Understanding a confusing symlink

[MikeBaas]

I recently installed WinSCP and intentionally got it from the Microsoft Store (1st time!).

The way it is setup leave me dumbfounded and I wonder if the accumulated knowledge of this forum could help to understand this puzzle:

The start menu entry for WinSCP points to the file "C:\Users\{me}\AppData\Local\Microsoft\WindowsApps\MartinPikryl.WinSCP_tvv458r3h9r5m\WinSCP.exe"

Verzeichnis von C:\Users\mbaas\AppData\Local\Microsoft\WindowsApps\MartinPikryl.WinSCP_tvv458r3h9r5m\WinSCP.exe

08.12.2022 19:15 0 ___A_____________ WinSCP.exe

Through some kind of magic, double clicking this 0 byte file launches the app!

What's going on, how does this stuff work - how could I find the exe that is executed when running this file?

 

[vefatica]

They are "app execution aliases". [Isn't the store wonderful?]. I don't know much about them. Try Google. Supposedly you can manage them ... Start ... alias ...

 

[Charles Dye]

You might have a look in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths and see whether there's a WinSCP.exe key in there....

 

[vefatica]

You might have a look in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths and see whether there's a WinSCP.exe key in there....

I think that, in some sense, app execution aliases are a modern (?) alternative App Paths entries. I also think they're supposed to work in places whene App Paths entries don't work. Here, winword has an App Paths entry and no app execution alias. TCC searches App Paths, so I can execute "winword" in TCC. But I can't execute "winword" in CMD or Powershell.

 

[vefatica]

@MikeBaas, how do you know they're symlinks?

 

[ohenryx]

follow hard links (reparsepoints?) to files (windows terminal)?

How do you follow a hard link (reparse point?) to a file? Piping to format-list doesn't show the target. At least in powershell 7, you get a little ascii arrow. That folder is in the $env:path.

stackoverflow.com

That article probably has more information than you wanted to know, but it is the best reference I have found to "reparse points".

 

[Alpengreis]

Finding the target of a Windows App Execution Alias

From the directory that contains the zero-byte file WT.EXE (for example), this PowerShell command;(Get-Item wt.exe).Target...is supposed to provide me with the target of a Windows App Execution Alias, in this case, WT.EXE From the directory that contains the zero-byte file WT.EXE, when I try it...

jpsoft.com

How do I find the target of a Windows App Execution Alias in C#/Win32 api?

Microsft Windows Terminal (installed via the Microsoft Store) creates a 0 bytes wt.exe file which is a Windows execution alias. AFAIK it is somthing similar to a symbolic link, except it seems to be

stackoverflow.com

 

[Alpengreis]

The following should be good enough for the beginning ...

Example:

fsutil reparsepoint query %localappdata%\Microsoft\WindowsApps\MicrosoftEdge.exe

 

[ohenryx]

function Resolve-AppXExePath {
<#
.SYNOPSIS
  Resolves AppX execution aliases to their app IDs and target paths.
.EXAMPLE
  Get-ChildItem -File $env:LOCALAPPDATA\Microsoft\WindowsApps | Resolve-AppXExePath
 .NOTES
  This command is slow, because a call to fsutil.exe is made for each input path.
  #>
  param(
    [Parameter(ValueFromPipeline)]
    [Alias('PSPath')]
    [string] $LiteralPath
  )
 
  process {
    $fullName = Convert-Path -LiteralPath $LiteralPath
    if (-not $?) { return }
    $name = [System.IO.Path]::GetFileName($LiteralPath)
 
    # Get a hex-dump representation of the reparse-point data via fsutil reparsepoint query $fullName
    $hexDump = fsutil reparsepoint query $fullName 2>&1
    if ($LASTEXITCODE) { Write-Error $hexDump; return }
 
    # Extract the raw bytes that make up the reparse-point data.
    [byte[]] $bytes = -split (-join ($hexDump -match '^[a-f0-9]+:' -replace '^[a-f0-9]+:\s+(((?:[a-f0-9]{2}) +){1,16}).+$', '$1')) -replace '^', '0x'
    
    # Convert the data to a UTF-16 string and split into fields by NUL bytes.
    $props = [System.Text.Encoding]::Unicode.GetString($bytes) -split "`0"
    # Output a custom object with the App ID (Package ID + entry-point name)
    # and the target path (which may just be the universal UWP launcher)

    [PSCustomObject] @{
      Name = $Name
      Target = $props[3]
    }
  }
}

Get-ChildItem -File $env:LOCALAPPDATA\Microsoft\WindowsApps\*.exe | Resolve-AppXExePath | Out-Gridview -Wait

# https://stackoverflow.com/questions/71697488/follow-hard-links-reparsepoints-to-files-windows-terminal

 

[MikeBaas]

@MikeBaas, how do you know they're symlinks?

My filemgr shows this as a symlink, I don't know how he recognized that. And some of the features it offers for symlinks (like showing what they are pointing do) do not work - so it certainly is not a "traditional" symlink. Or maybe I was misled by some incorrect interpretation of the filemgr...

 

[MikeBaas]

You might have a look in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths and see whether there's a WinSCP.exe key in there....

Indeed - thank you! :)

Also many thanks to all other contributors, those links were quite interesting!