1

I want to decompile an .exe and change the code to not need Admin to run. I know that it does something with:

<requestedPrivileges>
  <requestedExecutionLevel
  level="requireAdministrator"
  uiAccess="false"
/>
</requestedPrivileges>

However I'm not sure what I need to change (I'm using Resource Hacker).

Improve this question
1

1 Answer 1

Reset to default
1

Actually this has nothing to do with decompiling and little with reverse engineering.

What you need to do is to change level="requireAdministrator" into level="asInvoker":

<requestedPrivileges>
  <requestedExecutionLevel
  level="asInvoker"
  uiAccess="false"
/>
</requestedPrivileges>

Using ResourceHacker you should be able to do just that. The canonical way, however, would be to use the Manifest Tool (mt.exe) which is - depending on the version - included with the SDKs, WDKs or Visual C++/Studio.

Another way would be to strip the resource and place a manifest next to the .exe with the same name, but .manifest appended. I.e. if your .exe is named foobar.exe then the manifest would be foobar.exe.manifest.

And actually, thinking about it, this may even work without stripping the existing manifest resource (perhaps give it a try?). I.e. extract the existing manifest resource, place it next to the .exe as explained above and modify the (external) manifest. Then try to start the .exe ...

However, be warned: if your .exe has been signed, your tampering will invalidate the signature. If the software has been prepared to do integrity checking or certain other circumstances apply (Software Restriction Policies, AppLocker) this may lead to the software being unable to run.

If you wanted to achieve this without tinkering with the manifest resource, you can have a look here. This answer details how to enable running a software without elevation by invoking it with a special environment variable set.

Applying this registry file will create an entry named Run without admin rights (UAC) in the context menu, which allows you to make use of the feature:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\forcerunasinvoker]
@="Run without admin rights (UAC)"

[HKEY_CLASSES_ROOT\*\shell\forcerunasinvoker\command]
@="cmd /min /C \"set __COMPAT_LAYER=RUNASINVOKER && start \"\" \"%1\"\""
Improve this answer
4
  • I ran my program with this manifest: <<requestedPrivileges> <requestedExecutionLevel level='asInvoker' uiAccess='false' /> </requestedPrivileges>> And got the message (not user-and-pass prompt) "This application needs administraton permissions to run properly." I'm trying to run Speccy
    – Schreyer Karl
    Commented Nov 16, 2018 at 23:40
  • @SchreyerKarl how exactly did you try it? External manifest with embedded one stripped or still in place or manipulated the embedded manifest? Either way the problem can be that some program really requires admin privileges. With Speccy I would even expect this, since it will attempt to read stuff that a normal user doesn't necessarily have access to (without certain prerequisites in place at least). So it would make sense for Speccy to require those privileges. Similarly a software trying raw disk access would fall into this same category.
    – 0xC0000022L ♦
    Commented Nov 17, 2018 at 20:43
  • I tried both ways, however, only the admin --> asInvoker --> recompile worked for me. I didn't get the manifest striping method. I tried copying the manifest file (for other exe) into the folder where it was stored and renaming the manifest but it still prompted me for admin. If it's not too much trouble could you explain why the manifest striping works? Thank you so much in advance you have already bee a huge help!
    – Schreyer Karl
    Commented Nov 17, 2018 at 22:28
  • @SchreyerKarl an external manifest should take precedence. But I am not sure if this would work without removing an already embedded manifest.
    – 0xC0000022L ♦
    Commented Nov 17, 2018 at 22:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.