• 0

Determine if file is critical system file, HOW


Question

I wanna code to know if file is critical system file (like CONFIG.SYS , NTDETECT.COM , autoexec.bat)

I tried to use code to get file attributes and see if the file has "System" attribute but i found files like autoexec.bat hasn't "system" attribute.

I try to use that C# code but it doesn't work too (Every Time it gives me "True" value)

 public static string isFileSystem(string FileName)
		{
			try
			{
			   Type oType = Type.GetTypeFromProgID("Shell.Application");
			   object objShell = Activator.CreateInstance(oType);
			   object objFolder = oType.InvokeMember("Namespace", System.Reflection.BindingFlags.InvokeMethod, null, objShell, new object[] { new FileInfo(FileName).DirectoryName });
			   object objFolderItem = oType.InvokeMember("ParseName", System.Reflection.BindingFlags.InvokeMethod, null, objFolder, new object[] { new FileInfo(FileName).Name });
			   return oType.InvokeMember("isFileSystem", System.Reflection.BindingFlags.GetProperty, null, objFolderItem , null).ToString();
			}
			catch { return ""; }
		}

The Same code in VB.NET (without Blinding Codes) is

 Public Shared Function isFileSystem(ByVal FileName As String) As String
		Try 
			 Set objShell = CreateObject("Shell.Application")
			 Set objFolder = objShell.Namespace(new FileInfo(FileName).DirectoryName)
			 Set objFolderItem = objFolder.ParseName(new FileInfo(FileName).Name)
			 Return objFolderItem.IsFileSystem.ToString
		Catch
			 Return ""
		End Try
	End Function

I don't know where is the error.

If you have any other code can do the same task without too long codes it'll be good.

12 answers to this question

Recommended Posts

  • 0

This should work in 1.1 or 2.0:

 
	internal class MyMainClass
	{
		public static void Main()
		{
			FileAttributes fas = File.GetAttributes(@"c:\pagefile.sys");
			FileAttributes fa = File.GetAttributes(@"c:\YServer.txt");
			// should be true
			Console.WriteLine("Is System? {0}", (fas & FileAttributes.System) > 0);
			// should be false
			Console.WriteLine("Is System? {0}", (fa & FileAttributes.System) > 0);
		}
	}

In VB

Imports System.IO
Module Module1

	Sub Main()
		Dim fas As FileAttribute
		Dim fa As FileAttribute

		fas = File.GetAttributes("c:\pagefile.sys")
		fa = File.GetAttributes("c:\YServer.txt")

		Console.WriteLine("Is System? {0}", (fas And FileAttribute.System) > 0)
		Console.WriteLine("Is System? {0}", (fa And FileAttribute.System) > 0)
	End Sub

End Module

Edited by azcodemonkey
  • 0
  N_Win_Member said:

Soryy but i think you didn't understand what i was saying.

There is some files like autoexec.bat has no system attributes althouugh it's critical system file.

HOW Can I solve that ?

That IsFileSystem property just determines if it's part of the Windows file system, which is why it returns true all the time.

There must be a way to determine it, but it looks as if it is undocumented. I'll dig around to see what I can find.

  • 0

hi ! Emm, I think i'm correct in saying this, but for Windows versions above 98(2000 and xp) Config.sys , Autoexec.bat are NOT critical system files and hence maybe not marked as system. But i don't think the file attribute 'System' is the way to go about it

take for example, the file (in WinXP) C:\Windows\System32\ntoskrnl.exe i guess we could call it System critical but it has no "System" attribute to it.

I think u should maintain a list of system files and compare from that !

  • 0

I think he means "system file" by the way files are hidden. config.sys and autoexec.bat are hidden in XP. If you uncheck Hide Protected Operating System Files, and select Show Hidden Files and Folders, they show up, and hide when vice versa. I'm kind of curious as to how that is done. So far, I cannot find anything that specifies which files are considered protected OS files.

  • 0

@azcodemonkey

but that would mean that the file i said "ntoskrnl.exe" is not a system file since it does not hide with the "hide protected operating system files"...in any case..i guess, to me maintaining a list of files that we think are system is the only option, i give up !!

  • 0

Well there's SfcIsFileProtected function:

  Quote
Determines whether the specified file is protected (by Windows File Protection). Applications should avoid replacing protected system files.

Sample code, C#:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace WindowsApplication1
{
	public partial class Form1 : Form
	{

		[DllImport("sfc.dll")]
		static extern int SfcIsFileProtected(int handle, [MarshalAs(UnmanagedType.LPWStr)] string path);

		public Form1()
		{
			InitializeComponent();
		}

		private void button1_Click(object sender, EventArgs e)
		{
			if (SfcIsFileProtected(0, textBox1.Text.ToString()) == 0)
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nNot protected");
			}
			else
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nIs protected");
			}
		}
	}
}

  • 0

Ahhh... The consistency of the Win32 API is astounding. :pinch: I don't think it's doable via the API, N_Win.

@Wilhelmus, I think that's for files that are stored in windows/system32/dllcache as part of the Windows File Protection scheme. But, good find, nonetheless.

@Andareed, I'm pretty sure that GetAttributesOf is the equivalent of using FileAttributes. If you only select Show hidden files and folders, config.sys/autoexec.bat/boot.ini, et al, don't show. They only show if you uncheck Hide protected operating system files(Recommended) as well. To boot, config.sys, autoexec.bat, etc, are only tagged as Archive, not Hidden nor System.

I think you're full on correct, ~InstaShock~. A list was actually my initial thought, and I figured it would be in the registry, but I cannot find a thing that declares config.sys as a critical file, which I agree with you on about it not being so.

N_Win, you may want to head over to SysInternals' forum and ask there. Those guys know everything. LOL

  • 0

If you check the description for IShellFolder::GetAttributesOf, for SFGAO_HIDDEN, it says the following:

  Quote
The item is hidden and should not be displayed unless the Show hidden files and folders option is enabled in Folder Settings.

You could try contacting a shell MVP to see if they can shed more light on how shell knows what files to hide.

  • 0

Sorry For my wait replay and Thanks for all these replies and tries. But We are still having the problem here.

First for Wilhelmus Replay that was taking about SfcIsFileProtected sub it doesn't work for all system files it only works with protected files.

About Andareed idea which i was trying to use from the beginning ( Using Shell Method ) but with less complicate way. i was tring to use isfilesystem property that i have found in the following Microsoft link http://msdn2.microsoft.com/en-us/ms723191.aspx It was giving true in each time.

Another way by using shell i found and is working properly but with too long codes can be found in the project http://www.codeproject.com/vb/net/ExpCombo.asp. There is an item called Cshitem in previous explorer project which you can give a path then it will give you a lot of this file or folder properties. By using property called 'IsFileSystem' (one Cshitem properties) you can determine if this file is critical system file and if windows will hide or not. But as I said That is too long and complicated way.

If anyone can fix the first code or have another small code, it will be so good.

Thanks

Edited by N_Win_Member
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Serious question here. Why is the start menu such a heated topic? I can't remember the last time that I used the start menu for anything at all other than it pops up when I hit the WIN key on my keyboard before I type for the program I want to run and then hit Enter or to restart my machine. I honestly wish it would just go away, and it just be replaced with the PowerToys Run menu. Am I missing something with the Start menu? I see people always talking about installing third party replacements and such, but I just wonder what some are actually using the Start menu for that I might be missing out on. Genuine question. Hopefully not offending anyone as I know everyone has their own way to work and access things in the OS.
    • These are the Apple Watch models that support watchOS 26 by Aditya Tiwari Apple has announced the latest operating system upgrade for its smartwatch lineup, called watchOS 26, not watchOS 12, as many expected a while ago. The Cupertino giant has unified the software experience across its platforms by introducing the "Liquid Glass" software design and renaming all the operating systems to version 26. That said, the next question is which Apple Watch models will support watchOS 26. Apple has shared the official list of devices: Apple Watch Ultra 2 Apple Watch Ultra Apple Watch Series 10 Apple Watch Series 9 Apple Watch Series 8 Apple Watch Series 7 Apple Watch Series 6 Apple Watch SE (2nd Generation) The upcoming Apple Watch update brings several new features to your wrist. Liquid Glass design gives a fresh look to the UI with updated Control Center and translucent buttons within apps. It's new Workout Buddy feature can use an Apple Intelligence-enabled iPhone nearby to provide personalized, spoken motivation during workouts. Building on the Double Tap feature, you can now flick your wrist to perform actions like muting incoming calls, silencing timers, and dismissing notifications when your hands are full. It is available on Apple Watch Ultra 2 and Apple Watch Series 9 (or later). watchOS 26 is currently available for testing through the Apple Developer Program. It will roll out to general users during the fall season, when Apple is expected to refresh the Ultra and SE models. Note that your Apple Watch must be paired with an iPhone 11 (or later) or iPhone SE (2nd generation or later) running iOS 26. While the list of Apple Watch models that support watchOS 26 remains the same, it won't work with iPhone Xs/Xs Max and iPhone Xr, which were previously supported on watchOS 11. You can check out the respective lists of supported devices for iOS 26, iPadOS 26, and macOS 26 Tahoe.
    • Galaxy Z Fold7 to be the thinnest and lightest foldable from Samsung by Sagar Naresh Bhavsar A few days ago, Samsung shared an official teaser of their upcoming premium foldable, the Galaxy Z Fold7. Interestingly, the company titled the official post, "Meet the Next Chapter of Ultra," giving birth to a new rumor about a new "Ultra" foldable. The teaser highlighted Galaxy Z Fold7's tall and wide design, which previous rumors have suggested. The Galaxy Z Fold7 is also expected to come with a bigger display compared to the Galaxy Z Fold6. There were also rumors that Samsung could use a titanium backplate for improved durability and also make the device slim. Now, Samsung has shared a new teaser of the Galaxy Z Fold7 that adds a bit a weight to this rumor. Samsung has called the Galaxy Z Fold7 the "thinnest, lightest, and most advanced foldable yet." While the company didn't share any measurements or metrics that would define how thin or light the upcoming foldable is, the GIF shows the Galaxy Z Fold7 from the side (and it appears quite thin). Take a look for yourself: It would be safe to say that Samsung has been lacking in terms of making its foldable devices slim, even reducing the display crease. Though the company launched the Galaxy Z Fold6 Special Edition in China and Korea last year, which was their slimmest phone, it was nowhere near the likes of the OPPO Find N5. In terms of innovation as well, the company is far behind, and Chinese makers such as Huawei have already released the world's first triple-folding phone, the Mate XT. On the positive side, Samsung claimed that their "engineers and designers are refining each generation of the Galaxy Z series to be thinner, lighter, and more durable than the last," suggesting that the company could bring improvements with this year's foldable. The Galaxy Z Fold7 is expected to launch next month, in New York, in the second Unpacked event of the year, alongside the Galaxy Z Flip7. There are also rumors that the affordable version of the flip phone, the Galaxy Z Flip7 FE, could also launch at the event.
  • Recent Achievements

    • Explorer
      MusicLover2112 went up a rank
      Explorer
    • Dedicated
      MadMung0 earned a badge
      Dedicated
    • Rookie
      CHUNWEI went up a rank
      Rookie
    • Enthusiast
      the420kid went up a rank
      Enthusiast
    • Conversation Starter
      NeoToad777 earned a badge
      Conversation Starter
  • Popular Contributors

    1. 1
      +primortal
      500
    2. 2
      ATLien_0
      268
    3. 3
      +FloatingFatMan
      257
    4. 4
      Edouard
      201
    5. 5
      snowy owl
      171
  • Tell a friend

    Love Neowin? Tell a friend!