Re: PSA: Quick startup on the dedicated Duck.ai LLM/AI WebView2 chat mechanism

Maria Sophia <[email protected]>
Newsgroups alt.comp.os.windows-10,alt.comp.microsoft.windows,alt.comp.os.windows-11
Organization BWH Usenet Archive (https://usenet.blueworldhosting.com)
Message-ID <[email protected]>
Andy Burns wrote:
>> How does a shortcut target that is a 0-length file, actually work?
>> TARGET=C:\Users\...\AppData\Local\Microsoft\WindowsApps\DuckDuckGo.exe
> Does it have any Alternate Data Streams?
> Does a registry search for DuckDuckGo.exe show anything?

Hi Andy,

What I just found out in trying to answer your query, is insane.

It's way too complicated for me to even summarize, as nothing is 
familiar when it comes to where the heck this "thing" resides.

However, to answer your question directly... as far as I can tell, 
there are no alternate data streams attached to those stub EXEs. 

At least these results make ADS an unlikely explanation.

powershell -ExecutionPolicy Bypass -File .\checkforads.ps1

  # -------------------------------------------------------------------
  # checkforads.ps1
  # Auto-discovers DuckDuckGo*.exe under the current user's WindowsApps 
  # folder and then checks for Alternate Data Streams (ADS).
  # -------------------------------------------------------------------
  # v1p0 20260808 Check for Alternate Data Streams on DDG webview thing
  # -------------------------------------------------------------------
  $base = Join-Path $env:LOCALAPPDATA "Microsoft\WindowsApps"
  Write-Host "WindowsApps base: $base"
  Write-Host ""
  
  if (-not (Test-Path $base)) {
    Write-Host "WindowsApps base not found."
    exit 1
  }
  
  $paths = Get-ChildItem $base -Filter "DuckDuckGo*.exe" -Recurse -Force -ErrorAction SilentlyContinue |
           Select-Object -ExpandProperty FullName |
           Sort-Object -Unique
  
  if (-not $paths -or $paths.Count -eq 0) {
    Write-Host "No DuckDuckGo*.exe files found under WindowsApps."
    exit 0
  }
  
  foreach ($p in $paths) {
    Write-Host ""
    Write-Host "== Checking: $p =="
  
    $item = Get-Item -LiteralPath $p -ErrorAction SilentlyContinue
    if (-not $item) { Write-Host "Not found"; continue }
  
    Write-Host ("Length : {0} bytes" -f $item.Length)
  
    $item | ForEach-Object {
      $_.AlternateDataStreams |
        Select-Object Name, Length |
        Format-Table -AutoSize
    }
  }
  
  Write-Host ""
  Write-Host "Done."
  
  # end of checkforads.ps1

This outputs more useful information:
 wmic process where "name like 'DuckDuckGo%%'" get ProcessId,Name,ExecutablePath /format:list

That proves these strange "things" are zero bytes:
 C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\DuckDuckGo.exe (0 bytes)
 C:\Users\<user>\AppData\Local\Microsoft\WindowsApps\DuckDuckGo.DesktopBrowser_... \DuckDuckGo.exe (0 bytes)

But the actual running binaries are these, which are real files 
inside the packaged install:

C:\Program Files\WindowsApps\DuckDuckGo.DesktopBrowser_0.168.2.0_x64__ya2fgkz3nks94\WindowsBrowser\DuckDuckGo.exe
C:\Program Files\WindowsApps\DuckDuckGo.DesktopBrowser_0.168.2.0_x64__ya2fgkz3nks94\WindowsBrowser\DuckDuckGo.WebView.exe

So the 0-byte stub in WindowsApps under the user directory is 
acting like some kind of magical activation launcher/redirect 
and Windows then starts the real packaged components under 
C:\Program Files\WindowsApps\...

Whatever the heck it is, it's a strange beast making use of strange things.
-- 
If you never think how a system works, we'll never understand how it works.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.