I just tried/tested option one (environment variables like SU) ... works a charm and I can provide an exe for you to try ... I still think I prefer the second option though ... even though the first is more basic and SU-like ... I never did like having to (remember) to set those environment variables.

Plus - im not a huge security-freak myself, but my internal security alarm is slightly "buzzing" as i think about this stuff. Much would depend on the command line that you crafted - how "exposed" you would be. And in some case, the only thing that would "save your bacon" is the CRC check.

Plus dont forget, the CRC check is only for the EXE - not for a script you may call. So in some cases, you might be exposed.