sendemail only runs from cmd launched from scheduler?!

[taripo]

I have a program called sendemail

There are two versions one with something called 'TLS' and one without.
I want the 'TLS' one. That's here
http://caspian.dotconf.net/menu/Softwar ... l-v156.zip

I am running sendemail.exe from that zip.

And I have two command prompts open. Both have the same value for %PATH%

One command prompt, is opened via this technique mentioned by aGerman that involves task scheduler.
viewtopic.php?f=3&t=5443
and it works amazingly well. (much appreciated).

The other command prompt, I open it clicking the orb and right clicking cmd and clicking run as administrator.

I run sendemail.exe

1,531,966 sendEmail.exe

I called it sendemailtls.exe but that doesn't affect things

C:\blah>dir
20/09/2014 01:05 AM 1,531,966 sendemailtls.exe
C:\blah>

When I run it from the task scheduler command prompt, it works fine.

When I run it from a regular command prompt run as administrator, I get some funny error popup msgbox that says "The ordinal 132 could not be located in the dynamic link library SSLEAY32.dll"
The developer mentions this in his FAQ
"
Q: I'm using the Windows version of sendEmail, and I get the error message "the ordinal 2586 could not be located in the dynamic link libraby LIBEAY32.dll", what do I do?
A: I don't know why this happens, but you can fix it by downloading the "No TLS Support" version of sendEmail. You won't be able to send email through an SMTP server that requires encryption, but it won't give you that error message."

I want the TLS version though.

What the developer perhaps doesn't know, is it works in the cmd prompt launched via task scheduler, in the method mentioned by aGerman, works.

I am wondering why that might be.

I am running win7 ultimate 64bit.


Perhaps there is some kind of privilege that the command prompt generated by task scheduler has, that the regular command prompt does not, but I can't put my finger on what it is, any ideas?

And what are the differences between the environment of each command prompt?

[penpen]

If the error message is, what it seems to be (some developers are using weird error messages) it only has one reason, else there could be various reasons.

Assumed, that the error message denotes this error:
The dll file (->SSLEAY32.dll) is found, but there is no function definition with the ordinal number mentioned (->132) within this dll.

This happens, if an executable is linked against a dll with a different version, than actually used by your account/system.

In your case there should be at least two versions of the same dll installed on your system, and your admin account is using a different version than your local account; for what reasons ever:
- registered another version to the two accounts (software is installed on your local account only),
- different views may result in the use of another dll file (/version) with the same name,
- an environment variable (set by your software), but not necessarily restricted to "path", is not set up properly,
- ...

penpen

Edit: If you want to find out which dll file version has the needed function, you could use this dependency walker: http://www.dependencywalker.com/.

[taripo]

thanks..

the thing is, if I do echo %USERPROFILE% they both show the same username
not Administrator, though both have admin privileges

I have switched to installing perl and running sendemail.pl instead of sendemail.exe that works in both cmd windows. Though there is still the cmd question..

and the cmd question is this... what are the differences between the cmd windows?

if the cmd windows have different environment variables, then why?

[aGerman]

Execute SET to see if the environments differ. The environment was always inherited from the parent process. Normally that would be explorer.exe but in case of the task scheduler it inherits from wininit.exe. Thus, I wouldn't wonder ...
Have a look at the current working directory (cd). Also that is one of the pitfalls if something can't be found.

Regards
aGerman

[taripo]

They do have different environment variables.. a)slightly different PATH, the regular one has a PATH that includes a perl directory - I recently installed that and b)the regular one has OPENSSL_CONF which is from openssl which I recently installed. I guess perhaps the task scheduler one will have those if I restart.

But i've just done SET PATH= and SET OPENSSL_CONF= , and now both have the same environment variables.

i've done SET >a.a in one, and SET >b.b in the other. and done c:\windows\system32\fc a.a b.b and both come up as the same and are same size. no doubt environment variables are now the same.

But still, the regular one run as administrator, gives a popup when I run sendemailtls.exe and the task scheduler one runs it no error given.

In both cases i'm running it sendemailtls.exe in the same working directory.


C:\blah>dir
Volume in drive C has no label.
Volume Serial Number is B411-D580

Directory of C:\blah

20/09/2014 02:43 PM <DIR> .
20/09/2014 02:43 PM <DIR> ..
20/09/2014 12:42 AM 708,670 sendemailnotls.exe
20/09/2014 01:05 AM 1,531,966 sendemailtls.exe
2 File(s) 2,240,636 bytes
2 Dir(s) 1,083,441,152 bytes free

C:\blah>

[Squashman]

Why not just use a vbscript instead? That Way you don't have to rely on third party utilities.
Lots of other cmd line based email utilities as well.

[taripo]

As mentioned in post #3 in the thread, I have since found that sendemail.pl works, it doesn't have that dll popup error.

I'd be interested in vbscripts and other 3rd party command line based smtp utilities that do smtp with ssl/tls

But the question here is one of understanding.. What is different between the cmds that it works in the task scheduler cmd window and not the regular one run as admin. When both have the same environment variables. The same working directory. The same %userprofile%

[penpen]

It's only guessed, but i think, that the tasks run by the scheduler have "system" rights, which is higher than the "admin" rights you are running with.
So the different behaviour is probably caused by different system views (file system, registry, patches, manifests, ...) when running programs with different user rights.
Somehow the "system rights" view finds the right dll first, contrary to your "admin/user rights" view which finds the wrong dll first.

If you want to dig into, you could use tools like "Process Explorer" and "Process Monitor" from Sysinternals (now part of Microsoft):
http://technet.microsoft.com/en-us/sysinternals/bb896653,
http://technet.microsoft.com/en-us/sysinternals/bb896645.

If the executable is programmed in a good way, then it should be possible, to add (copy) the needed dlls into the executables directory.
Then the exe file doesn't scan the whole system to search them.
If you want to do this, then you should note that if the dll is not included directly, but indirectly by X.dll, then you have to add X.dll into the executables path, too.
Similar to this, you should add dlls, called by SSLEAY32.dll in the executables directory, too.
For detecting such "sub dlls" you could use the dependency walker, i've linked above.
But first you could try to copy the right version of SSLEAY32.dll and all "sub dlls" only and see if it works.

penpen

Edit: I've added the name "Process Monitor" and the link to "Process Explorer", sorry for the confuse name link combo (name ...explorer + link ... monitor).

[taripo]

thanks penpen.

Looking in dependency walker, I can't even find the SSLEAY32.DLL that the popup refers to

Dependency walker says "Errors were detected when processing "c:\blah\sendemailtls.exe" see the log window for details

Error: At least one module has an unresolved import due to a missing export function in an implicitly dependent module.
Error: Modules with different CPU types were found.
Warning: At least one delay-load dependency module was not found.
Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.


And I see the modules listed
But SSLEAY32.DLL isn't listed.

http://pastebin.com/raw.php?i=uQiUTzVc


And looking in Process Explorer

Fortunately the process is showing in process explorer, that's by virtue of the popup, which means the process won't close until I click OK to the popup...

I chose 'view lower pane' and view lowerpane..dlls

and I see it's using
c:\Windows\syswow64\ssleay32.dll
and the properties of that shown in process explorer show me it's version 1.0.1.9

I just realised some things
-I can specify the body in stdin, then keep the program open after clicking OK to the popup and then see it in process explorer..after the popup, so then if it were to ever not show the popup e.g. if run from the task schedular command prompt or a comp where it does work, then I could see what DLLs (the right ones hopefully) it uses when it does work (Though note..there's an issue seeing its dlls, or any process's dlls, in the process explorer when launched from task scheduler)
-Any process, even calc.exe when launched from the task scheduler command prompt.. When I click the process in process explorer - the process shows - but when I choose 'show lower pane' and show dlls, Nothing shows.
-I have also just realised, sendemail sends the email anyway despite the popup about that SSLEAY32.DLL

It'd be great to give it a correct version of SSLEAY32.DLL in its working directory though. And that even opens the possibility of decompiling and recompiling with the right SSLEAY32.DLL so it doesn't have to go to anywhere to look for it

[aGerman]

That you're running a 64 bit OS could be an important information (http://msdn.microsoft.com/en-us/library/windows/desktop/aa384274(v=vs.85).aspx). BTW I'm on Win7 x86 which means I can't test any of the following.

Check this from a "scheduled" and a "normal" cmd prompt:
1) Is PROCESSOR_ARCHITEW6432 defined? (only defined in WOW64 mode)
2) What are the values for PROCESSOR_ARCHITECTURE, ProgramFiles and ProgramW6432 variables

Are ssleay32.dll and sendemailtls.exe 32 bit or 64 bit applications? See viewtopic.php?f=3&t=5826
Are there 2 ssleay32.dll files (in C:\Windows\syswow64 as well as in C:\Windows\system32)?

Regards
aGerman

[taripo]

For those variables, in both command prompts, they all have these same values-

PROCESSOR_ARCHITECTURE=AMD64
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
CommonProgramW6432=C:\Program Files\Common Files
ProgramW6432=C:\Program Files
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files

which double checks what I said, as the only differences in variables are in %PATH% and in %OPENSSL_CONF% and in both cases i've done SET PATH=<ENTER> and SET OPENSSL_CONF=<ENTER> to nullify that difference.

That MS page doesn't mention what values the environment variables would have if a 32bit process is created by a 32bit process, or when a 64bit process is created by a 64bit process. And also.. these are just run when initiating the command prompt. Rather than during the running of sendemail I can't really run SET during the running of sendemail, as sendemail isn't a background process like a TSR program.

I see That MS page shows for a 32bit process created by a 64bit process.. and vice versa.. And the environment variables for the created process.. My environment variables seem to match those for a created 64bit process(created by a 32bit process). Though I don't know what process is the creator and what process is the created, that led to those variables being set.


I see c:\windows\system32\cmd.exe is 32bit
C:\>file c:\windows\system32\cmd.exe
c:\windows\system32\cmd.exe; PE32 executable for MS Windows (console) Intel 8038
6 32-bit
C:\>

i'm not sure what processes are 64bit

I have both
C:\Program Files>cd "\Program Files (x86)"

C:\Program Files (x86)>




C:\blah>file c:\windows\SysWOW64\ssleay32.dll
c:\windows\SysWOW64\ssleay32.dll; PE32 executable for MS Windows (DLL) (console)
Intel 80386 32-bit

C:\blah>

C:\blah>aa <-- batch by aGerman to identify 32bit and 64bit programs
file errorlevel CPU ID
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
C:\windows\system32\cmd.exe 0 00008664
C:\Windows\SysWOW64\ssleay32.dll 0 0000014C


C:\blah>




I just read
http://www.tomcarpenter.net/2010/07/09/ ... ne-64-bit/
that the SysWow64 directory has all 32bit commands
and task manager shows whether it's 32bit or 64bit by saying *32 next to 32bit ones. And nothing next to 64bit ones.

Oddly though..

I can't see a command line wy of showing 64bit ones

C:\Windows\SysWOW64>dir cmd.exe
Volume in drive C has no label.
Volume Serial Number is B411-D580

Directory of C:\Windows\SysWOW64

20/11/2010 05:17 AM 302,592 cmd.exe
1 File(s) 302,592 bytes
0 Dir(s) 1,061,675,008 bytes free

C:\Windows\SysWOW64>dir c:\windows\system32\cmd.exe
Volume in drive C has no label.
Volume Serial Number is B411-D580

Directory of c:\windows\system32

20/11/2010 06:24 AM 345,088 cmd.exe
1 File(s) 345,088 bytes
0 Dir(s) 1,061,675,008 bytes free

C:\Windows\SysWOW64>file cmd.exe
cmd.exe; PE32 executable for MS Windows (console) Intel 80386 32-bit


C:\Windows\System32>file cmd.exe
cmd.exe; PE32 executable for MS Windows (console) Intel 80386 32-bit

C:\Windows\System32>cd \blah

C:\blah>aa
file errorlevel CPU ID
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
C:\windows\system32\cmd.exe 0 00008664
C:\windows\SysWOW64\cmd.exe 0 00008664
C:\Windows\SysWOW64\ssleay32.dll 0 0000014C


C:\blah>

[penpen]

First to say:
I've just noticed that i wanted to write tools like "Process Explorer" and "Process Monitor" (with links).
I've written "Process Explorer" and linked the "Process Monitor" instead.
Sorry for that, i've updated the above post.

Looking in dependency walker, I can't even find the SSLEAY32.DLL that the popup refers to

This only shows that this dll is used indirectly by one of the other modules that is not found by dependency walker.
Just use Process Monitor/Explorer to find the path of these dlls.
If you add (/copy) the modules to the directory of the application then they should be processed as well.
Another possibility is, to add the dll's path to the "Options"->"Configure Module Search Order...": If you do that you should remove it from that list prior analyzing another executable.

(Though note..there's an issue seeing its dlls, or any process's dlls, in the process explorer when launched from task scheduler)
-Any process, even calc.exe when launched from the task scheduler command prompt.. When I click the process in process explorer - the process shows - but when I choose 'show lower pane' and show dlls, Nothing shows.

This is another hint, that the scheduler execute programs with system rights.
No process with lower rights is allowed to hook/profile/... processes with higher rights, so the returned list of the function in the background is empty (or an security exception is thrown and catched silently).
I think you should have no such problems if you start the Process Explorer/Monitor with system rights (using the scheduler).

penpen

[aGerman]

Also try to copy ssleay32.dll into the same directory of sendEmail.exe. That may help or not because we don't know all the dependencies.

Regards
aGerman

[taripo]

I have just run process explorer from task scheduler, ticking the box "run with highest privileges" and as you say penpen, now it must have system rights, as it is showing processes from both cmd prompts e.g. the DLLs used by calc.exe from both cmd prompts.

Does Task Manager show that process explorer is running like this? or any command show it? When I look in task manager it just shows the user running it.. Doesn't show that it as rights of system. But clearly it has more rights than a normally launched process explorer, I suppose "system rights".

When I (on Win7 64bit.. so the OS i've been discussing) then run sendemail from the system rights cmd prompt, leaving out the body so I can enter the body of the email in stdin, so the process remains running.. I don't see that SSLEAY32.DLL file listed in process explorer.. among the DLLs that it needs That's the system rights process explorer so it lists the DLLs just not SSLEAY32.DLL

Also On Win7 64bit, running sendemail from regular cmd prompt(which is where I get the msgbox come up), it shows it using SSLEAY32.DLL version 1.0.1.9
Running sendemail on that comp, from system rights cmd prompt, process explorer lists DLLs for it but not SSLEAY32.DLL. (Maybe sendemail quickly finishes using SSLEAY32.DLL and so it doesn't show up in process explorer).


I would note though, I have another computer, running XP 32bit,
On that one it's a slightly different story.
The sendemail.exe works, no popup.
I can see SSLEAY32.DLL in process explorer, that's the one that sendemail uses.
C:\DOCUME~1\blahuser\LOCALS~1\Temp\pdk-blahuser-6928\SSLEAY32.dll
I can double click it and have process explorer tell me it is Version 0.09.0008.0001 (that's 0.9.8.1)

I have another SSLEAY32.DLL on that XP 32bit comp, that is in the nmap program C:\nmap If I try on that XP 32bit comp, to run sendemail from C:\nmap or any directory with that wrong/foreign SSLEAY32.DLL then I get a msgbox come up that says "The ordinal 3873 could not be located in the dynamic link library LIBEAY32.DLL. So, that shows that sendemail will use the DLL in the current directory before looking elsewhere. Because on that comp, if the foreign DLL isn't there in the directory from which sendemail is running, then sendemail runs fine no msgbox. And i've tested this as well

XP 32bit C:\asdfasdf>dir
270,336 ssleay32.dll <-- nmap one
run sendemail, get msgbox.

XP 32bit C:\asdfasdf2>dir
200,704 ssleay32.dll <-- the right one
run sendemail, no msgbox.


Going to win7 64bit

Win7 64bit
C:\Windows\SysWOW64>dir ssleay32.dll
271,872 ssleay32.dll
run sendemail.exe, get msgbox (as mentioned)
That is SSLEAY32.DLL version 1.0.1.9, as mentioned.

If on XP 32bit, I copy the -good- DLL, the DLL which when clicked when listed in process explorer shows 0.09.0008.001 , that DLL. Or rather, the DLL that is good on that computer. And I copy it to the Windows 7 64bit computer
c:\asdf>dir
200,704 ssleay32.dll
run sendemail... I get a msgbox "the ordinal 132 ......... SSLEAY32.DLL"
but process explorer shows it is actually using the one in C:\windows\syswow64\ssleay32.dll

So now I replace the one originally in SysWOW64, with this one,, The one that works on XP32bit
C:\Windows\SysWOW64>dir ssleay32.dll
200,704 ssleay32.dll


Then I get this msgbox "The ordinal 354 could not be located in the dynamic link library LIBEAY32.DLL"
and process explorer confirms that it is using the DLL in c:\windows\syswow64

Now if I look for the LIBEAY32.DLL from the XP 32bit comp, specifically.. the one used by sendemail on that computer.

I see

DIR C:\DOCUME~1\blahuser\LOCALS~1\Temp\pdk-blahuser-6928
has two files
1,060,864 libeay32.dll <--- Version 0.09.0008.0001
200,704 ssleay32.dll <----- Version ditto.. also 0.09.0008.0001


as seen by process explorer

200,704 09-21-2014 ssleay32.dll

or sysinternals sigcheck or xp sp2's filever

C:\sdfsdfsdf>\sigcheck\sigcheck.exe -q -n ssleay32.dll
0.9.8a

XP (sp2 support tools apparently).
has filever
C:\ax>filever ssleay32.dll
--a-- W32i DLL ENU 0.9.8.1 shp 200,704 09-21-2014 ssleay32.dll

C:\ax>


If I put both of them onto Win7 64bit, then it works on Win7 64bit even in a regular command prompt.

And just to get more to the bottom of it, I put the versions that were on Win764-bit back on there. Ran sendemail got the popup. Checked the versions of both ssleay32.dll and libeay32.dll both are version 1.0.1.9

using filever from xp.. as it's a useful tool

C:\Windows\SysWOW64>\crp\filever ssleay32.dll
--a-- W32i DLL ENU 1.0.1.9 shp 271,872 08-06-2014 ssleay32.dll


C:\Windows\SysWOW64>\sigcheck\sigcheck -q -n ssleay32.dll
1.0.1i

I don't know why sysinternals sigcheck shows it with an i.. But process explorer and filever show it as 1.0.1.9 anyhow.



So, for it to work they have to both be not 1.0.1.9, but 0.9.8.1 So, they have to be the earlier version.

Is it possible to have determined that without having XP 32bit? So if i'd just had Win7 64bit with its not working DLLs 'cos wrong version.
Dependency walker didn't show the sub process of SSLEAY32.DLL and process explorer was only showing the one being used..which in the case of Win764bit as it was, was the wrong version ones.

And is it possible to determine what the dll process is that he used that'd be responsible.. that is requiring early versions of those two DLLs?

Also strange that sendemail on the XP 32bit machine, seems to use the DLLs in the directory it is run from.
Whereas on the Win7 64bit machine, it doesn't, it only uses the ones in c:\windows\syswow64

[aGerman]

Your linked ZIP file contains the Perl source. Maybe you should try to recompile it on your computer.

Regards
aGerman