Relevance issue with packaged "Application Information (Windows)" analysis

Hello all,

I'm looking for corroboration on an issue. I've not yet submitted this to support.

We have identified what seems to be a reproducible issue with the packaged "Application Information (Windows) analysis. One some machines, the applications area returns as Singular expression refers to nonexistant object.

On investigating, it seems that this section of relevance is fragile can break in at least two circumstances.

(if x64 of operating system then(( expand environment string of (value "DisplayName" of it as string) & (if (exists value "DisplayVersion" of it) then (" | " & expand environment string of (value "DisplayVersion" of it as string)) else (""))) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry) else nothing)

1.The key's value "DisplayVersion" exists, but its value is empty.

After quite a bit of debugging, it seems we have eight such packages. Seven of these are from the same vendor, in the public safety arena. Relevance to turn up such machines is:

exists keys whose ((exists value "DisplayName" of it) AND (exists value "DisplayVersion" of it) AND (value "DisplayVersion" of it = "") AND (not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

Analysis property to return such entries is:

(value "DisplayName" of it as string) of keys whose ((exists value "DisplayName" of it) AND (value "DisplayVersion" of it = "") AND (not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries; x64 registries)

2.The key's value "DisplayName" exists, but has its value is null.

I can isolate one such package, but a generic relevance eludes me.

Q: /* DEBUG MISSING DISPLAYNAME */ (exists name of it, (name of it | "none"), it) of values of keys whose ((name of it = "{8C415C6B-7569-41B9-8203-7E93278C46C9}") and (not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry
A: True, DisplayVersion, 3.1.0
A: True, Language, 1033
A: True, InstallDate, 20141002
A: True, DisplayIcon, ( <PATH_TO_ICONS_FILES>\PortaCount.ico,0 )
A: True, URLInfoAbout, TSI Incorporated/http://www.TSI.com
A: True, InstallSource, C:\Users\REDACTED\Desktop\FitPro+ v3.0.exe
A: True, InstallLocation, C:\FitPro+
A: True, LogFile, C:\Program Files (x86)\InstallShield Installation Information\{8C415C6B-7569-41B9-8203-7E93278C46C9}\setup.ilg
A: True, UninstallString, "C:\Program Files (x86)\InstallShield Installation Information\{8C415C6B-7569-41B9-8203-7E93278C46C9}\setup.exe" -runfromtemp -l0x0409  -removeonly
A: True, NoRepair, 1
A: True, ModifyPath, "C:\Program Files (x86)\InstallShield Installation Information\{8C415C6B-7569-41B9-8203-7E93278C46C9}\setup.exe" -runfromtemp -l0x0409 
A: True, VersionMinor, 1
A: True, VersionMajor, 3
A: True, Version, 50397184
A: True, RegOwner, TSI Inc.
A: True, RegCompany, TSI Inc.
A: True, Publisher, TSI Incorporated
A: True, ProductGuid, {8C415C6B-7569-41B9-8203-7E93278C46C9}
A: False, none, 
A: True, LogMode, 1
A: True, DisplayName, 
T: 33.000 ms

Has anyone else seen these behaviors?

Thank you,
Andrew

Hi @atlauren just to make sure on that machine , under Appetizer.cpl , do you see entry of that software? What is the expected result you wish to see on the Analysis for that application?

Hi @orbiton

I haven't been able to examine the actual system.

Personally, I'd prefer to have data returned -- however incomplete, or maybe with entries indicating an error -- than the entire analysis property erroring out.

-Andrew

1 Like

Come to think of it, is it possible to query for the data type of a registry entry? I played with that a bit but couldn't suss it out.

There is a “type” property for registry values if that’s what you mean.

Q: (name of it, type of it) of value "DisplayName" of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++" of native registry
A: DisplayName, REG_SZ
T: 3.987 ms
I: singular ( string, registry key value type )

Q: (names of it, it) of values whose (type of it = "REG_SZ") of key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Notepad++" of native registry
A: DisplayName, Notepad++ (64-bit x64)
A: Publisher, Notepad++ Team
A: MajorVersion, 8
A: MinorVersion, 93
A: UninstallString, "C:\Program Files\Notepad++\uninstall.exe"
A: QuietUninstallString, "C:\Program Files\Notepad++\uninstall.exe" /S
A: DisplayIcon, C:\Program Files\Notepad++\notepad++.exe
A: DisplayVersion, 8.9.3
A: URLInfoAbout, https://notepad-plus-plus.org/
A: MementoSectionUsed, 
T: 2.949 ms
I: plural ( string, registry key value )


I haven’t encountered his myself but I can certainly re-create the situation you are seeing @atlauren and get the same somewhat broken results.

With it being the software vendors that create the issue, there could easily be other Bigfix customers impacted.

One crude hack I tried to avoid the expression erroring out seem to be appending a string then read the following text of it.

Q: ( ( following text of first "##" of expand environment string of ("##" & value "DisplayName" of it as string) & (if (exists value "DisplayVersion" of it) then (" | " & expand environment string of (value "DisplayVersion" of it as string)) else (""))) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of native registry)
A: AutoHotkey | 2.0.19
A: EPSON XP-2200 Series Printer Uninstall
A: HxD Hex Editor 2.5 | 2.5
A: Microsoft SQL Server 2022 (64-bit)
A:  | 1.2.3.4
A: Notepad++ (64-bit x64) | 8.9.3
A: Microsoft OneDrive | 26.055.0323.0004
A: Microsoft OneNote - en-gb | 16.0.19822.20182
A: Microsoft OneNote - en-us | 16.0.19822.20182
A: Microsoft Office Professional Plus 2019 - en-us | 16.0.19822.20182
A: TreeSize Free V4.8.1 | 4.8.1
A: Intel(R) Management Engine Components | 2521.8.6.0
A: Dell Touchpad | 10.3201.101.216
A: NVIDIA Graphics Driver 572.76 | 572.76
A: NVIDIA PhysX System Software 9.23.1019 | 9.23.1019
T: 7.144 ms
I: plural string
 

Looking for size of value = 1 seems to succeed.

Q: (name of it, value "InstallLocation" of it) of keys whose (((exists value "DisplayName" of it) and (size of value "DisplayName" of it = 1)) and (not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it) of keys "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of (x32 registries, x64 registries)
A: {8C415C6B-7569-41B9-8203-7E93278C46C9}, C:\FitPro+
T: 13.000 ms
1 Like

For any HCL folks watching, I've filed CS1444955 on this. :slight_smile:

2 Likes

Problem already tracked with Defect Article KB0130062

A refresh of the site Inventory&License is in plan within the end of the current month

3 Likes

Thank you @gpoliafico, that’s great to know.

Given that the defect cites “ This may be due to a blank Application Name”, I hope the revision will include a blank Version as well?

-Andrew

yes, as for the original relevance expression revisions with DisplayVersion black are intended to be included in the output …

1 Like

Hi @gpoliafico,

I think the new content has rolled out? We presently show site "BES Inventory and License" at version 207. The relevance in question:

(if x64 of operating system then(( expand environment string of (value "DisplayName" of it as string) & (if (exists value "DisplayVersion" of it) then (" | " & expand environment string of (value "DisplayVersion" of it as string)) else (""))) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry) else nothing)

is now

(if x64 of operating system then(( ((expand environment string of (value "DisplayName" of it as string) & (if (exists value "DisplayVersion" of it) then ( " | " & expand environment string of (value "DisplayVersion" of it as string)) else "" )) | "" )) of keys whose ((not exists value "SystemComponent" of it OR value "SystemComponent" of it as string != "1") AND (not exists value "WindowsInstaller" of it OR value "WindowsInstaller" of it as string != "1") AND exists value "UninstallString" of it AND not exists value "ParentKeyName" of it AND exists value "DisplayName" of it) of key "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall" of registry) else nothing)

...and the error results seem to have corrected themselves. :smiley:

3 Likes

Confirm that the "BES Inventory and License" site has been updated at version 207 and contains the fix for the Defect Article KB0130062 … hopefully now is better.

1 Like

I believe the relevance may still be wrong in some regard. Although the relevance does not throw an error and returns correctly in most circumstances, it skips those existing DisplayName entries that have a valid entry and the DisplayVersion Is blank. I have run across this in poorly written custom software rather than COTS products.

The current results skip over this condition rather than returning a result such as:
A: Badly Installed Custom Software |

(if (exists value "DisplayVersion" of it) then ( " | " & expand environment string of (value "DisplayVersion" of it as string)) else "" )

The issue lies in satisfying the IF condition and then using “expand environment string” in the THEN portion.

q: if exists "" then expand environment string of "" else ""
E: Singular expression refers to nonexistent object.

q: unique values whose (it != "") of ((if exists "" then expand environment string of "" else "") | "")
T: 0.119 ms

q: (if exists expand environment string of "" then expand environment string of "" else "")
A:
T: 0.055 ms

I would prefer some valid returned information over simply dropping the records. Perhaps, if DisplayName is not present then return InstallLocation.