Introduction to VMware ThinApp

VMware ThinApp 4.0

Introduction to VMware ThinApp

Introduction to VMware ThinApp Revision: 20080627 Item: EN-000063-00

You can find the most up-to-date technical documentation on our Web site at: http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware.com

2008 VMware, Inc. All rights reserved. Protected by one or more U.S. Patent Nos. 6,397,242, 6,496,847, 6,704,925, 6,711,672, 6,725,289, 6,735,601, 6,785,886, 6,789,156, 6,795,966, 6,880,022, 6,944,699, 6,961,806, 6,961,941, 7,069,413, 7,082,598, 7,089,377, 7,111,086, 7,111,145, 7,117,481, 7,149,843, 7,155,558, 7,222,221, 7,260,815, 7,260,820, 7,269,683, 7,275,136, 7,277,998, 7,277,999, 7,278,030, 7,281,102, 7,290,253, and 7,356,679; patents pending. VMware, the VMware boxes logo and design, Virtual SMP and VMotion are registered trademarks or trademarks of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.

VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

VMware, Inc.

Contents

IntroductiontoVMwareThinApp

HowThinAppWorks 5 FeaturesofThinapp 8 UserModeOperation 8 VirtualSideBySide(SxS)Support 8 ApplicationIsolation 9 MultipleSimultaneousClientApplicationVersions 9 InstantPortableDeploymentofApplicationsonUSBFlashorCDROM) ThinAppApplicationsAreLoadedasNormalApplications 9 SetupCapture 9 TextBasedSettingsFiles 9 Compression 9 ApplicationSync 9 ApplicationLink 10 TerminalServerandMetaFrameSupport 10 VirtualFileSystem 10 VirtualRegistry 10 VirtualCOM 10 DynamicRemapping 11 VirtualServices 11 Scripting 11 ActiveDirectoryAuthentication 11 PackagingRuntimes 11 SecurityFeaturesofThinApp 12 StreamingApplicationswithThinApp 12 Sandbox 12 UserMode 13 ImprovedSecurityinUserMode 13 ImprovedSystemStabilityinUserMode 14 SideBySide(SxS) 14 DynamicPathRelocation 15 InstantSxSDLLMigration 15 FileSystemShellFolderRemapping 15 RegistryDataRemapping 16 ShortPathNames 16 SolvingtheShortPathNameMigrationProblem 18 PreventingConflictsWhenIsolationIsUsed 18 VirtualServices 19 UsingVirtualServices 19 StartingVirtualServices 19 StoppingVirtualServices 19 UsingaRealWindowsService 19

VMware, Inc.

Contents

VMware, Inc.

Introduction to VMware ThinApp

VMwareThinAppenablesyoutopackage,run,andmanageyoursoftwareapplications.ThinAppcaptures theinstallationofapplicationsintoasingleexecutablefileandenablesyoutoinstallyourcaptured applicationswithnodependenciesonthehostpersonalcomputer(PC).ThinAppdoesthisbyvirtualizingthe application. Applicationvirtualizationenablesthedeploymentofsoftwarewithoutmodifyingthelocaloperatingsystem orfilesystem.Itallowsyoutodeliverandupdatesoftwareinanisolatedenvironmentwhileensuringthe integrityoftheoperatingsystemandallapplications.Thissignificantlyreducesapplicationconflictsandthe needforregressiontesting.Asingleapplicationcanbebundledanddeployedtomultipleoperatingsystem versions.Applicationsareeasiertoprovision,deploy,upgrade,androllback. Acomparisonwithmachinevirtualizationcanbeusefultohelpunderstandapplicationvirtualization. Machinevirtualization,asaccomplishedwithVMwareproductslikeWorkstationandESX,decouples operatingsystemsfromtheunderlyinghardware.Thisisdonebyabstractingthephysicalhardwareresources andpresentingthemtotheoperatingsystemasvirtualresources.Theresultisahigherdegreeofhardware independence,isolation,andencapsulationthancanbeachievedwithoperatingsystemsinstalleddirectly ontohardwareresources.

ApplicationvirtualizationwithVMwareThinAppdecouplesapplications fromtheunderlying operatingsystem.Abstractedoperatingsystemresourcesarepresentedtotheapplicationasvirtual resources.Theresultisahigherdegreeofindependence,isolation,andencapsulationthanfor applicationsinstalleddirectlyintoanoperatingsystemenvironment.Applicationvirtualizationis highlycomplementarytomachinevirtualization.Usingbothmachineandapplicationvirtualization togetherincreasesthebenefitsofeach.

ThisdocumentprovidesanintroductiontoThinAppandincludesthefollowingtopics:

HowThinAppWorksonpage 5 FeaturesofThinapponpage 8 SecurityFeaturesofThinApponpage 12 StreamingApplicationswithThinApponpage 12 Sandboxonpage 12 UserModeonpage 13 SideBySide(SxS)onpage 14 DynamicPathRelocationonpage 15 ShortPathNamesonpage 16 VirtualServicesonpage 19

ForspecificinformationandinstructionsforusingThinApp,seetheVMwareThinAppUsersManual.

How ThinApp Works

ThinAppworksbyusingabuildprocesstolinkthevirtualoperatingsystemwithacompressedembedded filesystemandregistryintoasingleexecutablefile.Theexecutablefilecanrunwithzeroinstallation,and withoutdecompressingfilestodisk,fromanydatasourceincludingyourdesktop,anetworkpath,or removablestoragelikeUSBFlashandCDROM.ThinAppenablesapplicationstorundirectlyfromstorage devicessuchasUSBflashornetworksharesinanefficientmannerbyusingblockbasedstreamingwith transparentdecompression.

VMware, Inc.

Introduction to VMware ThinApp

ThinAppaccomplisheszeroinstallationbypresentingavirtualenvironmenttotherunningapplication, makingitappearasifallofitsfiles,registryentries,environmentvariables,COM/ActiveXcontrols,services, andsoonarealreadyinstalledonthePC,eventhoughnochangeshaveactuallybeenmade. Thevirtualenvironmentpresentedtotheapplicationisamergedviewoffilesinstalledbytheapplicationand filesalreadyexistingonthePC.Forexample,considerahostPCthathasafilesystemthatlookslikeFigure 21 inWindowsExplorer: Figure 2-1. Host PC File System Viewed in Windows Explorer

Local Disk (C:) Documents and Settings Program Files Common Files ComPlus Applications Internet Explorer Messenger microsoft frontpage
MicrosoftOfficecreatesvariousdirectoriesduringitsinstallationprocess,includingthese:
C:\Program files\Microsoft Office\... C:\Program files\Microsoft Works\...

WhenyourunaversionofMicrosoftOfficecapturedbyThinApp,theapplicationseesalloftheoriginalfiles onthePCplustheadditionaldirectoriesinstalledbyMicrosoftOffice.IfyouselectFile > Open,youseethe directorystructureasshowninFigure 22: Figure 2-2. ThinApp-Captured Microsoft Office File System Viewed in Windows Explorer

Local Disk (C:) Documents and Settings Program Files Common Files ComPlus Applications Internet Explorer Messenger microsoft frontpage Microsoft Office Document Themes 12 MEDIA Office 12 1033 1036 3082 Samples Microsoft Works
BecausethesedirectoriesarenotactuallycreatedonthehostPC,thePCremainsunchangedandcaptured applicationsdonotnegativelyimpactotherapplicationsonthesamePC.

VMware, Inc.

Introduction to VMware ThinApp

ThinApppresentsamergedviewofthesystemregistryaswell.Figure 23showstheregistryasseenby WindowsRegedit: Figure 2-3. Registry as Seen by Windows Regedit

HKEY_LOCAL_MACHINE HARDWARE SAM SECURITY SOFTWARE C07ft5Y Classes Clients Gemplus Microsoft Active Setup NetSh NetShow Non-Driver Signing Ole Outlook Express PCHealth

VMware, Inc.

Introduction to VMware ThinApp

Figure 24showstheregistryasseenbyacapturedversionofMicrosoftOffice: Figure 2-4. Registry as seen by a captured version of Microsoft Office

My Computer HKEY_CLASSES_ROOT HKEY_CURRENT USER HKEY_LOCAL_MACHINE HARDWARE SAM SECURITY SOFTWARE C07ft5Y Classes Clients Gemplus Microsoft Active Setup NetSh NetShow Non-Driver Signing Office 12.0 Access connectivity Common Registration User Settings Visio Common Delivery InfoPath Visio Ole Outlook Express PCHealth

Features of Thinapp
ThefollowingsectionsdescribeThinAppfeatures.

User Mode Operation

ThinApprunscompletelyinusermode,whichprovidesmanysystemstability,security,infrastructure,and easeofuseadvantages.Formoreinformation,seeUserModeonpage 13.

Virtual Side-By-Side (SxS) Support

ThinAppsupportsSidebyside(SxS).SxSisanoperatingsystemfeaturesupportedbyWindowsXP, Windows 2003,andWindowsVista.SxSisrequiredtodeploymostcurrentsoftwareproductsincluding MicrosoftOffice2007,AdobeReader8,and.NET2.0/3.0.Formoreinformation,seeSideBySide(SxS)on page 14.

VMware, Inc.

Introduction to VMware ThinApp

Application Isolation
ThinAppenablesapplicationstorunwithoutanymodificationtotheregistryorfilesystemofthehostPC. OtherapplicationsrunningonthesamePCareunawareofvirtualizedapplications.

Multiple Simultaneous Client Application Versions

ThinAppistheonlyvirtualizationtechnologythatsupportsmultipleconcurrentrunningcopiesofitsclient applicationonthesamePC.Thatis,youcaninstallApplicationBbyusingthemostcurrentreleaseofThinApp withoutaffectingApplicationAthatwasinstalledusingapreviousversionofThinApp. EachapplicationthatiscapturedandinstalledwithThinAppcontinuestooperateindependentlyofThinApp itself.

Instant Portable Deployment of Applications on USB Flash or CD-ROM)

ThinAppcaneasilyconvertstandardapplicationsintoportableapplicationsthatrunfromUSBflashdevices orCDROMplayers.ForUSBdeployment,ThinAppusesitsportablemodetoredirectapplicationregistry andfilesystemchangesintendedforthehostPCtofilesstoredontheportabledevice.BecauseThinApphas nodevicedriversandrunsinguestaswellasrestricteduseraccounts,youcanusecapturedportable applicationsonkioskPCseveniftheyarelockeddownanddonotpermitanyinstallation.

ThinApp Applications Are Loaded as Normal Applications

WindowsviewsexecutablesgeneratedbyThinAppasnormalapplicationsthatrunwithoutexternal dependencies.OtherapplicationsonthesystemarenotaffectedbyinstallingThinAppvirtualapplications.

Setup Capture
TheThinAppSetupCapturewizardprovidesasimplewaytopackageapplicationsintovirtualapplications. UseSetupCapturetotakesnapshotsofamachinebeforeandafteryouinstallanapplication.TheThinApp packageiscreatedusingthedifferencesbetweenthetwosnapshots.

Text-Based Settings Files

Exceptforapplicationfiles,whicharestoredasnormalbinaryfiles,allThinAppfilesandsettingsarestored as.inifilessoThinAppprojectscanbemanagedusingsourcecontrolapplications.

Compression
ThinAppusesblockbasedstreamingdecompression.Compresseddatadoesnotneedtobedecompressedto adiskbeforeitcanbeaccessed.Thismeansthatyoucanlaunchpackagesfromanetworksharewithout decompression.Allthepackagedataisdecompressedoneblockatatimeasneededbytheapplication.Only startupdataissentoverthenetwork. WhenyoudeploypackagestoPCharddrivesforofflineuse,requirementsfordiskspacearereducedbecause packagedataremainscompressedatalltimes.ThinApphascompressionratiossimilartothoseachievedwith ZIPcompression.

Application Sync
UseApplicationSynctodeployThinAppapplicationupdates.ThisenablesThinApptoautomaticallycheck forandinstallupdatestoyourpackagedapplication.Updatesmightincludechangessuchasanewversion, servicepackupdates,orconfigurationchangesinthepackage.inifile. NOTEIfyouuseApplicationSync,VMwarerecommendsthatyoudisable automaticapplicationupdatesthatareconfiguredinyourvirtualapplication. Conflictsmightoccurbetweenthelinkedpackagesandthesoftwarethatis automaticallyupdated.

VMware, Inc.

Introduction to VMware ThinApp

Application Link
ApplicationLinkconnectsdeployedapplications.Forexample,youcanestablisharelationshipbetweena deployedinstanceofMicrosoftOffice2003andanewMicrosoftOfficeplugin.ApplicationLinkenablesyou toestablishalinkbetweenapplicationswithouthavingtoencapsulatethemintothesameexecutablepackage.

Terminal Server and MetaFrame Support

YoucanusethesameThinApppackagesonterminalserversanddesktopPCswithoutchanges.Youcanrun multipleversionsofanapplicationsimultaneouslyonthesameserverwithoutconflictsbecauseoftheregistry andfilesystemisolationthatThinAppprovides.Youcanupdateapplicationswithouthavingtostop currentlyrunningcopies.

Virtual File System

ThinAppsupportspackagesgreaterthan4GBinsize.Italsosupportssandboxing,isolation,andsystemmerge modesforspecificregistrysubtrees.Sandboxedfilescanbescannedandblockedbyantivirussoftware.The virtualfilesystemisstoredinmacroformat,remappingshellfoldersautomatically.Thevirtualfilesystem automaticallymigratesSidebySide(SxS)fromWindowsXPtoWindowsVista.

Virtual Registry
TheThinAppvirtualregistryisavisibleapplication,nottheentiresystem.Thefollowingvirtualregistry featuresaresupported:

Executablefilescontainareadonlyimageoftheregistry. Thevirtualregistryismergedontothesystemregistry. ApplicationspecificregistrysubtreesareautomaticallyisolatedfromthehostPCtopreventconflicts withlocallyinstalledversions. Thesandboxstoresruntimemodificationsasdiffs. Theregistrycancontainperuserdata(HKEY_CURRENT_USER). TheregistrycancontainSIDspecificuserdata. Theregistrycanberesettoacapturedstatebydeletingthesandbox. Thevirtualregistryissharedbyallapplicationsinthesamesandbox. Automaticbackupandrestorationoccurupondiskcorruption(commonUSBflash). DynamicPathRelocationisappliedtoallregistryreadsandwritesallowinginstantoperatingsystem andPCmigration.Formoreinformation,seeDynamicPathRelocationonpage 15.

Virtual COM
VirtualCOMprovidesthefollowingfeatures:

InprocessCOMfromvirtualDLLS. Nosystemregistration. NoextractingDLLsorOCXstofilesystem. OutofprocessCOM/DCOM. ExecutablebasedCOMwithoutinstallation. ServicebasedCOMwithvirtualservices.

10

VMware, Inc.

Introduction to VMware ThinApp

Dynamic Remapping
ThinAppprovidesthefollowingdynamicremappingfeatures:

Registryandfilesystemdynamicallyreadjustforinstantmigrationacrossoperatingsystems (DynamicPathRelocationonpage 15). Userprofiledataandsandboxdynamicallyremaps,enablingapplicationandsettingmigrations. ExecutiononUSBflashfromPCtoPC. Managesshellfoldersandshortpathnames.

Virtual Services
ThinAppprovidesthefollowingvirtualservicesrelatedfeatures:

Applicationsthatrequireaservicecanbepackaged. Virtualservicesautostartwhenanapplicationislaunched. Virtualservicescanbestartedandstoppedbyanapplicationlikerealservices. SupportforpackagingservicesanddeploymentasrealWindowsservicesisstartedatboottime.

Scripting
ThinAppprovidesthefollowingscriptingfeatures:

Embedandenable.vbsinexecutablefiles. Configureprelaunchandshutdown. ExposetheVMwareThinAppruntimeAPI. ProvideaccesstoanyCOMscriptingprovider. Executecommandsinavirtualorrealenvironment. Setapplicationtimeouts,andauthenticatewithLDAPoradatabase.

Active Directory Authentication

ThinAppsupportsthefollowingActiveDirectoryAuthenticationfeatures:

ApplicationaccesstiedtoActiveDirectorygroups. DynamicadditionandremovalofuserstoActiveDirectorygroupsforaccesscontrolpurposes. Offlinecachedcredentialsforofflineusage.

Packaging Runtimes
ThinAppenablesyoutopackageruntimeswithyourapplicationandeliminatepreinstallationrequirements. Someexamplesinclude:

.NET1.1,2.0,3.0 Java Perl CrystalReports COMandActiveXcontrols

VMware, Inc.

11

Introduction to VMware ThinApp

Security Features of ThinApp

ThinApphasthefollowingsecurityfeatures:

GrouppolicysecurityBecauseThinApphasnokernelmodecode,itcannotviolatemachinegroup policyappliedtouseraccounts. ThinApphasnoabilitytogiveapplicationselevatedpermissionsfordevicesonamachine,suchasthe filesystem,registry,networkingdevices,orprinters.

RunsinrestricteduseraccountsBecauseThinApprequiresnodevicedrivers,itcanrunapplicationsin guestuseraccountswithoutpreviousinstallationsofthesoftware. AllowsapplicationsrequiringadministratorrightstorunwithoutadditionalprivilegesWhenyou makeglobalchangesusingavirtualapplication,theThinAppsandboxprovidesauserand applicationspecificlocationtomakethosechanges.Thehostsystemisnotaffected.Thisfeatureenables applicationstoruninsecure,restrictedenvironmentslikeTerminalServerandWindowsVista.

Streaming Applications with ThinApp

ThinAppprovidesstreamingcapabilitywithoutrequiringanewserverorclient.ThinAppusesthestandard SMBprotocoltostreamapplicationsoveraLAN,soanyWindowsfilesharecaninstantlybecomeastreaming server.ThinAppembeddedclienttechnologyenablesyoutoclickonexecutablefilesfromnetworksharesafter whichtheclientisloadeddirectlyintomemory. ThinAppsupportsthefollowingstreamingfeatures:

WindowsClient ServercanbeanySMBshare Blockbyblockstreaming Instantstartforpackagesover8GBinsize Streamsfromanysourcemedia,includingnetworksharesandISCSI,harddrives,USBFlash,and CDROM

Sandbox
Thesandboxholdsruntimemodificationsthatapplicationsmakeastheyarerunning.Theexecutablethatyou buildneverchanges,soitcanbeplacedinasharedfolderwithreadonlyaccess.Thesandboxhasthe followingfeatures:

Providesperuserandperapplicationstorageofapplicationmodifications. Providesprotectionforthehostmachinesincethevirtualapplicationisselfcontained. EnablesapplicationstorunonTerminalServeriftheyarenotalreadyabletodoso. EnablesmostapplicationstorunonVistaiftheyarenotalreadyabletodoso. EnablesITtomaintainlockeddowndesktops. Revertstoaknownapplicationstatewhenyoudeletethesandbox.

12

VMware, Inc.

Introduction to VMware ThinApp

User Mode
VMwareThinAppusesusermodeforapplicationvirtualization.Usermodemaintainssystemsecurity, stability,andusability. Windowsrunsallcodeinoneoftwomodes,usermodeandkernelmode(alsoreferredtoasRing3andRing0 respectively).ThetwomodesreflecttwodifferentsecuritymodelsthatareenforceddirectlybyyourIntelor AMDprocessor.Coderunninginkernelmodehasfullmachineaccesswithnosecuritycontrols.Forexample, yourcodecanwritetorawdeviceports,intercept,andfiltersystemwidefilesystemactivity,readandwrite machinewideprocessandkernelmemory,andaccessanykernelorprocessobjectswithoutregardfor securitydescriptors.KernelmodecodeiseitheradevicedriverortheWindowskernelitself. Usermodeisthemodeinwhichallapplicationsrun.Usermodehasstrictsecuritypoliciesappliedatalltimes. Usermodecodecannotdoanythingtoamachinethatdirectlycausesittofailorviolateappliedsecurity policies.Forexample,usermodecodecannotaccessfilesownedbyotherusersunlessfilesystempermissions allowit.Usermodecodecannotmakenetworkconnectionsunlessthegroupsecuritypolicyenablesittodo so.Any80386(Pentium+)andhigherprocessorsenforceaspecificsecuritypolicyonusermodeapplications byprohibitingthemfromexecutinginstructionsthattalktodeviceportsdirectly,preventingaccesstomemory inotherprocesses,andbypreventingexecutionofkernelmodewithoutfirstgoingthroughspecificcontrolled entrypoints. Forusermodecode,Windowssupportsmanydifferentsetsofuseraccountsthatarebasedonsecurity policies.Forexample,administratorandguestaccountsareuserbasedsecuritypolicies.Administrators typicallyhavenearlyfullpermissiontoaccessanysystemobjectstheywant,whileguestsarerestrictedand cannotreadotherusersfilesorwritetogloballocationsonamachine. Bothadministratorsandguestsrunapplicationsinusermode,butswitchtokernelmodewhenmaking systemcallstoaccessobjects.Kernelmodecodeverifiessecuritydescriptorstocheckifusershaveaccessto theobjectstheyrequest. UsermodeenablesThinApptodothefollowing:

ThinAppcanrunapplicationsonlockeddownPCswithoutadministratorrights.Thismeansremote userscanexecuteapplicationsonkioskandhotelPCswheretheyarenotabletoinstallsoftwareordevice drivers. ThinAppcanrunapplicationsdirectlyfromUSBflashdevicesandvariousportablestorage.Because ThinAppcanbeloadedwithoutaclientcomponent,youcanuseapackagedapplicationonanyPCor networkshare. ThinAppoperateswithallsystemlevelsoftwareanddoesnotconflictwithdevicedrivers.

Improved Security in User Mode

Softwareapplicationstypicallyhavebugsthatcreatepotentialsecurityproblems.Forexample,Internet ExplorercanbeusedtoforcemachineswithInternetaccesstoexecutecodeusinganHTMLemailor redirectingpageviewstospecificWebsites. WithWindowsVista,MicrosoftrunsInternetExplorerfromaseparateuseraccountthathaslimitedsecurity rights.Becauseofthis,acompromisedInternetExploreraccountcannotdoanythingtotherestofthemachine. ThissolutionispossiblebecauseInternetExplorerrunsinusermode. BecauseThinApprunsinusermode,anybugorvulnerabilitypresentsnoadditionalrisktotherestofthe systembecauseallThinAppcodeisrunninginusermodeinthesamesecuritycontextastheapplication. Othersolutionsusedevicedriversandrunsignificantamountsofkernelmodecode.Ifthesesolutionsare compromised,youcanlosefullcontroloveryourmachine.Usermodecodecanbewalledoffusinguser accountsbutkernelmodecodecannot. BecauseThinApprunsinusermode,ithasthesamerightsandpermissionsasanyotherapplicationaspecific userhas.ThinAppcannotexceedthesecurityrightsoftheuseraccountitisrunninginbecauseithasnodevice driversorcomponentsrunninginkernelmode.

VMware, Inc.

13

Introduction to VMware ThinApp

WhenusingVMwareThinApp,administratorsdonotneedtoconsiderhowtheirsystemwidesecurity policiesareaffected. VMwareThinAppcanbedeployedinconjunctionwithcentralITgrouppoliciesorseparatelyinthecaseof smallerdevelopmentgroups.Developergroupscanusethecodecomponentsandframeworksoftheirchoice withoutrequiringsecuritypolicychangesbytheirITorganization.

Improved System Stability in User Mode

Systemfailurescanbehardtodiagnosewithoutsignificanttimeandresources.Mostsystemfailuresare causedbythirdpartydevicedrivers. Everyinstructionrunninginkernelmoderepresentsariskofsystemfailure.Oftenfailuresarecausedby threaddeadlocksthatonlyoccurunderrarecircumstancesandwhencombinedwithotherproducts. Kernelmodeapplicationshavenoprotectionfromsystemfailureorleakedresources.Akernelmodesystem failureisoftencausedbyadeadlockedthread,sothatthemachineappearstobefrozenorperformsbadlyfor noapparentreason. Usermodecodecanneverdirectlycauseasystemfailureandcanbeeasilystoppedwithataskmanagerifit causesthesystemtofreeze.Thereisnootherimpactonthesystem.Windowsautomaticallycleansupaftera failurebyclosingopenfilehandles,freeingallocatedmemory,anddiscardingcreatedresources. Usermodeenablesyoutorunapplicationsdirectlyfromlockeddownaccountswithoutpreinstallingadevice driverorgrantingtheuserelevatedsecurityprivileges. BecauseThinApphasnodevicedrivers,itenablesdeploymentofapplicationswithzerofootprintondesktop PCs.Applicationscanrunfromnetworkshareswithnopreinstallationrequirements.

Side-By-Side (SxS)
VMwareThinAppsupportsSidebyside(SxS).SxSisanoperatingsystemfeaturesupportedbyWindowsXP, Windows 2003,andWindowsVista.SxSisrequiredtodeploymostcurrentsoftwareproductsincluding MicrosoftOffice2007,AdobeReader8,and.NET2.0/3.0. WithSxStechnology,applicationscaninstallDLLstoversionspecificdirectories.ThisinformsWindows whichversionoftheDLLshouldbeusedwhenthatDLLisloaded.Forexample,MicrosoftOffice2007installs MFC80(8.0.50727.42)tothefollowingpath:
%SystemRoot%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll

ThepathcontainsinformationabouttheDLLversion.Theonlywaytoplacefilesatthislocationisbyusing MSIinstallertechnology.AninstalledSxSDLLisinstalledindifferentlocationsonWindows XPandWindows Vista.BecauseusersmightmigratetheirexistingWindows XPinstallationstoVista,theupgradeprocess automaticallymovestheDLLstotheirnewlocationonVista. WindowsoperatingsystemsthathaveSxSlookforanapplicationsmanifestinformationtodeterminewhich versiontoloadfromSxS.AmanifestisanXMLdescriptionofalltheSxSDLLsthatcanbeloadedbyan application.ThemanifestalsostateswhichversionofthoseDLLstouse.Themanifestcanbeembeddedinthe applicationexecutableorDLLinthefileasaresource.Themanifestcanalsobestoredseparatelyonthefile systemasa.manifestfile.Themanifestfileforapp.exeiscalledapp.exe.manifest. Themanifestresolutionalgorithmprovidessearchcapabilitiesbasedontheuserslanguage(forexample, FrenchandGermanversionsareavailable).SxSDLLshaveaforceupgrademechanismimplementedas separatesecuritypolicyfiles(alsoXMLfiles).ThismechanismenablesMicrosofttooverrideversionnumber requestsbyapplicationsifasecurityholeisdiscoveredinasharedlibrary.Forexample,anapplication manifestmightrequestversion1.0.0.0ofagivenDLL,butMicrosoftcanprovideapolicyfileupdatethat redirectsallrequestsofversion1.0.0.0to1.0.0.5. IftheapplicationnormallyinstallsDLLstoc:\windows\winsxs\..., thisisreflectedinthecaptureand appearsinyourprojectunder%systemroot%\winsxs\....

14

VMware, Inc.

Introduction to VMware ThinApp

Atruntime,ThinAppexaminesanapplicationsmanifestfile(fromtheresourcesectionorseparate.manifest virtualfile)anddetermineswhichversionofaDLLtouse.ThinAppthenloadsthecorrectversionoftheDLL fromthevirtualpath(containedinsidethepackage).VMwareThinAppsupportsmanagementofruntime activationcontextsaswell,soitknowswhichversionofDLLstoloadfromdynamicDLLloads. Natively(withoutThinApp),SxSissupportedonWindowsXP,Windows 2003,andWindowsVista,butnot Windows2000andWindowsNT.IfyouwanttosupportWindows2000andWindowsNTwithoutThinApp, youinstallyourvirtualapplicationatthefollowinglocations(thisisautomaticallyperformedbyMSIinstaller 3.0):

c:\winnt\system32(theapplicationdirectory) c:\winnt\winsxs (SxSpathlocation)

InstallationofyourvirtualapplicationatthefirstlocationisrequiredtosupportWindows2000andWindows NT.InstallationofthevirtualapplicationatthesecondlocationisrequiredtomeetMicrosoftsDesignedfor Windowsguidelines.Theseguidelinesstatethattheapplicationmustcontinuetoworkiftheoperating systemisupgradedfromWindows2000toWindowsXP. BecauseVMwareThinApphasitsownSxSprocessing,allSxStechnologyisavailableforWindowsNT, Windows2000,WindowsXP,Windows2003,andWindowsVistaintheVMwareThinAppenvironment. OnWindowsVista,MicrosofthaschangedthepathlocationsandfilepathnamealteringalgorithmforSxS DLLs.VMwareThinAppautomaticallymovesSxSDLLscapturedforWindowsXPandWindows2003, placingtheminthecorrectlocationinvirtualspaceforWindowsVistaatruntimewhentheapplicationstarts. Therefore,thesameexecutablecanrunonallplatformswithnochanges. VMwareThinAppistheonlyvirtualizationtechnologythatfullysupportsSxSwhichallowsyoutovirtualize mostnewapplicationsinwhichvirtualizationproductsfailbecausetheymusthaveSxSDLLsphysically installedonthemachinebeforetheywork.

Dynamic Path Relocation

DynamicpathrelocationistheabilitytomovefilesandmodifyregistryvaluestomatchthelocalhostPC. ThinAppperformsdynamicremappingduringapplicationstartupandatruntime.Dynamicremapping enablesbothapplicationsandtheirassociatedsettingstomigrateacrossdifferentversionsofWindows.

Instant SxS DLL Migration

WindowsXPSxSDLLsaremigratedtoWindowsVistaSxSDLLsautomaticallydependingontheplatform youareusing. IfyoucaptureanapplicationthatusesSxSDLLsonWindowsNT,Windows 2000,Windows XP,orWindows 2003,itinstallsSxSDLLstoapathlocationdifferentthanwheninstalledonVista.ThinAppdynamically movestheseSxSfilesduringapplicationstartupiftheplatformhaschanged.UsingThinAppdynamicpath relocation,youcancreateonepackagethatworksonallplatforms.

File System Shell Folder Remapping

Manyapplicationsaccessfilesusingshellfolderlocations.Forexample,applicationstypicallycall GetWindowsDirectorytoobtainthepathtoc:\windowsinsteadofusingahardcodedpath.Ondifferent versionsofWindows,thesystemdirectoryislocatedindifferentlocations.Inaddition,theusercanselectan alternatedirectoryduringinstallationofWindows.Applicationsalsotypicallyuseshfolder.dlltoobtain thepathvariousshellfolderlocationslikec:\Program Filesandc:\documentsandsettings\username. AnexampleisMacromediaFlash,whichinstallstoc:\windows\system32\macromed\flash.Atruntime, FlashusesGetWindowsDirectorytoobtainthepartialpathc:\windows\system32,andthenappends macromed\flashtoobtainthelocationofitsinstallationdirectory.Inaddition,Flashusesaregistryvaluethat correspondstothefollowinglocation:
HKEY_CLASSES_ROOT\CLSID\{1171A62F-05D2-11D1-83FC-00A0C9089C5A}\InprocServer32 DefaultValue = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx

VMware, Inc.

15

Introduction to VMware ThinApp

WhenanapplicationisrunningthatinstallsMacromediaFlashdynamicallyorduringthecaptureprocess(for example,FirefoxorInternetExplorer),theregistrystoresthepathC:\WINDOWS\system32,andfilesare writtentoc:\windows\system32\macromed\flash.IftheapplicationismovedtoanotherPCwherethe Windowsrootdirectoryisdifferent(forexamplec:\winnt onWindows2000),theapplicationfailstowork unlessboththefilesandregistrykeysareremappedtopointtoc:\winnt. TheThinAppvirtualfilesystemstoresfilepathsusingfoldermacros,sothefilepathsautomaticallypointto thecorrectlocationondifferentPCs.ThinAppstoresregistrydatausingthesamefoldermacros,sothat registryvaluesautomaticallyreadjusttopointtothecorrectlocationonadifferentPC.Forexample,whenthe applicationwritestheregistryvalueC:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx,ThinApp storesthisinternallyas%SystemSystem%\Macromed\Flash\Flash9b.ocx.Whentheapplicationqueriesfor thisvalue,ittransparentlyexpandsbacktoC:\WINDOWS\system32\Macromed\Flash\Flash9b.ocxwhen runningonWindows XP,Windows2003,WindowsVista,and C:\winnt\system32\Macromed\Flash\Flash9b.ocxwhenrunningonWindows2000orWindowsNT.

Registry Data Remapping

ThinAppinterceptsalldatawrittentotheregistryandseeksreferencestoshortpathnamesorshellfolders.If anyreferencesarefound,itinternallystorestheregistrydatainmacroformatsothatthedatareexpandsto thecorrectlocationonotherPCs.

Short Path Names

ThinAppsitsabovetheWindowsloaderandfilesystem,andcorrectlyhandlesshortpathnames(DOS8.3file names). Forexample,applicationslikeMicrosoftOfficehavealargenumberofregistryvaluesthatcontainentrieslike C:\PROGR~1\MICROS~3,butonothercomputers,thevirtualfilesmightactuallyappeartoexistat C:\PROGRA~1\MICROS~4.Becauseofthis,variousCOMcomponentsfailtoworkatruntime. Manyapplicationsdonotinstallorrunproperlywhenanondefaultpathisused.ThinAppusesdynamic macroexpansionforallregistryandfilenameinformationtoaddresstheshortpathnameissue. Atruntime,ThinAppfiltersregistryandfilenamedatatoreplaceshortpathswithmacroversionsthat reexpandtothecorrectlocationonnewcomputers.Inthisscenario,registryvaluesautomaticallyreadjustto pointtothecorrectlocationswhenthepackageisrunonadifferentcomputer.ShortpathnamesareDOS8.3 compatiblenamesthatmapintotheirlongpathnameequivalents.ForexampleC:\PROGR~1istheshortpath nameversionofC:\ProgramFiles. Shortpathnamesareimportantformostapplicationsforseveralreasons:

Shortpathnameseliminatespacesfrompathsthatpreventsomecompatibilityandsecurityissues.For example,whenexecutingthecommandC:\Program Files\Microsoft Office\OFFICE11\winword.exe c:\Myfile.docusingShellExecute,Windowsattemptsanumberof possiblecommandstoseeiftheyarevalid:

c:\Program.exe "Files\Microsoft Office\OFFICE11\winword.exe c:\Myfile.doc" c:\Program Files\Microsoft.exe "Office\OFFICE11\winword.exe c:\Myfile.doc" c:\Program Files\Microsoft.exe Office\OFFICE11\winword.exe "c:\Myfile.doc"

Ifyoucreatethefilec:\Program.exeonaPC,itmightcausesproblemswhenyouareusingMicrosoft Officeandmightalsocreateasecurityproblem.

Shortpathnamesenablecompatibilitywithlegacyapplications16bitapplicationsmustuseDOS8.3 filenamepaths.WhenWindowsruns16bitapplications,itprovidesapplicationswiththeshortpath nameversionforallfilenames.

16

VMware, Inc.

Introduction to VMware ThinApp

ShortpathnamesworkaroundWindowsAPIpathlengthlimitations.ManyWindowsAPIfunctionshave limitationsonthemaximumstringlengththeycanhandleforpaths.Forexample,onWindowsXPSP1, aShellExecuteAPIcommandcannothandleastringlengthlongerthan128characters.Oftentheregistry isusedtostoreavaluesuchasCommand+Parameters.ThefollowingentryforOffice2003isanexample:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ois.exe\shell\Edit\command DefaultValue = C:\PROGRA~1\MICROS~3\OFFICE11\OIS.EXE /shellEdit "%1"

Iftheexecutablefilenameplustheparameterisgreaterthan128characters,thecommandfailson WindowsXPSP1(MicrosoftextendedthelengthforShellExecuteinSP2). Forexample,thefollowingcommandexceeds128characters(168chars):

C:\Program Files\Microsoft Office\OFFICE11\winword.exe c:\documents and settings\Greogory Appleblaught\My Documents\Draft 34 April 6 2006 Master License Agreement.doc

Thesamepathismuchsmallerusingshortpathnames(85characters):
C:\Progra~1\Micros~3\OFFICE11\winword.exe c:\docume~1\Greogo~1\MyDocu~1\Draft3~1.doc

Theuseofshortpathnamesintheregistryisverycommon.Forexample,MicrosoftOfficeinstallshundreds ofshortpathnamereferencesintheregistry. ShortpathnamesarenotconsistentacrossPCsandarealsohighlydependentoninstallationorder.For example,installingMicrosoftOfficeafterinstallingMicrosoftVisualStudiocancreateidenticalshortpath namesthatrefertodifferentlocations. InstallingMicrosoftOfficefollowedbyMicrosoftVisualStudiogenerates:

c:\progra~1\micros~1 and c:\progra~1\micros~2 c:\progra~1\micros~1 = c:\Program Files\Microsoft Office c:\progra~1\micros~2 = c:\Program Files\Microsoft Visual Studio

Whencapturingasnapshotofanapplicationsinstallation,VMwareThinAppwritesanumberofshortpath namevaluestotheregistryasdescribedabove.MovingtheapplicationtoadifferentPCorinstalling additionalapplicationsonthesamePCmightaffecttheshortpathnamevaluesthattheunderlyingoperating systemprovides. Virtualizationsolutionsthatarebasedonfilterdriversdonothavetheabilitytocontrolshortpathname valuesbecausetheyaregeneratedbytheWindowsfilesystem.Becauseofthis,acaptureononePChasagood chanceoffailingwhenmovedtoanotherPCorwhenexecutedlateronthesamePCafterotherapplications havebeeninstalled. Commonareasoffailurethatoccurwhenpropershortpathnamesupportisnotavailableinclude:

InprocessandoutofprocessCOMfailureTheapplicationtriestocreateCOMobjectsandfails becausetheregistryvaluespointtotheinprocessoroutofprocessCOMservernolongerpointtothe correctlocation. AnMSIisexecutedtoreinstallanapplicationeventhoughitwasfullyinstalled msi.dllperforms anintegritycheckforallMSIinstalledcomponentsrequestedbyanapplication.Ifmsi.dlldetectsthata DLLordatafileisnotlocatedatthesamelocationthatitwasoriginallyinstalledto,itkicksoffa reinstallationproceduretotrytocorrecttheproblem. ChildprocessesfailtoexecuteManychildprocessapplicationsareexecutedusingregistryvaluesthat pointtoshortpathnames.Ifthevaluesdonotpointtothecorrectlocation,thechildprocessfailsto launch.Thisoftenrendersanapplicationunusable. AnapplicationfailstoloadApplicationsmightfailordonotloadproperlybecausetheycannotlocate theinstallationpathorsharedDLLpathsusingregistrydata. AnapplicationindicatestherearemissingdatafilesAnapplicationmightdisplayerrormessages relatingtomissingfilesbecauseitcannolongerlocateafileusingashortpathnamepointerfromthe registry.

VMware, Inc.

17

Introduction to VMware ThinApp

Solving the Short Path Name Migration Problem

ThinAppusesacombinationofdynamicregistrydataexpansionandvirtualshortpathnamestoenable applicationstoinstantlymigratefromonePCtoanother. Whenanapplicationwritesavaluetotheregistry,ThinAppscansthedataforreferencestoashortpathname orshellfolderlocation.Iftheapplicationdoesthis,VMwareThinAppstoresthevalueinternallyinmacro formatthatencodesboththeshellfolderlocationaswellasthelongpathnamevalueforashortpathname. Atruntime,whenanapplicationqueriesthesameregistryvalue,itreceivestheoriginalvalueitwrotetothe registry.IftheapplicationmovestoadifferentPCwheretheshortpathnamesaredifferent,itobtainsan automaticallyadjustedvalue. Forexample,ifyoulookatHKEY_LOCAL_MACHINE.txtforacaptureofMicrosoftOffice,youseesomeentries similartothefollowing:
isolation_full HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{03B54468-0899-42338689-623FFFC295EE}\InprocServer32 Value= REG_SZ~%ProgramFilesDir~0032\Common Files\Microsoft Shared\Smart Tag\IETAG.DLL#2300 Value=ThreadingModel REG_SZ~Apartment#2300

Inthiscase,theregistryvalueisencodedtoexpandtotheshellfolderlocation c:\Program Filesand\common files\microsoft shared\smart tag\ietag.dll asinthefollowingexpression: GetShortPathName(ExpandMacro("%ProgramFilesDir%") + "\Common Files\microsoft shared\smart tag\ietag.dll") BecauseThinAppperformsthismacroexpansionandcollapseforeveryregistryoperation,ithasbeenhighly optimizedtorequireverylittleCPUoverhead.Theexpansionandcollapseoccursdynamicallyatruntime,so nostartupoverheadtimeforapplicationswithlargeregistriesoccurs.

Preventing Conflicts When Isolation Is Used

InavirtualenvironmentwhereanapplicationisisolatedfromaPC,thenormalfilesystemisnotawareof shortpathnamesthatavirtualizedapplicationneedstouse(forexample,whenadesktopPChasMicrosoft Officeinstallednatively).Inthiscase,MicrosoftOfficeoccupiestheshortpathnamec:\progra~1\micros~1. Supposethat,onthissamedesktop,avirtualversionofMicrosoftVisualStudioapplicationbeginsrunning. Inthiscase,VisualStudioneedstouseadifferentshortpathnameotherthan c:\progra~1\micros~1 becausethisnameisalreadyinuse. Theapplicationmustreservetheshortpathnamec:\progra~1\micros~2whentheshortpathnameis allocatedbytheWindowsfilesystem.AproblemarisesifathirdMicrosoftapplicationisinstalledwhileVisual Studioisrunning.Itisuncertainiftheprocesswillreceiveamicros~3ormicros~2shortpathname.Inthelatter case,itconflictswiththevirtualapplicationandthevirtualapplicationmightfail. ThinAppdoesnotusefilterdriversanddoesnotdependontheWindowsfilesystemfortheallocationofshort pathnames.ThinApppreventsconflictsbetweenshortpathnamesbetweenvirtualapplicationsandsystem applicationsbyusingitsownshortnamespacethatdoesnotcollidewithsystemapplications. Becauseeachvirtualapplicationisisolatedfromallothervirtualapplications,youcanhavetwovirtual applicationsusingthesameshortpathnamesinternally.ThinAppusesadifferentnamespacethanWindows forshortpathnameswhenthesystemdoesnothavethepathsalreadycreated.Youcanseethisinactionby runningapackagedcmd.exeandusedir /xtolistshortpathnames. WhenyouuseThinAppSetupCapturetocaptureapplications,youcaninstallcapturedapplicationsby launchingthemfromtheirdefaultlocationwithoutconcernforshortpathnames.

18

VMware, Inc.

Introduction to VMware ThinApp

Virtual Services
ThinAppcanbeusedtopackageservicesinavirtualserviceorarealWindowsservice.Virtualservicesrun peruserandrealservicesrunpermachine.

Using Virtual Services

Virtualserviceshavethefollowingfeatures:

Theyarepackagedtogetherwithamainsupportingapplication. Theyrunonapplicationstartup. Theyrunundertheuseraccountthatrunstheapplication. Theycanbestartedandstoppedonlybyvirtualapplicationsinthesamesandbox(visibletothe servicescontrolpanelservicesmanagerwhenyourunfromvirtualcmd.exe). Theydonotrequireinstallationorsystemrelatedchanges.

Bydefault,anyapplicationthatinstallsaserviceautomaticallyusesvirtualservices.WhenyouuseSetup Capturetocaptureanapplicationthatinstallsvirtualservices,nochangesareneededtoyourprojectto runvirtualservices.

Starting Virtual Services

ThinAppusestheregistryvaluescapturedbySetupCapturetodetermineifitshouldautomaticallystart avirtualservicewhenitshostapplicationisexecuted. IftheServiceStartupTypeisAutomatic,ThinAppstartstheserviceautomaticallybeforeexecutingthe hostapplication. IftheServiceStartupTypeisManual,ThinAppdoesnotstarttheserviceuntilahostapplication specificallystartstheserviceusingserviceAPIcalls(OpenServiceorStartService).Topreventa virtualservicefrombeingautomaticallystartedwhenthefirstparentprocessislaunched,youcanusethe AutoStartServicesoption.

Stopping Virtual Services

Virtualservicesthatarestartedduringapplicationstartupareautomaticallyshutdownwhenthelast nonserviceapplicationexits.Youcanforcevirtualservicestocontinuerunninguntiltheuserlogsoff usingtheAutoShutdownServicesoption. Virtualserviceswillcontinuerunninguntilyoulogoutorwhenanapplicationexplicitlytellsaserviceto stop.

Using a Real Windows Service

RealWindowsserviceshavethefollowingfeatures:

Theyarepackagedasaseparatecapturedexecutablefiles. Theyrunonbootup. Theyrunundertheaccountspecifiedbytheservice. Theyaredirectlyvisibletothecontrolpanelservicesmanager. Theycanbestartedandstoppedbyanyapplication. Theyrequireglobalsystemregistrychanges.

VMware, Inc.

19

Introduction to VMware ThinApp

20

VMware, Inc.