StartPortableApps.nsi for testing environment

I have been experimenting with some things, using StartPortableApps. So far I've found them useful, so I figured I'd post them here in case they might be useful to others. I'm posting them as .nsi source rather than an executable, because I don't want anyone mistaking this for a production or reliable version. Someone with NSIS installed can probably get this compiled in a couple of minutes (you'll need an icon file -- any will do -- or comment that line out).

It was estimated in another topic that StartPortableApps was just a five line script. I found one more line needed (the RequestExecutionLevel line for Vista). Then I added a few other things, including comments.

The environment variable changes are part my preference and part so I can more easily see what other tested apps are doing. Note that these changes are inherited by programs started by the PAM, but don't make any lasting changes on the host computer. One result is that temporary files are isolated in one place; I understand John will do something like this in a future version. If this were production usage, one could use a file wiper easily on any leftover files in that temp directory. Or one could force the temp directory (by changing this program a bit) to be on the portable drive.

The most useful thing I've tried is using the Sysinternals "psexec.exe -l" program to run things with limited privileges (the lines are commented out below, but easy to put back). I started using psexec with the -l option in a lot of my regular shortcuts as a way to improve security; it removes all administrative tokens and specifically denies the Administrators group, so what you are left with is what privileges your regular user account has, including file permissions. I'm not suggesting this for John's release, just saying that I find it useful for my own testing and such. Note that the limited privileges are inherited -- if PAM is started with limited privileges, then if it starts FireFox Portable, FireFox will also have limited privileges, as will anything Firefox starts (e.g. Acrobat).

For example, if I am testing a program launched with "psexec -l" I'll get immediate complaints about needing admin for something or other, if admin is needed. (Not quite the same as UAC on Vista, but similar enough that a developer on XP can get a head start.) The same with trying to write files in one of the system areas, like %systemroot%, if it is limited to Administrators, or registry entries in HKLM. It gives me a quick way to test running portably on a guest account without actually switching to one. It's not a replacement for testing on a guest account, but catches a lot of things first. Plus 0-day malware will have a harder time getting a foothold if it inherits no Admin privileges. (Psexec, for some reason, briefly opens a CMD window when it runs, which is annoying, but fleeting.)

Another thing this script does is start two programs. More could be added, for a specialized startup sequence. If one wanted, say, five specific programs launched, one could add a few lines at the end of this script and compile it into an .exe. I chose 10 seconds delay between starts, but it's easy to have more or none.

The other reason to post this is in case some of those with more NSIS experience can offer suggestions for better ways to do things. Again, I'm in no way suggesting this as a substitute for the startup program in John's suite, just as something that might be useful for a few developers.

!define NAME "StartPortableApps"
!define FULLNAME "StartPortableApps"
!define APP "StartPortableApps"
!define VER "1.0.1.1 experimental"
;!define WEBSITE "PortableApps.com"
;!define DEFAULTSETTINGSDIR "settings"

Name "${FULLNAME}"
OutFile "${NAME}.exe"
Caption "${FULLNAME} | PortableApps.com"
VIProductVersion "${VER}"
VIAddVersionKey ProductName "${FULLNAME}"
VIAddVersionKey Comments "Allows ${APP} to be run from a removable drive.  For additional details, visit ${WEBSITE}"
VIAddVersionKey CompanyName "PortableApps.com"
VIAddVersionKey LegalCopyright "John T. Haller"
VIAddVersionKey FileDescription "${FULLNAME}"
VIAddVersionKey FileVersion "${VER}"
VIAddVersionKey ProductVersion "${VER}"
VIAddVersionKey InternalName "${FULLNAME}"
VIAddVersionKey LegalTrademarks "PortableApps.com is a trademark of Rare Ideas, LLC."
VIAddVersionKey OriginalFilename "${NAME}.exe"
;VIAddVersionKey PrivateBuild ""
;VIAddVersionKey SpecialBuild ""

;=== Program Icon
Icon "${NAME}.ico"


SilentInstall Silent
RequestExecutionLevel user
OutFile "StartPortableApps.exe"


;=== Main section ===
Section "Main"

      System::Call 'kernel32::CreateMutexA(i 0, i 0, t "${NAME}") i .r1 ?e'
      Pop $0
      StrCmp $0 0 SetTempEnv
         ; already running; two might interfere with each other
         MessageBox MB_OK|MB_ICONEXCLAMATION "Another instance seems to be running. Please wait a moment and try again."
         Abort
      
   SetTempEnv:
      ; let's set special environment variables for the PA run-time environment
      ; first TEMP ... make sure our directory exists
     CreateDirectory $TEMP\papps
     ; ignore errors in case it already exists or something
     ; put %TEMP% into $1
      ReadEnvStr $1 TEMP
      ; set TEMP, TMP, and TEMPDIR to point to papps
      System::Call 'Kernel32::SetEnvironmentVariableA(t, t) i("TEMP", "$1\papps").r0'
      System::Call 'Kernel32::SetEnvironmentVariableA(t, t) i("TEMPDIR", "$1\papps").r0'
      System::Call 'Kernel32::SetEnvironmentVariableA(t, t) i("TMP", "$1\papps").r0'

      ; some programs need to know what drive they are on
      System::Call 'Kernel32::SetEnvironmentVariableA(t, t) i("pdrive", "$EXEDIR").r0'

      ; now start menus and things that will inherit this environment
      ; the next lines show how to start with limited privileges
      ;Exec `"$EXEDIR\PortableApps\Sysinternals\pstools\psexec.exe" -l -d "$EXEDIR\PortableApps\PortableAppsMenu\PortableAppsMenu.exe"`
      ;Sleep 10000   ; 10 seconds * 1000 milliseconds
      ;Exec `"$EXEDIR\PortableApps\Sysinternals\pstools\psexec.exe" -l -d "$EXEDIR\PortableApps\PStart\PStart.exe"`
      Exec `"$EXEDIR\PortableApps\PortableAppsMenu\PortableAppsMenu.exe"`
      Sleep 10000   ; 10 seconds * 1000 milliseconds
      Exec `"$EXEDIR\PortableApps\PStart\PStart.exe"`
      
SectionEnd