Everything

php

Home » Project » Newsgroups » php.internals » php-win32 writing to system32 dir? »

php-win32 writing to system32 dir?

php.internals

Dietrich Ayala

23 years ago

php.exe seems to be writing to this file every time it loads:

C:\WINNT\system32\config\software.LOG

anyone have info on why this is happening, and how i would stop it?

TIA,

dietrich

Marshall A. Greenblatt

23 years ago

----- Original Message -----
From: "Dietrich Ayala" <dietrich@ganx4.com>
To: <internals@lists.php.net>
Sent: Wednesday, June 11, 2003 4:13 PM
Subject: [PHP-DEV] php-win32 writing to system32 dir?

> php.exe seems to be writing to this file every time it loads:
>
> C:\WINNT\system32\config\software.LOG
>
> anyone have info on why this is happening, and how i would stop it?

This file is the repository for the HKEY_LOCAL_MACHINE\SOFTWARE registry
hive on Windows NT systems -- it's not specific to PHP.

See http://scilnet.fortlewis.edu/tech/NT-Server/registry.htm

>
> TIA,
>
> dietrich

- Marshall

Derick Rethans

23 years ago

On Wed, 11 Jun 2003, Dietrich Ayala wrote:

> php.exe seems to be writing to this file every time it loads:
>
> C:\WINNT\system32\config\software.LOG
>
> anyone have info on why this is happening, and how i would stop it?

What does it put in that log?

regards,
Derick

--
"Interpreting what the GPL actually means is a job best left to those
that read the future by examining animal entrails."
-------------------------------------------------------------------------
Derick Rethans                                 http://derickrethans.nl/
International PHP Magazine                          http://php-mag.net/
-------------------------------------------------------------------------

Dietrich Ayala

23 years ago

cannot open it, is locked by system. registry uses it (thanks marshall).

here's the filemon (sysinternals.com) output:

1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
1:36:31 PM php.exe:1380 SET INFORMATION
C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288

----- Original Message -----
From: "Derick Rethans" <derick@php.net>
To: "Dietrich Ayala" <dietrich@ganx4.com>
Cc: <internals@lists.php.net>
Sent: Wednesday, June 11, 2003 1:28 PM
Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?

DvDmanDT

23 years ago

You can most likely compy the file, then open it... That's what I do on the
Apache logs.. :p
"Dietrich Ayala" <dietrich@ganx4.com> skrev i meddelandet
news:004101c33059$9c0f3210$6302000a@foundstone.com...

Dietrich Ayala

23 years ago

Thanks, but I tried that one straight away :) It's locked down, cannot even
copy it.

Do any php-win developers have any idea why this is happening? I'm assuming
php is making some system call to write data to the hive, as it's not
accessible directly. It makes the same 3 writes every time it loads.

TIA,

-dietrich

"DvDmanDT" <dvdmandt@telia.com> wrote in message
news:20030612013830.28640.qmail@pb1.pair.com...

> You can most likely compy the file, then open it... That's what I do on

the

> Apache logs.. :p
> "Dietrich Ayala" <dietrich@ganx4.com> skrev i meddelandet
> news:004101c33059$9c0f3210$6302000a@foundstone.com...
> > cannot open it, is locked by system. registry uses it (thanks marshall).
> >
> > here's the filemon (sysinternals.com) output:
> >
> > 1:36:31 PM php.exe:1380 SET INFORMATION
> > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
> > 1:36:31 PM php.exe:1380 SET INFORMATION
> > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
> > 1:36:31 PM php.exe:1380 SET INFORMATION
> > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288
> >
> > ----- Original Message -----
> > From: "Derick Rethans" <derick@php.net>
> > To: "Dietrich Ayala" <dietrich@ganx4.com>
> > Cc: <internals@lists.php.net>
> > Sent: Wednesday, June 11, 2003 1:28 PM
> > Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?
> >
> >
> > > On Wed, 11 Jun 2003, Dietrich Ayala wrote:
> > >
> > > > php.exe seems to be writing to this file every time it loads:
> > > >
> > > > C:\WINNT\system32\config\software.LOG
> > > >
> > > > anyone have info on why this is happening, and how i would stop it?
> > >
> > > What does it put in that log?
> > >
> > > regards,
> > > Derick
> > >
> > > --
> > > "Interpreting what the GPL actually means is a job best left to those
> > >                     that read the future by examining animal

entrails."

> >
>
> -------------------------------------------------------------------------
> > >  Derick Rethans

http://derickrethans.nl/

> > >  International PHP Magazine

http://php-mag.net/

DvDmanDT

23 years ago

Maybe you could use some kind of boot disk to open the file and check the
contents... But I'm not sure if NTFS and boot disks come along very well...
:p

I would also consider using hackman (HEX editor) to open file system and
check the file from there, although, that's kinda hard...
"Dietrich Ayala" <dietrich@ganx4.com> skrev i meddelandet
news:012701c33084$a68ed260$6302000a@foundstone.com...

> Thanks, but I tried that one straight away :) It's locked down, cannot

even

> copy it.
>
> Do any php-win developers have any idea why this is happening? I'm

assuming

> php is making some system call to write data to the hive, as it's not
> accessible directly. It makes the same 3 writes every time it loads.
>
> TIA,
>
> -dietrich
>
> "DvDmanDT" <dvdmandt@telia.com> wrote in message
> news:20030612013830.28640.qmail@pb1.pair.com...
> > You can most likely compy the file, then open it... That's what I do on
> the
> > Apache logs.. :p
> > "Dietrich Ayala" <dietrich@ganx4.com> skrev i meddelandet
> > news:004101c33059$9c0f3210$6302000a@foundstone.com...
> > > cannot open it, is locked by system. registry uses it (thanks

marshall).

> > >
> > > here's the filemon (sysinternals.com) output:
> > >
> > > 1:36:31 PM php.exe:1380 SET INFORMATION
> > > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
> > > 1:36:31 PM php.exe:1380 SET INFORMATION
> > > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 8192
> > > 1:36:31 PM php.exe:1380 SET INFORMATION
> > > C:\WINNT\System32\Config\SOFTWARE.LOG SUCCESS Length: 12288
> > >
> > > ----- Original Message -----
> > > From: "Derick Rethans" <derick@php.net>
> > > To: "Dietrich Ayala" <dietrich@ganx4.com>
> > > Cc: <internals@lists.php.net>
> > > Sent: Wednesday, June 11, 2003 1:28 PM
> > > Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?
> > >
> > >
> > > > On Wed, 11 Jun 2003, Dietrich Ayala wrote:
> > > >
> > > > > php.exe seems to be writing to this file every time it loads:
> > > > >
> > > > > C:\WINNT\system32\config\software.LOG
> > > > >
> > > > > anyone have info on why this is happening, and how i would stop

it?

> > > >
> > > > What does it put in that log?
> > > >
> > > > regards,
> > > > Derick
> > > >
> > > > --
> > > > "Interpreting what the GPL actually means is a job best left to

those

Andrey Hristov

23 years ago

The linux kernel has NTFS module which can read NTFS
partitions wo problems.


Andrey


----- Original Message -----
From: "DvDmanDT" <dvdmandt@telia.com>
To: <internals@lists.php.net>
Sent: Thursday, June 12, 2003 5:21 AM
Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?

> Maybe you could use some kind of boot disk to open the file and check the
> contents... But I'm not sure if NTFS and boot disks come along very

well...

> :p
>
> I would also consider using hackman (HEX editor) to open file system and
> check the file from there, although, that's kinda hard...
> "Dietrich Ayala" <dietrich@ganx4.com> skrev i meddelandet
> news:012701c33084$a68ed260$6302000a@foundstone.com...
> > Thanks, but I tried that one straight away :) It's locked down, cannot
> even
> > copy it.
> >
> > Do any php-win developers have any idea why this is happening? I'm
> assuming
> > php is making some system call to write data to the hive, as it's not
> > accessible directly. It makes the same 3 writes every time it loads.
> >
> > TIA,
> >
> > -dietrich
> >
> > "DvDmanDT" <dvdmandt@telia.com> wrote in message
> > news:20030612013830.28640.qmail@pb1.pair.com...
> > > You can most likely compy the file, then open it... That's what I do

on

Wez Furlong

23 years ago

It could be PHP looking for the per-directory configuration settings
from the registry. (PHP makes the accesses in read-only mode, but the
registry might be doing something funky to handle locking).

OR, it could be a dll that is loaded by one of your PHP extensions.

Have you tried using a tool such as regmon to spy on it?

http://www.sysinternals.com/ntw2k/source/regmon.shtml

--Wez.

On Wed, 11 Jun 2003, Dietrich Ayala wrote:

Dietrich Ayala

23 years ago

Thanks Wez.

Regmon showed a series of registry accesses by php.exe, all reading.

looks like <snip>registry might be doing something funky to handle
locking</snip> is probably the case.

-d

----- Original Message -----
From: "Wez Furlong" <wez@thebrainroom.com>
To: "Dietrich Ayala" <dietrich@ganx4.com>
Cc: <internals@lists.php.net>
Sent: Thursday, June 12, 2003 12:42 AM
Subject: Re: [PHP-DEV] php-win32 writing to system32 dir?

> It could be PHP looking for the per-directory configuration settings
> from the registry. (PHP makes the accesses in read-only mode, but the
> registry might be doing something funky to handle locking).
>
> OR, it could be a dll that is loaded by one of your PHP extensions.
>
> Have you tried using a tool such as regmon to spy on it?
>
> http://www.sysinternals.com/ntw2k/source/regmon.shtml
>
> --Wez.
>
> On Wed, 11 Jun 2003, Dietrich Ayala wrote:
>
> > Thanks, but I tried that one straight away :) It's locked down, cannot

even

> > copy it.
> >
> > Do any php-win developers have any idea why this is happening? I'm

assuming