diff --git a/8x8_Work_Updater.ps1 b/8x8_Work_Updater.ps1 index bbe7ccd..c23b845 100644 --- a/8x8_Work_Updater.ps1 +++ b/8x8_Work_Updater.ps1 @@ -1,8 +1,8 @@ # ============================================================================== # Script Name: 8x8_Work_Updater.ps1 -# Description: Downloads 8x8 with a progress bar, injects a user-session GUI -# countdown dialog via HKU RunOnce, waits for user response/timer, -# silently installs, and relaunches 8x8. +# Description: Downloads 8x8 with a progress bar, uses Win32 CreateProcessAsUser +# token duplication to display a live countdown GUI directly on +# the active user's screen, silently updates 8x8, and relaunches it. # ============================================================================== # Ensure script is running elevated @@ -11,6 +11,7 @@ if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdenti exit 1 } +# Load required .NET assemblies Add-Type -AssemblyName System.Net.Http $workDir = "C:\ProgramData\JCT600_8x8Update" @@ -29,6 +30,96 @@ Set-Acl $workDir $acl if (Test-Path $flagFile) { Remove-Item $flagFile -Force } +# ------------------------------------------------------------------------------ +# Embedded C# Win32 Process Launcher (Crosses Session 0 Isolation via Token Duplication) +# ------------------------------------------------------------------------------ +$TokenLauncherCode = @" +using System; +using System.Diagnostics; +using System.Runtime.InteropServices; + +public class UserSessionLauncher +{ + [DllImport("advapi32.dll", SetLastError = true)] + private static extern bool OpenProcessToken(IntPtr ProcessHandle, uint DesiredAccess, out IntPtr TokenHandle); + + [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] + private static extern bool DuplicateTokenEx(IntPtr hExistingToken, uint dwDesiredAccess, IntPtr lpTokenAttributes, int ImpersonationLevel, int TokenType, out IntPtr phNewToken); + + [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] + private static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); + + [DllImport("kernel32.dll", SetLastError = true)] + private static extern bool CloseHandle(IntPtr hObject); + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] + private struct STARTUPINFO + { + public int cb; + public string lpReserved; + public string lpDesktop; + public string lpTitle; + public int dwX; + public int dwY; + public int dwXSize; + public int dwYSize; + public int dwXCountChars; + public int dwYCountChars; + public int dwFillAttribute; + public int dwFlags; + public short wShowWindow; + public short cbReserved2; + public IntPtr lpReserved2; + public IntPtr hStdInput; + public IntPtr hStdOutput; + public IntPtr hStdError; + } + + [StructLayout(LayoutKind.Sequential)] + private struct PROCESS_INFORMATION + { + public IntPtr hProcess; + public IntPtr hThread; + public int dwProcessId; + public int dwThreadId; + } + + public static bool StartProcessInUserSession(string commandLine) + { + Process[] explorers = Process.GetProcessesByName("explorer"); + if (explorers.Length == 0) return false; + + IntPtr hProcess = explorers[0].Handle; + IntPtr hToken = IntPtr.Zero; + IntPtr hDupToken = IntPtr.Zero; + + if (!OpenProcessToken(hProcess, 0x0002 | 0x0004, out hToken)) return false; + + if (!DuplicateTokenEx(hToken, 0x02000000 | 0x0001 | 0x0002 | 0x0004 | 0x0008 | 0x0010 | 0x0020 | 0x0040 | 0x0080 | 0x0100, IntPtr.Zero, 2, 1, out hDupToken)) + { + CloseHandle(hToken); + return false; + } + + STARTUPINFO si = new STARTUPINFO(); + si.cb = Marshal.SizeOf(si); + si.lpDesktop = @"winsta0\default"; // Connect directly to interactive user display + + PROCESS_INFORMATION pi = new PROCESS_INFORMATION(); + bool result = CreateProcessAsUser(hDupToken, null, commandLine, IntPtr.Zero, IntPtr.Zero, false, 0x00000010, IntPtr.Zero, null, ref si, out pi); + + if (pi.hProcess != IntPtr.Zero) CloseHandle(pi.hProcess); + if (pi.hThread != IntPtr.Zero) CloseHandle(pi.hThread); + if (hDupToken != IntPtr.Zero) CloseHandle(hDupToken); + if (hToken != IntPtr.Zero) CloseHandle(hToken); + + return result; + } +} +"@ + +Add-Type -TypeDefinition $TokenLauncherCode -ErrorAction SilentlyContinue + try { # -------------------------------------------------------------------------- # Step 1: Download 8x8 Setup Installer with Console Progress Bar @@ -181,34 +272,26 @@ $form.Dispose() [System.IO.File]::WriteAllText($guiScript, $guiContent, $utf8NoBom) # -------------------------------------------------------------------------- - # Step 3: Trigger Interactive GUI via Active Desktop Process Execution + # Step 3: Trigger Interactive GUI on Active User's Desktop via Token Duplication # -------------------------------------------------------------------------- Write-Host "[3/5] Launching interactive dialog on active user desktop..." -ForegroundColor Cyan $explorerProc = Get-Process -Name explorer -ErrorAction SilentlyContinue | Select-Object -First 1 if (-not $explorerProc) { - Write-Warning "No active desktop session detected. Proceeding directly to update." + Write-Warning "No active user desktop session detected. Proceeding directly to update." } else { - # Query active user SID from Explorer process - $userSid = (Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = $($explorerProc.Id)" | Invoke-CimMethod -MethodName GetOwnerSid).Sid - - if ($userSid) { - # Inject RunOnce command directly into active user registry hive - $regPath = "Registry::HKEY_USERS\$userSid\Software\Microsoft\Windows\CurrentVersion\RunOnce" - $cmdToRun = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$guiScript`"" - - if (Test-Path $regPath) { - Set-ItemProperty -Path $regPath -Name "JCT600_8x8_UpdateGUI" -Value $cmdToRun -Force - - # Signal Explorer shell to execute RunOnce entries for active session - Start-Process "explorer.exe" -ArgumentList "shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" -ErrorAction SilentlyContinue - } - } + $launchCmd = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File `"$guiScript`"" + $launched = [UserSessionLauncher]::StartProcessInUserSession($launchCmd) - Write-Host "Waiting for user dialog response or timer expiration (1 hour max)..." -ForegroundColor Yellow - while (-not (Test-Path $flagFile)) { - Start-Sleep -Seconds 2 + if ($launched) { + Write-Host "Dialog launched successfully on user's active screen." -ForegroundColor Green + Write-Host "Waiting for user response or timer expiration (1 hour max)..." -ForegroundColor Yellow + while (-not (Test-Path $flagFile)) { + Start-Sleep -Seconds 2 + } + } else { + Write-Warning "Failed to duplicate user token. Proceeding to silent installation." } } @@ -239,9 +322,9 @@ $form.Dispose() Write-Host "Installation completed successfully." -ForegroundColor Green # -------------------------------------------------------------------------- - # Step 5: Launch 8x8 Work via Explorer Shell + # Step 5: Launch 8x8 Work via User Session Token # -------------------------------------------------------------------------- - Write-Host "[5/5] Launching 8x8 Work..." -ForegroundColor Cyan + Write-Host "[5/5] Launching 8x8 Work in user session..." -ForegroundColor Cyan $possiblePaths = @( "${env:ProgramFiles}\8x8 Inc\8x8 Work\8x8 Work.exe", @@ -254,9 +337,8 @@ $form.Dispose() if ($exePath) { if ($explorerProc) { - # Run 8x8 via explorer.exe to launch under standard user graphics context - Start-Process "explorer.exe" -ArgumentList "`"$exePath`"" - Write-Host "8x8 Work launched successfully." -ForegroundColor Green + [UserSessionLauncher]::StartProcessInUserSession("`"$exePath`"") | Out-Null + Write-Host "8x8 Work launched successfully in user context." -ForegroundColor Green } else { Start-Process -FilePath $exePath }