Why does my IL generated Assembly, ilasm.exe called by C#, need UAC?

Go To StackoverFlow.com


I'm trying to compile an IL Code to an Assembly. The ilasm.exe should get called by my C# Application. I'm invoking the ilasm.exe through an ProcessStartInfo Instance. The generation of the PE works fine and my Assembly is working.

My problem is that the files that were created by my application, afterwards need administrator privileges to be executed.

If I call ilasm.exe manually from command line, no admin rights are needed.

Used ilasm.exe command: ilasm.exe /qui /output="c:\test\newFile.exe" <path to il file>

My Application calling the ilasm.exe:

ProcessStartInfo startInfo = new ProcessStartInfo();
startInfo.CreateNoWindow = false;
startInfo.UseShellExecute = false;
startInfo.FileName = @"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe";
startInfo.WindowStyle = ProcessWindowStyle.Hidden;
startInfo.Arguments = ilFilePath + " /qui /output=" + outputPath + "testFile.exe";

    using (Process exeProcess = Process.Start(startInfo))
    // Log error.

Am I doing anything wrong? Do I need to specify anything else when calling another Process from C#?

I'm running my Application and the commandline without admin rights.

2012-04-04 00:20
by Patrick Trautmann
What is the error you receive as non-admin? What is patchFile? You are not calling it identically to how you said you call it from the command line - Chris Benard 2012-04-04 00:24
Sorry I forgot to mention some things. patchFile is in this case the path to the file containing the il code. I'm not getting any errors. The Error is that ilasm.exe calls through c# code, afterwards needs admin rights to get executed, while ilasm.exe calls through cmd don't need them - Patrick Trautmann 2012-04-04 00:36
If I understand you, you are saying both generate valid EXEs, but the one generated from Process.Start makes your computer go BOOP and pop the UAC prompt. If that's the case, it sounds like the one from code is embedding the highestAvailable requestedExecutionLevel explained here. If so, I have no clue why it would be different - Chris Benard 2012-04-04 00:40


It's requiring UAC because you're not supplying a path to a writable location in output, so it's trying to write to the same folder ilasm is in (or the current folder for your app).

A non-admin user doesn't have write access to anything under %WINDIR% (the Windows folder) or %ProgramFiles%, so it's asking for elevation to a user that does have write access to the folder.

2012-04-04 00:27
by Ken White
yes I'm sorry. I forgot to declare my variables. An complete generated call from C# would be ilasm.exe C:\Test\myilcode.il /qui /output=C:\Test\testFile.exe. The exact called command called by my application needs admin rights afterwards, while the one called manualy from cmd don't. So actually I'm not writing to an System Folder : - Patrick Trautmann 2012-04-04 00:40
OK. I'll leave my answer for now, because it does address the original question as asked and might be useful to someone in the future. (And for future reference, when you have problems it helps get you answers if you provide all of the pertinent information. :) It means people have all the facts before they post answers, which means there's less chance they'll have to delete it afterward when you add details that invalidate the answer. - Ken White 2012-04-04 00:47
'all of the pertinent information' is relevant, you'll have a howl at my answer : - Hans Passant 2012-04-04 04:46
I'm sorry. Next time I will be more precise ;) But thank you all for trying to help - Patrick Trautmann 2012-04-04 11:54


What is patchFile?

This comment by @Chris is relevant to this puzzle, I don't see it in the question. You are probably dealing with a difficult problem that Microsoft needed to solve with UAC. Supporting old programs that need UAC privileges but don't ask for it because they were written before Vista. Like installers. And patch programs.

My crystal ball says that your actual program name is not newFile.exe like your question says but has a name like "update.exe" or "patch.exe". And furthermore, it isn't obvious either, that you don't include a manifest in the program you generated. A manifest that says that the program is Vista aware with the <requestedExecutionLevel> element. And furthermore, also not obvious, that when you run this from the command line by hand that you use another name for the .exe.

That's a lot of guesses, but put them together and it makes sense: Windows goes "aha! Old program, sounds like it is going to want to write to .exe files in a restricted directory. Better display the UAC prompt".

2012-04-04 04:43
by Hans Passant
Ah, nice catch! I'd forgotten the update, setup, and install filename issues! +1, because you're probably 100% on the money with this "psychic" answer. (I really wish people would post actual code and var contents, anonymising only the absolute minumum, instead of fictionalizing meaningless things to be overprotective. It would make it much easier to catch things like this, I think.) : - Ken White 2012-04-04 10:57