# php-win32 writing to system32 dir? - Thread: https://externals.io/message/2287 - Original archive: https://news-web.php.net/php.internals/2287 - Started by Dietrich Ayala on 2003-06-11T20:13:51+00:00 - Messages: 10 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #2287 — Dietrich Ayala — 2003-06-11T20:13:51+00:00 URL: https://externals.io/message/2287#2287 php.exe seems to be writing to this file every time it loads: C:\WINNT\system32\config\software.LOG anyone have info on why this is happening, and how i would stop it? TIA, dietrich --- ## #2289 — Derick Rethans — 2003-06-11T20:28:27+00:00 URL: https://externals.io/message/2287#2289 · In reply to: #2287 > php.exe seems to be writing to this file every time it loads: > > C:\WINNT\system32\config\software.LOG > > anyone have info on why this is happening, and how i would stop it? What does it put in that log? regards, Derick -- "Interpreting what the GPL actually means is a job best left to those that read the future by examining animal entrails." ------------------------------------------------------------------------- Derick Rethans http://derickrethans.nl/ International PHP Magazine http://php-mag.net/ --- ## #2288 — Marshall A. Greenblatt — 2003-06-11T20:29:59+00:00 URL: https://externals.io/message/2287#2288 · In reply to: #2287 ----- Original Message ----- From: "Dietrich Ayala" To: Sent: Wednesday, June 11, 2003 4:13 PM Subject: [PHP-DEV] php-win32 writing to system32 dir? > php.exe seems to be writing to this file every time it loads: > > C:\WINNT\system32\config\software.LOG > > anyone have info on why this is happening, and how i would stop it? This file is the repository for the HKEY_LOCAL_MACHINE\SOFTWARE registry hive on Windows NT systems -- it's not specific to PHP. See http://scilnet.fortlewis.edu/tech/NT-Server/registry.htm > > TIA, > > dietrich - Marshall --- ## #2290 — Dietrich Ayala — 2003-06-11T20:39:51+00:00 URL: https://externals.io/message/2287#2290 · In reply to: #2289 cannot open it, is locked by system. registry uses it (thanks marshall). here's the filemon (sysinternals.com) output: 1:36:31 PM php.exe:1380 SET INFORMATION C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192 1:36:31 PM php.exe:1380 SET INFORMATION C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192 1:36:31 PM php.exe:1380 SET INFORMATION C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288 ----- Original Message ----- From: "Derick Rethans" To: "Dietrich Ayala" Cc: Sent: Wednesday, June 11, 2003 1:28 PM Subject: Re: [PHP-DEV] php-win32 writing to system32 dir? > > > > […] > > What does it put in that log? > > regards, > Derick > > -- > "Interpreting what the GPL actually means is a job best left to those > that read the future by examining animal entrails." > ------------------------------------------------------------------------- > Derick Rethans http://derickrethans.nl/ > International PHP Magazine http://php-mag.net/ --- ## #2293 — Dietrich Ayala — 2003-06-12T01:47:54+00:00 URL: https://externals.io/message/2287#2293 · In reply to: #2289 Thanks, but I tried that one straight away :) It's locked down, cannot even copy it. Do any php-win developers have any idea why this is happening? I'm assuming php is making some system call to write data to the hive, as it's not accessible directly. It makes the same 3 writes every time it loads. TIA, -dietrich "DvDmanDT" wrote in message news:20030612013830.28640.qmail@pb1.pair.com... > You can most likely compy the file, then open it... That's what I do on the > Apache logs.. :p > "Dietrich Ayala" skrev i meddelandet > news:004101c33059$9c0f3210$6302000a@foundstone.com... > > […] entrails." > > […] > > ------------------------------------------------------------------------- > > […] http://derickrethans.nl/ > > […] http://php-mag.net/ --- ## #2292 — DvDmanDT — 2003-06-12T01:56:08+00:00 URL: https://externals.io/message/2287#2292 · In reply to: #2290 You can most likely compy the file, then open it... That's what I do on the Apache logs.. :p "Dietrich Ayala" skrev i meddelandet news:004101c33059$9c0f3210$6302000a@foundstone.com... > cannot open it, is locked by system. registry uses it (thanks marshall). > > here's the filemon (sysinternals.com) output: > > 1:36:31 PM php.exe:1380 SET INFORMATION > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192 > 1:36:31 PM php.exe:1380 SET INFORMATION > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192 > 1:36:31 PM php.exe:1380 SET INFORMATION > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288 > > ----- Original Message ----- > From: "Derick Rethans" > To: "Dietrich Ayala" > Cc: > Sent: Wednesday, June 11, 2003 1:28 PM > Subject: Re: [PHP-DEV] php-win32 writing to system32 dir? > > > > […] > > ------------------------------------------------------------------------- > > […] --- ## #2294 — DvDmanDT — 2003-06-12T02:21:34+00:00 URL: https://externals.io/message/2287#2294 · In reply to: #2293 Maybe you could use some kind of boot disk to open the file and check the contents... But I'm not sure if NTFS and boot disks come along very well... :p I would also consider using hackman (HEX editor) to open file system and check the file from there, although, that's kinda hard... "Dietrich Ayala" skrev i meddelandet news:012701c33084$a68ed260$6302000a@foundstone.com... > Thanks, but I tried that one straight away :) It's locked down, cannot even > copy it. > > Do any php-win developers have any idea why this is happening? I'm assuming > php is making some system call to write data to the hive, as it's not > accessible directly. It makes the same 3 writes every time it loads. > > TIA, > > -dietrich > > "DvDmanDT" wrote in message > news:20030612013830.28640.qmail@pb1.pair.com... > > […] > the > > […] marshall). > > […] it? > > […] those > > […] > entrails." > > […] > > ------------------------------------------------------------------------- > > […] > http://derickrethans.nl/ > > […] > http://php-mag.net/ --- ## #2296 — Andrey Hristov — 2003-06-12T07:09:15+00:00 URL: https://externals.io/message/2287#2296 · In reply to: #2294 The linux kernel has NTFS module which can read NTFS partitions wo problems. Andrey ----- Original Message ----- From: "DvDmanDT" To: Sent: Thursday, June 12, 2003 5:21 AM Subject: Re: [PHP-DEV] php-win32 writing to system32 dir? > Maybe you could use some kind of boot disk to open the file and check the > contents... But I'm not sure if NTFS and boot disks come along very well... > :p > > I would also consider using hackman (HEX editor) to open file system and > check the file from there, although, that's kinda hard... > "Dietrich Ayala" skrev i meddelandet > news:012701c33084$a68ed260$6302000a@foundstone.com... > > […] > even > > […] > assuming > > […] on > > […] > marshall). > > […] > it? > > […] > those > > […] > > ------------------------------------------------------------------------- > > […] --- ## #2297 — Wez Furlong — 2003-06-12T07:42:16+00:00 URL: https://externals.io/message/2287#2297 · In reply to: #2293 It could be PHP looking for the per-directory configuration settings from the registry. (PHP makes the accesses in read-only mode, but the registry might be doing something funky to handle locking). OR, it could be a dll that is loaded by one of your PHP extensions. Have you tried using a tool such as regmon to spy on it? http://www.sysinternals.com/ntw2k/source/regmon.shtml --Wez. > Thanks, but I tried that one straight away :) It's locked down, cannot even > copy it. > > Do any php-win developers have any idea why this is happening? I'm assuming > php is making some system call to write data to the hive, as it's not > accessible directly. It makes the same 3 writes every time it loads. --- ## #2300 — Dietrich Ayala — 2003-06-12T19:14:10+00:00 URL: https://externals.io/message/2287#2300 · In reply to: #2297 Thanks Wez. Regmon showed a series of registry accesses by php.exe, all reading. looks like registry might be doing something funky to handle locking is probably the case. -d ----- Original Message ----- From: "Wez Furlong" To: "Dietrich Ayala" Cc: Sent: Thursday, June 12, 2003 12:42 AM Subject: Re: [PHP-DEV] php-win32 writing to system32 dir? > It could be PHP looking for the per-directory configuration settings > from the registry. (PHP makes the accesses in read-only mode, but the > registry might be doing something funky to handle locking). > > OR, it could be a dll that is loaded by one of your PHP extensions. > > Have you tried using a tool such as regmon to spy on it? > > http://www.sysinternals.com/ntw2k/source/regmon.shtml > > --Wez. > > > > > […] even > > […] assuming > > […]