Javascript Windows Logoff - logoff.exe

Question

I'm developing an HTA file and i"m trying to create a link in wich the user will be logged off when clicked.

My function:

function fn_fecha()
{
WshShell = new ActiveXObject("WScript.Shell");
WshShell.Run("C:\\Windows\\System32\\logoff.exe");
}

and the call:

<tr>
<td WIDTH=300>
</td>            
<td>
<a id=hsair href="#" onclick="javascript:fn_fecha"  >SAIR</a>
</td>               
</tr>

I've tried both the function with just one "\" (c:\windows\system32\logoff.exe) and the function with fn_fecha(), but it does not find the file when i do this. The HTA file is hosted on a server (but is not open via IIS).

Answer 1

In Windows 7 x64 you can find the folder "C:\Windows\SysWOW64", which contains some 32-bit applications and libraries to create a 32-bit compatible environment.

(See also: Why do 64-bit DLLs go to System32 and 32-bit DLLs to SysWoW64 on 64-bit Windows?)

In this case, you meant to invoke C:\Windows\System32\logoff.exe, but somehow the path had been redirected to C:\Windows\SysWOW64\logoff.exe, which does not exist. So here you got a file-not-found error.

You can do a experiment to prove it. Just copy an executable to C:\Windows\SysWOW64\test1.exe, and try run the following code with mshta. See the magic?

    <script>new ActiveXObject("WScript.Shell").Run(
"C:\\Windows\\System32\\test1.exe");</script>

P.S. To my surprise, both mshta.exe and wshom.ocx are 64-bit, then why does Windows direct the path to SysWOW64?

Answer 2

Solution

Instead of specifying the path C:\Windows\System32 use the special alias %WINDIR%\Sysnative

function fn_fecha()
{
WshShell = new ActiveXObject("WScript.Shell");
WshShell.Run("%WINDIR%/Sysnative/logoff.exe");
}

Explanation

Your 32-bit application is trying to access code in the %Windir%\System32 folder which is reserved for 64-bit code. Windows is silently redirecting your request as explained by this Microsoft KB article:

On a computer that is running a 64-bit version of Windows...a 32-bit application cannot access the following folder:

%WinDir%\System32

Therefore, the 32-bit application cannot start any 64-bit applications in the System32 folder. Additionally, the 32-bit application cannot retrieve file information about any files in the System32 folder or in the subfolders of the System32 folder....

This behavior occurs because Windows on Windows 64-bit (WOW64) provides file system redirection. In a 64-bit version of Windows...the %WinDir%\System32 folder is reserved for 64-bit applications. When a 32-bit application tries to access the System32 folder, access is redirected to the following folder:

%WinDir%\SysWOW64

By default, file system redirection is enabled.

In your case logoff.exe doesn't exist in the SysWOW64 folder, producing the file not found error. The article explains that the special alias %WinDir%\Sysnative bypasses the unwanted file redirection:

WOW64 recognizes the Sysnative folder as a special alias. Therefore, the file system does not redirect access away from the Sysnative folder. This mechanism is flexible and easy to use. You can use the Sysnative folder to bypass file system redirection.

Note that the hotfix mentioned in the article only applies to Windows Server 2003/XP. This functionality is built in to later versions of Windows.