Todays Inspector riddle

Customizations
1

(imported topic written by SystemAdmin)

So, these work:

q: version of file “C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe”

A: 3.6.0.546

T: 0.994 ms

q: image path of running service “McAfeeFramework”

A: “C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe” /ServiceStart

T: 52.576 ms

q: substring before " /" of (image path of running service “McAfeeFramework”)

A: “C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe”

T: 58.784 ms

Now, in trying to replace the filename with the “substring” line above to get the file location, I get a singular expression error. See below.

q: version of file (substring before " /" of (image path of running service “McAfeeFramework”))

E: Singular expression refers to nonexistent object.

Any ideas how to get the above line working? It seems like it is too simple for it not to work.

Thanks.

2

(imported comment written by tim7ad91)

psisk,

I don’t have McAfee, but I found that using substring between “%22” works for other services

So for Symantec it looks like

q: version of file (substring between “%22” of (image path of running service “Symantec AntiVirus”))

A: 10.0.2.2000

T: 49.239 ms

I: singular version

I would think you could change yours to:

q: version of file (substring between “%22” of (image path of running service “McAfeeFramework”))

Maybe one of the pros on here can explain why the - substring before " /" doesn’t work.

I found a service that uses a switch similar to McAfee. The image path of the Logical Disk Manager service, dmadmin looks like

q: (image path of running service “dmadmin”)

A: %25SystemRoot%25\System32\dmadmin.exe /com

Notice it doesn’t return the image path in quotes, like Symantec and McAfee do. What’s more is that it returns and encoded environment variable, so, I can’t test effectively. However, using this service I tried several different things including encoding with the ascii hex value for “/”. - %2F without success. I ended up with the same errors you did.

Hopefully the expression using %22 above will work for you.

Like you, I’d still want to understand why your original expression didn’t work.

Guess I’ve added to the riddle instead of solving it.

-tim7ad

3

(imported comment written by jessewk)

substring before " /" doesn’t work because the quotes surrounding the path are still part of the string. You’d have to include additional relevance to strip out the leading and trailing quotes.

To make sure any environment variables are expanded, use this:

expand environment string of (image path of running service “dmadmin”)

Does that answer all the questions?

4

(imported comment written by tim7ad91)

Jesse,

Thanks Jesse, that took care of my example:

q: version of file (substring before " /" of expand environment string of (image path of running service “dmadmin”))

A: 2600.2180.503.0

Since, the image path above doesn’t include any quotes the substring before " /" works.

I see now why it would not work for a string that already contained quotes (as in psisk’s example).

This should work in that situation:

q: version of file (substring between “%22” of (image path of running service “McAfeeFramework”))

5

(imported comment written by SystemAdmin)

It worked! Thanks much everyone, it is appreciated.