• 0

Determine if file is critical system file, HOW


Question

I wanna code to know if file is critical system file (like CONFIG.SYS , NTDETECT.COM , autoexec.bat)

I tried to use code to get file attributes and see if the file has "System" attribute but i found files like autoexec.bat hasn't "system" attribute.

I try to use that C# code but it doesn't work too (Every Time it gives me "True" value)

 public static string isFileSystem(string FileName)
		{
			try
			{
			   Type oType = Type.GetTypeFromProgID("Shell.Application");
			   object objShell = Activator.CreateInstance(oType);
			   object objFolder = oType.InvokeMember("Namespace", System.Reflection.BindingFlags.InvokeMethod, null, objShell, new object[] { new FileInfo(FileName).DirectoryName });
			   object objFolderItem = oType.InvokeMember("ParseName", System.Reflection.BindingFlags.InvokeMethod, null, objFolder, new object[] { new FileInfo(FileName).Name });
			   return oType.InvokeMember("isFileSystem", System.Reflection.BindingFlags.GetProperty, null, objFolderItem , null).ToString();
			}
			catch { return ""; }
		}

The Same code in VB.NET (without Blinding Codes) is

 Public Shared Function isFileSystem(ByVal FileName As String) As String
		Try 
			 Set objShell = CreateObject("Shell.Application")
			 Set objFolder = objShell.Namespace(new FileInfo(FileName).DirectoryName)
			 Set objFolderItem = objFolder.ParseName(new FileInfo(FileName).Name)
			 Return objFolderItem.IsFileSystem.ToString
		Catch
			 Return ""
		End Try
	End Function

I don't know where is the error.

If you have any other code can do the same task without too long codes it'll be good.

12 answers to this question

Recommended Posts

  • 0

This should work in 1.1 or 2.0:

 
	internal class MyMainClass
	{
		public static void Main()
		{
			FileAttributes fas = File.GetAttributes(@"c:\pagefile.sys");
			FileAttributes fa = File.GetAttributes(@"c:\YServer.txt");
			// should be true
			Console.WriteLine("Is System? {0}", (fas & FileAttributes.System) > 0);
			// should be false
			Console.WriteLine("Is System? {0}", (fa & FileAttributes.System) > 0);
		}
	}

In VB

Imports System.IO
Module Module1

	Sub Main()
		Dim fas As FileAttribute
		Dim fa As FileAttribute

		fas = File.GetAttributes("c:\pagefile.sys")
		fa = File.GetAttributes("c:\YServer.txt")

		Console.WriteLine("Is System? {0}", (fas And FileAttribute.System) > 0)
		Console.WriteLine("Is System? {0}", (fa And FileAttribute.System) > 0)
	End Sub

End Module

Edited by azcodemonkey
  • 0
  N_Win_Member said:

Soryy but i think you didn't understand what i was saying.

There is some files like autoexec.bat has no system attributes althouugh it's critical system file.

HOW Can I solve that ?

That IsFileSystem property just determines if it's part of the Windows file system, which is why it returns true all the time.

There must be a way to determine it, but it looks as if it is undocumented. I'll dig around to see what I can find.

  • 0

hi ! Emm, I think i'm correct in saying this, but for Windows versions above 98(2000 and xp) Config.sys , Autoexec.bat are NOT critical system files and hence maybe not marked as system. But i don't think the file attribute 'System' is the way to go about it

take for example, the file (in WinXP) C:\Windows\System32\ntoskrnl.exe i guess we could call it System critical but it has no "System" attribute to it.

I think u should maintain a list of system files and compare from that !

  • 0

I think he means "system file" by the way files are hidden. config.sys and autoexec.bat are hidden in XP. If you uncheck Hide Protected Operating System Files, and select Show Hidden Files and Folders, they show up, and hide when vice versa. I'm kind of curious as to how that is done. So far, I cannot find anything that specifies which files are considered protected OS files.

  • 0

@azcodemonkey

but that would mean that the file i said "ntoskrnl.exe" is not a system file since it does not hide with the "hide protected operating system files"...in any case..i guess, to me maintaining a list of files that we think are system is the only option, i give up !!

  • 0

Well there's SfcIsFileProtected function:

  Quote
Determines whether the specified file is protected (by Windows File Protection). Applications should avoid replacing protected system files.

Sample code, C#:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace WindowsApplication1
{
	public partial class Form1 : Form
	{

		[DllImport("sfc.dll")]
		static extern int SfcIsFileProtected(int handle, [MarshalAs(UnmanagedType.LPWStr)] string path);

		public Form1()
		{
			InitializeComponent();
		}

		private void button1_Click(object sender, EventArgs e)
		{
			if (SfcIsFileProtected(0, textBox1.Text.ToString()) == 0)
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nNot protected");
			}
			else
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nIs protected");
			}
		}
	}
}

  • 0

Ahhh... The consistency of the Win32 API is astounding. :pinch: I don't think it's doable via the API, N_Win.

@Wilhelmus, I think that's for files that are stored in windows/system32/dllcache as part of the Windows File Protection scheme. But, good find, nonetheless.

@Andareed, I'm pretty sure that GetAttributesOf is the equivalent of using FileAttributes. If you only select Show hidden files and folders, config.sys/autoexec.bat/boot.ini, et al, don't show. They only show if you uncheck Hide protected operating system files(Recommended) as well. To boot, config.sys, autoexec.bat, etc, are only tagged as Archive, not Hidden nor System.

I think you're full on correct, ~InstaShock~. A list was actually my initial thought, and I figured it would be in the registry, but I cannot find a thing that declares config.sys as a critical file, which I agree with you on about it not being so.

N_Win, you may want to head over to SysInternals' forum and ask there. Those guys know everything. LOL

  • 0

If you check the description for IShellFolder::GetAttributesOf, for SFGAO_HIDDEN, it says the following:

  Quote
The item is hidden and should not be displayed unless the Show hidden files and folders option is enabled in Folder Settings.

You could try contacting a shell MVP to see if they can shed more light on how shell knows what files to hide.

  • 0

Sorry For my wait replay and Thanks for all these replies and tries. But We are still having the problem here.

First for Wilhelmus Replay that was taking about SfcIsFileProtected sub it doesn't work for all system files it only works with protected files.

About Andareed idea which i was trying to use from the beginning ( Using Shell Method ) but with less complicate way. i was tring to use isfilesystem property that i have found in the following Microsoft link http://msdn2.microsoft.com/en-us/ms723191.aspx It was giving true in each time.

Another way by using shell i found and is working properly but with too long codes can be found in the project http://www.codeproject.com/vb/net/ExpCombo.asp. There is an item called Cshitem in previous explorer project which you can give a path then it will give you a lot of this file or folder properties. By using property called 'IsFileSystem' (one Cshitem properties) you can determine if this file is critical system file and if windows will hide or not. But as I said That is too long and complicated way.

If anyone can fix the first code or have another small code, it will be so good.

Thanks

Edited by N_Win_Member
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Scientists explain how bigger does not mean better for electric vehicles during colds by Sayan Sen Image by Blomst via Pixabay A new study by Cornell University researchers, working with Tompkins Consolidated Area Transit (TCAT), has found that electric buses use a lot more energy in cold weather, especially in places like Ithaca, where the roads are hilly and winters can be harsh. TCAT started testing seven battery-electric buses (BEBs) in 2021 as part of a pilot program funded by a federal grant. Over two years, the buses ran on 41 different routes in Tompkins County.However,t the buses had issues during colder months, with lower driving range and performance. To understand why, researchers looked at real-world data and developed what they called “Optimal Temperature Zone” (OTZ) models—these models show how much energy the buses would have used in ideal temperatures between 16°C and 30°C. When temperatures dropped to between −4°C and 0°C, the buses used about 48.0% more energy, including both power used to drive and energy regenerated through braking, compared to OTZ predictions. Even in the wider range of −12°C to 10°C, energy use still jumped by 28.6%. Half of this extra energy went into heating the batteries themselves. These bus batteries work best at about 24°C, so when it’s cold, they need extra power to warm up before the bus can even get moving. The other major factor was the cabin’s heating system, especially on urban routes where doors open and close often, letting in cold air. “With an all-electric vehicle, the battery is the only onboard energy source,” said Max Zhang, senior author of the study and a professor at Cornell. “Everything has to come from it.” The study also found that regenerative braking—the process that lets the battery recharge a bit while the bus slows down—didn’t work as well in cold conditions. One reason is that these bus batteries are huge, about eight times bigger than typical electric car batteries, and it’s harder to keep the temperature even across all the battery cells. To improve the buses' performance in winter, the researchers suggested a few short-term fixes: parking them indoors to keep them warmer, charging batteries while they’re still warm, and reducing the length of time the doors stay open during stops. On a bigger scale, cities might need to rethink their transit infrastructure. That includes checking how many charging stations they have, whether buses can be kept in heated garages, and how to adjust routes and schedules. “You have to try to optimize the schedule of all of the buses and to consider the capability of your infrastructure – how many charging stations you have, and if you have your own garage,” said lead author and PhD student Jintao Gu. The team found that rural routes, which have fewer stops, use less extra energy in cold weather than urban ones. That could help transit agencies decide which routes are better for electric buses during colder months. “One of the lessons we’ve learned is that these buses should be designed for the whole country, including states with colder climates,” said Zhang. “But any lessons are good lessons. This helps us learn as a society and do better.” Source: Cornell University, ScienceDirect This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act of 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing
    • Appears to be 150W PSU (Core Ultra 9) so most power delivery ports wouldn't even support it.
    • I wasn't implying people should be forced to use a single launcher. I prefer user choice. If Windows includes a decent game launcher, great, people might choose to use it if they want to. If it sucks, no one will use it. I would be completely against anyone being forced in that direction, just like I am against being forced to use 3rd party launchers if I choose to use Steam.
    • Sounds good, but that'd require Microsoft to develop and API of some sort and then get all the developers to support it... but everyone knows that while others will support Microsoft, Microsoft won't support itself and will kill off the feature... again. Microsoft has tried this trick in Windows 9x era, they tried it with the games library in Vista, they tried a big push for Games for Windows Live, and then again in Windows 8 with the WPA apps via their mobile/windows phone eco system. Now they're trying it again, and it's lets not forget that this isn't a push to make PC gaming better. It's not. To do that they need to provide at least the same level of quality and feature set of Steam, otherwise why else are gamers going to not use Steam. Right now Xbox app and everything Microsoft centric around the PC gaming front is exclusively for their new Xbox brand push to make everything an Xbox. Your Toaster, your cat, your PC, your VR headset, everything is a Xbox and that'll last for this generation of Xbox now probably. Then, like Microsoft always has done and will do, they'll drop it like a hot potato and everyone will be left crying. Point in case, bringing Xbox games to the ROG handheld, their entire point of this... They're marketing it as if it's an Xbox console in a handheld, yet, it's not. There are going to be Xbox gamers who think, they'll be able to pickup their Xbox one games and play them on a handheld like Nintendo and Steam Deck users... except they're going to quickly find out that their Xbox game library is almost entirely missing or games they've already purchased on the Xbox need to be purchased again on the 'this is an Xbox' handheld.
  • Recent Achievements

    • Dedicated
      tesla maxwell earned a badge
      Dedicated
    • Dedicated
      Camlann earned a badge
      Dedicated
    • Week One Done
      fredss earned a badge
      Week One Done
    • Dedicated
      fabioc earned a badge
      Dedicated
    • Week One Done
      GoForma earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      637
    2. 2
      Michael Scrip
      224
    3. 3
      ATLien_0
      219
    4. 4
      +FloatingFatMan
      142
    5. 5
      Xenon
      135
  • Tell a friend

    Love Neowin? Tell a friend!