Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: windows agent update #1036

Merged
merged 1 commit into from
Aug 23, 2024
Merged

feat: windows agent update #1036

merged 1 commit into from
Aug 23, 2024

Conversation

zzmark
Copy link
Contributor

@zzmark zzmark commented Aug 17, 2024

旧文件更名为 {name}.old
若权限允许,设置重启后删除旧版本。当然不删也不会有什么影响。

NOTE: 无法在 IDE debug 下测试

if err != nil {
return err
}
err = windows.MoveFileEx(windows.StringToUTF16Ptr(oldBackup), nil, windows.MOVEFILE_DELAY_UNTIL_REBOOT) // optional: delay delete old file
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

重启时删除文件,后面可以直接replace?另外,安全软件有反应么?

Copy link
Contributor Author

@zzmark zzmark Aug 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

windows 允许移动正在运行的exe
延迟删除只是可选操作,不删也行。

所以,整体变为,

  • 移动到临时文件
    • 此时,old 持有句柄
  • 写入新的文件
  • 服务重启
    • 此时,服务持有新文件句柄,而 update 进程持有 old 句柄
  • 清理临时文件(重启后)

update 进程退出后,old 只用于备份,没有进程打开。下次再使用 Rename 移动时可以直接被覆盖。删不删是无所谓的

安全软件,windows defender 和 nod32 无反应,再猛的我得去找环境测测。
理论上没啥问题。

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这个移动算是windows的合规操作。

延迟删除,会触发注册表修改,就看软件做得完善程度了。
这个东西原理就是,写入一个注册表项,重启后由ssms负责执行该列表

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

感谢@zzmark, 辛苦文档补充下说明,我之前测试下载部分会被安全软件误报

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

感谢@zzmark, 辛苦文档补充下说明,我之前测试下载部分会被安全软件误报

这部分文档该维护到哪里,还是我在 update_windows.go补些注释就好

windows 平台,很多操作误报没什么办法,解决不完的,
一些企业把规则写得很激进,比如:程序内下载算作木马,移动服务进程文件视为破坏系统
这类问题很难完全规避,只能自行加白名单了。

一些软件主进程文件就是个 loader,再按版本加载,例如 chrome。
但需要分包,不值得搞

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

可以放到主README 部分 ,或者你先补注释吧,我来统一更新下文档

@kongfei605 kongfei605 merged commit 7d33cba into flashcatcloud:main Aug 23, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants