Cockatrice/tools/installer-holder-probe/holder_line.h
sentry[bot] bf3562a85a
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 cover (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Desktop / Prune caches (push) Waiting to run
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
[Installer] Offer to end running Cockatrice immediately when auto-close fails (#7675)
* [Installer] Offer to end running Cockatrice immediately when auto-close fails

* [Installer] Keep the way out that costs nothing in the first prompt

The prompt now offers to end Cockatrice, so what the deleted close-again text
said has to survive in it: an instance the probe reports as waiting for an
answer to a question of its own has been brought forward, and answering that
window is the way out that ends nothing. Say so, and say where to go when Yes
leaves it listed - Task Manager - so an end that cannot take effect does not
loop on the same dialog.

* [Installer] Bring the comments back in line with the code

GuardCloseTried no longer counts closes, and the file header, CloseHolders and
GuardAppsNotRunning still described an escalation after a second close, as did
the probe's --end-holders note.

* [Installer] End Oracle and Servatrice too when the guard's end answer is confirmed

The guard's end answer only ever stopped cockatrice.exe, so an Oracle holding
the card database or a Servatrice service kept the payload locked and the
prompt came back with nothing left that could free it.

The probe now ends every program the payload installs, services included:
isPayloadProgram() - the list restart_manager_holders already used for its
parent walk - decides the set, so a scanner holding a DLL or a program the
user keeps in the install directory is still named and left to the user. A
service is terminated rather than sent a stop through the SCM, which notices
the process exit and marks it stopped afterwards.

The guard prompt now says what ending costs: an unsaved deck, an unwritten
setting, players on a running Servatrice, and an Oracle mid-way through the
card database. It also keeps the notification-area hint, which the probe's
"has no window to ask" answer depends on, and drops the claim that Oracle
and Servatrice had been brought forward.

* [Installer] Give every running-program prompt the same end-or-retry answers

Four prompts meet a running program and each offered a different set: the
guard ended it, the launcher wait only kept waiting, and the recovery prompt
after a failed purge could only ask Cockatrice to close. With Oracle or
Servatrice holding the files, that last one had no answer that could free
anything - Yes and No both retried the purge and Cancel aborted an install
whose old version was already gone.

All four now follow the guard's shape: one automatic attempt, then a prompt
whose Yes ends the programs it names and whose No retries, with Cancel to
give up.

- RecoverFromHolders closes once and purges before it asks anything, then
  offers EndHolders - the same end answer as the guard - instead of a close
  the user had to trigger himself.
- WaitForLauncherToExit can end the launcher by pid, the one process it
  holds a pid for, rather than looping 60 s waits with Cancel as the only
  way out.
- END_COST and AFTER_CLOSING_GUIDANCE are !defines, so the cost of ending
  and the guidance for the answers that end nothing read the same in every
  prompt.

* [Installer] End the launcher through the handle it was waited on

The "end it" answer used to look the launcher's pid up again after a dialog that
can stay open as long as the user takes, so a pid that had been reused in the
meantime - or a /PID= that was never the launcher - would be terminated instead.
The handle the wait already holds names that process and cannot be handed to
another, so the terminate answer now acts on it.

PROCESS_TERMINATE is requested along with PROCESS_SYNCHRONIZE; when only the
synchronize right is granted the launcher is still waited on and the answer falls
back to asking it to close, instead of reporting a live launcher as gone and
writing the payload over it.

* [Installer] Say what the end answer ends, and report a failed end

The prompt offered "end every program listed above", but EndHolders only ends the
programs the payload installs: a scanner holding a payload DLL, or a service the
Restart Manager names by its long name, was listed and then silently left alone, so
Yes looked like it did nothing and the same dialog came back unchanged.

The wording now says which programs Yes ends and that anything else has to be closed
by hand, and the round after an end that did not free the files says so, so the same
dialog no longer reappears word for word. The three prompts are one macro so they
cannot drift apart again.

The added sentences eat into the 1024 characters one NSIS string holds, so the
holder line's budget drops from 400 to 320 characters to keep the longest message
(cancel line included) inside it: 977 characters, measured against the worst case
the probe can produce.

---------

Co-authored-by: sentry[bot] <39604003+sentry[bot]@users.noreply.github.com>
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
2026-10-27 19:09:21 +01:00

62 lines
2.6 KiB
C++

#ifndef HOLDER_LINE_H
#define HOLDER_LINE_H
#include <cstddef>
#include <string>
#include <vector>
/**
* @brief One application or service that has an installer file open or mapped.
*
* Deliberately free of Windows types: the wording is what the abort dialog shows,
* and it is the only part of the probe that can be exercised off Windows.
*/
struct Holder
{
std::wstring imageName; ///< "cockatrice.exe", empty when the image could not be read
std::wstring appName; ///< Restart Manager's name for the application or service
std::wstring serviceShortName; ///< service short name, empty when this is not a service
unsigned long processId = 0;
bool isService = false;
};
/// How many holders the single-line summary names before it says how many were left out.
inline constexpr std::size_t HOLDER_LINE_MAX = 5;
/**
* @brief How many characters the summary may spend on the holders it names.
*
* The line is not the whole string: every prompt puts it after a fixed paragraph and before
* the answers, and one NSIS string holds 1024 characters. Those paragraphs grew when the
* guard started spelling out what ending the programs costs and what is left to do by hand,
* so this budget is what keeps the longest message - the one that also says the last end
* freed nothing, plus the "; and N more" the summary appends after the budget - complete,
* including the Cancel line at its end. Windows caps one application or service name well
* below this, so it bounds the list without ever cutting a single holder short.
*/
inline constexpr std::size_t HOLDER_LINE_CHAR_MAX = 320;
/**
* @brief Renders one holder the way the user has to recognise it, e.g.
* "cockatrice.exe (pid 24340, running)".
*
* The image name is preferred over the application name because it is what Task
* Manager shows, and the application name is what remains for a process whose
* image cannot be opened (another account, a protected process). A service is
* named by Restart Manager's long name and identified by its short name, because
* both are how the user finds it again in services.msc.
*/
std::wstring formatHolder(const Holder &holder);
/**
* @brief Renders every holder as a single "; "-joined line.
*
* One line because it is written to the installer log as one and repeated in a
* message box, where nsExec hands the text back as one string. Only the first
* HOLDER_LINE_MAX are named, and only while they fit in HOLDER_LINE_CHAR_MAX
* characters; the rest are counted, so a machine with a dozen open handles cannot
* push the real answer off the dialog.
*/
std::wstring formatHolders(const std::vector<Holder> &holders);
#endif