php-win32 writing to system32 dir? View as Markdown

You can most likely compy the file, then open it... That's what I do on the
Apache logs.. :p
"Dietrich Ayala" dietrich@ganx4.com skrev i meddelandet
news:004101c33059$9c0f3210$6302000a@foundstone.com...

cannot open it, is locked by system. registry uses it (thanks marshall).

here's the filemon (sysinternals.com) output:

1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288

----- Original Message -----
From: "Derick Rethans" derick@php.net
To: "Dietrich Ayala" dietrich@ganx4.com
Cc: internals@lists.php.net
Sent: Wednesday, June 11, 2003 1:28 PM
Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?

php.exe seems to be writing to this file every time it loads:

C:\WINNT\system32\config\software.LOG

anyone have info on why this is happening, and how i would stop it?

What does it put in that log?

regards,
Derick

--
"Interpreting what the GPL actually means is a job best left to those
that read the future by examining animal entrails."

---

Derick Rethans http://derickrethans.nl/
International PHP Magazine http://php-mag.net/

Maybe you could use some kind of boot disk to open the file and check the
contents... But I'm not sure if NTFS and boot disks come along very well...
:p

I would also consider using hackman (HEX editor) to open file system and
check the file from there, although, that's kinda hard...
"Dietrich Ayala" dietrich@ganx4.com skrev i meddelandet
news:012701c33084$a68ed260$6302000a@foundstone.com...

Thanks, but I tried that one straight away :) It's locked down, cannot
even
copy it.

Do any php-win developers have any idea why this is happening? I'm
assuming
php is making some system call to write data to the hive, as it's not
accessible directly. It makes the same 3 writes every time it loads.

TIA,

-dietrich

"DvDmanDT" dvdmandt@telia.com wrote in message
news:20030612013830.28640.qmail@pb1.pair.com...

You can most likely compy the file, then open it... That's what I do on
the
Apache logs.. :p
"Dietrich Ayala" dietrich@ganx4.com skrev i meddelandet
news:004101c33059$9c0f3210$6302000a@foundstone.com...

cannot open it, is locked by system. registry uses it (thanks
marshall).

here's the filemon (sysinternals.com) output:

1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288

----- Original Message -----
From: "Derick Rethans" derick@php.net
To: "Dietrich Ayala" dietrich@ganx4.com
Cc: internals@lists.php.net
Sent: Wednesday, June 11, 2003 1:28 PM
Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?

php.exe seems to be writing to this file every time it loads:

C:\WINNT\system32\config\software.LOG

anyone have info on why this is happening, and how i would stop
it?

What does it put in that log?

regards,
Derick

--
"Interpreting what the GPL actually means is a job best left to
those
that read the future by examining animal
entrails."

---

Derick Rethans
http://derickrethans.nl/
International PHP Magazine
http://php-mag.net/

It could be PHP looking for the per-directory configuration settings
from the registry. (PHP makes the accesses in read-only mode, but the
registry might be doing something funky to handle locking).

OR, it could be a dll that is loaded by one of your PHP extensions.

Have you tried using a tool such as regmon to spy on it?

http://www.sysinternals.com/ntw2k/source/regmon.shtml

--Wez.

Thanks, but I tried that one straight away :) It's locked down, cannot even
copy it.

Do any php-win developers have any idea why this is happening? I'm assuming
php is making some system call to write data to the hive, as it's not
accessible directly. It makes the same 3 writes every time it loads.