmed

The guard's end answer only ever stopped cockatrice.exe, so an Oracle holding
the card database or a Servatrice service kept the payload locked and the
prompt came back with nothing left that could free it.

The probe now ends every program the payload installs, services included:
isPayloadProgram() - the list restart_manager_holders already used for its
parent walk - decides the set, so a scanner holding a DLL or a program the
user keeps in the install directory is still named and left to the user. A
service is terminated rather than sent a stop through the SCM, which notices
the process exit and marks it stopped afterwards.

The guard prompt now says what ending costs: an unsaved deck, an unwritten
setting, players on a running Servatrice, and an Oracle mid-way through the
card database. It also keeps the notification-area hint, which the probe's
"has no window to ask" answer depends on, and drops the claim that Oracle
and Servatrice had been brought forward.

* [Installer] Give every running-program prompt the same end-or-retry answers

Four prompts meet a running program and each offered a different set: the
guard ended it, the launcher wait only kept waiting, and the recovery prompt
after a failed purge could only ask Cockatrice to close. With Oracle or
Servatrice holding the files, that last one had no answer that could free
anything - Yes and No both retried the purge and Cancel aborted an install
whose old version was already gone.

All four now follow the guard's shape: one automatic attempt, then a prompt
whose Yes ends the programs it names and whose No retries, with Cancel to
give up.

- RecoverFromHolders closes once and purges before it asks anything, then
  offers EndHolders - the same end answer as the guard - instead of a close
  the user had to trigger himself.
- WaitForLauncherToExit can end the launcher by pid, the one process it
  holds a pid for, rather than looping 60 s waits with Cancel as the only
  way out.
- END_COST and AFTER_CLOSING_GUIDANCE are !defines, so the cost of ending
  and the guidance for the answers that end nothing read the same in every
  prompt.

* [Installer] End the launcher through the handle it was waited on

The "end it" answer used to look the launcher's pid up again after a dialog that
can stay open as long as the user takes, so a pid that had been reused in the
meantime - or a /PID= that was never the launcher - would be terminated instead.
The handle the wait already holds names that process and cannot be handed to
another, so the terminate answer now acts on it.

PROCESS_TERMINATE is requested along with PROCESS_SYNCHRONIZE; when only the
synchronize right is granted the launcher is still waited on and the answer falls
back to asking it to close, instead of reporting a live launcher as gone and
writing the payload over it.

* [Installer] Say what the end answer ends, and report a failed end

The prompt offered "end every program listed above", but EndHolders only ends the
programs the payload installs: a scanner holding a payload DLL, or a service the
Restart Manager names by its long name, was listed and then silently left alone, so
Yes looked like it did nothing and the same dialog came back unchanged.

The wording now says which programs Yes ends and that anything else has to be closed
by hand, and the round after an end that did not free the files says so, so the same
dialog no longer reappears word for word. The three prompts are one macro so they
cannot drift apart again.

The added sentences eat into the 1024 characters one NSIS string holds, so the
holder line's budget drops from 400 to 320 characters to keep the longest message
(cancel line included) inside it: 977 characters, measured against the worst case
the probe can produce.

---------

Co-authored-by: sentry[bot] <39604003+sentry[bot]@users.noreply.github.com>
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

tools/installer-holder-probe/close_holders.cpp

@@ -1,5 +1,7 @@
 #include "close_holders.h"
 
+#include "restart_manager_holders.h"
+
 // clang-format off
 // windows.h has to come before anything that pulls in a Windows type, as everywhere in
 // this tool.
@@ -310,7 +312,7 @@ CloseHoldersResult closeCockatriceHolders(const std::vector<Holder> &holders, un
     return result;
 }
 
-EndHoldersResult endCockatriceHolders(const std::vector<Holder> &holders, unsigned long waitMilliseconds)
+EndHoldersResult endHolders(const std::vector<Holder> &holders, unsigned long waitMilliseconds)
 {
     EndHoldersResult result;
     std::vector<std::wstring> lines;
@@ -318,13 +320,16 @@ EndHoldersResult endCockatriceHolders(const std::vector<Holder> &holders, unsign
     std::vector<std::size_t> endedLines;
 
     for (const Holder &holder : holders) {
-        if (holder.isService || !isCockatriceImage(holder.imageName)) {
-            // The same split as the close: Oracle writes the card database in place and a
-            // service has nothing to ask, so neither is ever ended here.
+        if (!isPayloadProgram(holder.imageName)) {
+            // Not one of the programs the payload installs: a scanner that has a DLL open, or
+            // a program the user keeps in the install directory. It is named and left to the
+            // user, because ending it would destroy something this installer does not own.
             lines.push_back(processLabel(holder) + L" left to you");
             continue;
         }
 
+        // Services included: the installer asked before getting here, and the Service
+        // Control Manager reports the terminated process as a stopped service afterwards.
         const HANDLE process = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, holder.processId);
         if (process == nullptr) {
             lines.push_back(processLabel(holder) + L" could not be ended (win32 " + std::to_wstring(GetLastError()) +

tools/installer-holder-probe/close_holders.h

@@ -63,13 +63,20 @@ struct EndHoldersResult
 };
 
 /**
- * @brief Ends every running Cockatrice the probe named.
+ * @brief Ends every running Cockatrice, Oracle and Servatrice the probe named.
  *
  * This is the last resort behind the installer's "end it now" answer, never a first move: a
  * client that is still running may have an unsaved deck, an open game or a settings write in
- * flight, so the caller only gets here after the user picked it from a prompt that says so.
- * Only cockatrice.exe is ended - Oracle writes the card database in place and Servatrice is a
- * service, so both are named and left to the user, exactly as they are for the close.
+ * flight, Oracle may be part-way through writing the card database, and Servatrice may be
+ * serving a game, so the caller only gets here after the user picked it from a prompt that
+ * says so.
+ *
+ * Every program the payload installs is ended, services included. A service is terminated
+ * like a process rather than stopped through the Service Control Manager: the installer has
+ * asked the user first, and the SCM notices the process exit and marks the service stopped
+ * afterwards, so it can be started again normally. Anything else the Restart Manager named -
+ * a scanner holding a DLL, a program the user keeps in the install directory - is left to
+ * the user, because ending it would destroy something this installer does not own.
  *
  * Waits up to @c waitMilliseconds for what it ended to be gone, so the caller can measure the
  * purge immediately afterwards instead of racing a process that is still exiting.
@@ -77,6 +84,6 @@ struct EndHoldersResult
  * @param holders what the probe named, one entry per application or service
  * @param waitMilliseconds how long to wait for the ended instances to be gone, 0 to not wait
  */
-EndHoldersResult endCockatriceHolders(const std::vector<Holder> &holders, unsigned long waitMilliseconds);
+EndHoldersResult endHolders(const std::vector<Holder> &holders, unsigned long waitMilliseconds);
 
 #endif

tools/installer-holder-probe/holder_line.h

@@ -26,12 +26,15 @@ inline constexpr std::size_t HOLDER_LINE_MAX = 5;
 /**
  * @brief How many characters the summary may spend on the holders it names.
  *
- * The line is not the whole string: the abort dialog puts it after a fixed paragraph and
- * before the path of the installer log, inside an NSIS string of 1024 characters. Windows
- * caps one application or service name well below this budget, so it bounds the list
- * without ever cutting a single holder short.
+ * The line is not the whole string: every prompt puts it after a fixed paragraph and before
+ * the answers, and one NSIS string holds 1024 characters. Those paragraphs grew when the
+ * guard started spelling out what ending the programs costs and what is left to do by hand,
+ * so this budget is what keeps the longest message - the one that also says the last end
+ * freed nothing, plus the "; and N more" the summary appends after the budget - complete,
+ * including the Cancel line at its end. Windows caps one application or service name well
+ * below this, so it bounds the list without ever cutting a single holder short.
  */
-inline constexpr std::size_t HOLDER_LINE_CHAR_MAX = 400;
+inline constexpr std::size_t HOLDER_LINE_CHAR_MAX = 320;
 
 /**
  * @brief Renders one holder the way the user has to recognise it, e.g.

tools/installer-holder-probe/main.cpp

@@ -45,8 +45,9 @@ enum ExitCode
 ///                     abort dialog/log
 ///   --close-holders  bring the running Cockatrice forward, ask it to close, and wait for
 ///                     it to exit, for the offer to close after a failed purge
-///   --end-holders    end the running Cockatrice and wait for it to be gone, for the last
-///                     resort the guard prompt offers after a close was asked for twice
+///   --end-holders    end the running Cockatrice, Oracle and Servatrice and wait for them to
+///                     be gone, for the last resort the guard prompt offers when a close did
+///                     not free the files
 ///
 /// All three answer from two lookups that cover each other's blind spot: the Restart Manager
 /// names whoever has a payload file open, and every process running from the directory is
@@ -161,7 +162,7 @@ int main(int argumentCount, char **arguments)
         return EXIT_HOLDERS_FOUND;
     }
     if (mode == Mode::End) {
-        const EndHoldersResult result = endCockatriceHolders(holders, END_WAIT_MILLISECONDS);
+        const EndHoldersResult result = endHolders(holders, END_WAIT_MILLISECONDS);
         writeLine(result.report);
         return result.ended > 0 ? EXIT_HOLDERS_FOUND : EXIT_NO_HOLDERS;
     }

tools/installer-holder-probe/restart_manager_holders.cpp

@@ -34,16 +34,6 @@ constexpr const wchar_t *PAYLOAD_FILES[] = {L"cockatrice.exe", L"oracle.exe", L"
 /// exists to name, so askingProcessIds() stops its walk up the parent chain at one.
 constexpr const wchar_t *PAYLOAD_PROGRAMS[] = {L"cockatrice.exe", L"oracle.exe", L"servatrice.exe"};
 
-bool isPayloadProgram(const std::wstring &imageName)
-{
-    for (const wchar_t *program : PAYLOAD_PROGRAMS) {
-        if (CompareStringOrdinal(imageName.c_str(), -1, program, -1, TRUE) == CSTR_EQUAL) {
-            return true;
-        }
-    }
-    return false;
-}
-
 void collectFilesOf(const std::wstring &directory, int depth, int maxDepth, std::vector<std::wstring> &files)
 {
     if (files.size() >= MAX_PROBED_FILES) {
@@ -144,6 +134,16 @@ Holder holderOf(const RM_PROCESS_INFO &info)
 }
 } // namespace
 
+bool isPayloadProgram(const std::wstring &imageName)
+{
+    for (const wchar_t *program : PAYLOAD_PROGRAMS) {
+        if (CompareStringOrdinal(imageName.c_str(), -1, program, -1, TRUE) == CSTR_EQUAL) {
+            return true;
+        }
+    }
+    return false;
+}
+
 std::vector<std::wstring> collectPayloadFiles(const std::wstring &installDir)
 {
     std::vector<std::wstring> files;

tools/installer-holder-probe/restart_manager_holders.h

@@ -21,6 +21,18 @@
  */
 std::vector<std::wstring> collectPayloadFiles(const std::wstring &installDir);
 
+/**
+ * @brief Whether @p imageName is one of the programs the payload installs.
+ *
+ * The single place that answers which images are Cockatrice's own, so the guard ends the
+ * same set it names. Matched case-insensitively on the image name alone: only holders are
+ * ever tested against it, and a holder is a process that has a payload file open or runs
+ * from the install directory.
+ *
+ * @param imageName the file name of a process image, empty when it could not be read.
+ */
+bool isPayloadProgram(const std::wstring &imageName);
+
 /**
  * @brief Names the applications and services that have one of @p files open or mapped.
  *