windows-server-2003/inetsrv/iis/setup/acwebsvc

Notes about using AcWebSvc.dll

------------------------------

In order for AcWebSvc.dll to hook a process, two things must happen:

 - AcWebSvc.dll must be copied into the %windir%\apppatch directory.

 - An entry must be made in the App Compat database.



To create the entry in the App Compat database, it's necessary

to create an xml file describing the process to be hooked.



Below is sample xml that describes a pretty contrived scenario.  It

basically hooks notepad.exe and associates it with an IIS application

called "Notepad IIS App!".  This fake application includes two ISAPI

extensions called, GetClientInfo.dll and ReadEntity.dll, which are

installed in a path that can be acquired by reading a key from the

registry.  It has a dependency on its own ISAPI extensions and also

something (that is also made up) called IISASP60.  Finally, the sample

uses a setup indicator file, called "file.txt" to determine whether

the app is installed or not (note that this entry is optional in the

xml, and if a SetupIndicatorFile is not present, the shim will use

the presence of any of the listed extensions to determine if the

shimmed process installed or uninstalled.)  Finally, the shim is

able to force enable all dependencies of this application, including

both its own extensions and any dependent applications.  To do this,

set the "HonorDisabledExtensionsAndApplications" setting to "FALSE".

Note that this violates our suggested best practices for app

installation, and will enable all dependencies even if the administrator

for the server intentionally disabled them for security reasons.



To insert the xml into the database, first create a database file

by running the following command, which produces a file called

notepad.sdb:



     shimdbc custom notepad.xml notepad.sdb



Finally, to include the notepad.sdb file into the database, run

the following command:



     sdbinst notepad.sdb



Once these steps are done, any processes called "notepad.exe" will

inject AcWebSvc.dll and hook on process exit.



To remove the entry from the AppCompat database, run the

following command:



     sdbinst -u notepad.exe



For more information about creating xml to describe a "real"

application, see the following:



     http://winwebsites/AppCompat/Development.



For more information about how the DATA tags work with

the IIS lockdown mechanism, see section 4.1.2.1 of the

following:



     http://iis6/Specs/SecurityConsoleMetadata.doc





-----Sample XML-----

<?xml version="1.0" encoding="Windows-1252"?>

<DATABASE NAME="IIS Database"> 



    <LIBRARY> 



        <SHIM NAME="EnableIIS" FILE="AcWebSvc.dll"/> 



    </LIBRARY> 



    <APP NAME="Sample XML Using Notepad" VENDOR="Microsoft"> 



        <EXE NAME="NOTEPAD.EXE"> 



            <SHIM NAME="EnableIIS" COMMAND_LINE="%DbInfo%"> 



                <INCLUDE MODULE="*"/> 

                <INCLUDE MODULE="%EXE%"/> 



                <DATA NAME="AppName" VALUETYPE="STRING" VALUE="Notepad IIS App!"/>

                <DATA NAME="BasePath" VALUETYPE="STRING" VALUE="HKEY_LOCAL_MACHINE\Software\WadeH\InstallPath"/>

                <DATA NAME="PathType" VALUETYPE="STRING" VALUE="1"/>

                <DATA NAME="WebSvcExtensions" VALUETYPE="STRING" VALUE="GetClientInfo.dll,ReadEntity.dll"/>

                <DATA NAME="GroupID" VALUETYPE="STRING" VALUE="NPISA"/>

                <DATA NAME="GroupDesc" VALUETYPE="STRING" VALUE="Way Cool Notepad IIS Stuff!"/>

                <DATA NAME="EnableExtGroups" VALUETYPE="STRING" VALUE="IISASP60"/>

                <DATA NAME="SetupIndicatorFile" VALUETYPE="STRING" VALUE="file.txt"/>

                <DATA NAME="HonorDisabledExtensionsAndDependencies" VALUETYPE="STRING" VALUE="TRUE"/>



            </SHIM> 



        </EXE> 



    </APP> 



</DATABASE>

-----Sample XML-----