5 ms·

When Mark Russinovich did something like this, he got a job offer from Microsoft. Maybe Zeffy has a future on the Windows team?

lightbyte 10y ago
I doubt it, this isn't exactly revolutionary. All he did was modify a dll to return a 1 for the "is_os_supported" function instead of what it used to it.
chris_wot 10y ago
The question is: why would you want put yourself through that level of hell? I don't mean working for Microsoft, that would be pretty amazing! What I mean is, why would anyone want to become a specialist in Windows Update and winsxs technologies? Seriously, it's kludge after kludge. Windows 7 uses the WSUS protocol (which is a hairball set of web services) to figure out which updates it needs to apply - of which it does through recursively querying what base packages are on the system and goes some way to explain the incredibly slow updates people see... but it gets its latest package list and after Microsoft realised they had so many security patches they were releasing they discovered their CAB file format needed to be rearchitected as it could hold enough files... hence WSUSCAN2.CAB now must be downloaded along with something like a third or fourth attempt at getting the windows agent written correctly. But it gets worse, because somehow it must check what it has downloaded in a gigantic (over 1GB) opaque ESE edb file, which it synchronised with the sift are distribution cache in the Windows directory. Here it looks up the Componebt Based Services registry, along with a CONPONENTS hive that only the Windows Update service loads and you generally can't see when you open Regedit. Except that there is a set of keys in the HKLM\Software\Microsoft\CurrentControlSet\Conponebt Based Services - consisting of an ApplicabilityCache, a list of packages, a package index, a set of package detection keys, and a set of componebt detection keys. Once you begin to decipher a current and applicable state, you must work out how it relates to the package index list in the registry, which in turn somehow related to the packages keys, which have their own interesting binary keys that Microsoft set... So once you've worked that out then you need to decipher the manifest files in the Windows Sude by Side system. These are signed with CAT files, abdysuslly have Microsoft Update files that go along with actually payload files. Somehow these relate to a set of session XML files, which are meant to help you troubleshoot when things go wrong and package states go awry. Except the XML format isntvfocumebted except in a few tantalising blogs which aren't in any way complete and some of which seem to becMicrosidt developers reverse engineering the file format themselves... WinSxS itself holds every files ever installed by Windows Uodate in the %systemroot%\winsxs folder, which is a bunch of folders with NTFS hardkinks back to the C:\Windows\system32 files. Microsoft originally wanted to see the state of an installation so they made the decision that when the kinks to newer files were updated they would keep The of files around so they could know the system state and presumably try to allow rolling forwards and backwards o a snapshot of time - they reasoned this was ok because they released the dism.exe took to remove of hitfixee and updates from previous service packs. Unfortunately that switch never got used because the DISM got released in Windows 7 SP1 and sonebody in Mucrosodt decided to go with rolling updates, and no more service packs. Consequently there are often 8 or 9 GBof unneeded and unused files in most Windows 7 systems (depending on the age and how frequently updated the system has been maintained)... and evidently someone st Microsofy realised this because about 4 or 5 months ago they released an update for, or all things, the Windows Disk Cleanup Woizard to remove these old packages. You must run it, then reboot and depending on the amount if packages it removes has been known to have edb ysers stuck in "100% of updates have been installed" for 15 to 45 minutes whilst it cranks through the cleanup process. Of course most end users think there PC has crashed and Windows is "stuck" so they reboot it half way through, to varying results. There are three different tools to check corruption - the sfc utility, the dism utility and a variety of Windows diagnostics that old you can download and that are a bunch of Powershell of VBscriot scripts that attempt to slowly fix the plethora of issues that can prevent Microsoft Update from working. No, kernel reversing engineering is fun, but poking around Windows Update is not. I wouldn't recommend getting hired to untangle it...
- chris_wot 10y ago
  Wow, I got all that out and look at the typos!
  - tunap 10y ago
    Thank you for taking the time, typos & all. I was unaware Disk Cleanup now has the ability to clean that ginormous mess up! Am off to attempt to 'not crash' an old bloated laptop.
- frik 10y ago
  Thank you!
- ch4ck 10y ago
  Disk cleanup wizard WinSXS addon for W7 SP1 was released in October 2013... https://blogs.technet.microsoft.com/askpfeplat/2013/10/08/breaking-news-reduce-the-size-of-the-winsxs-directory-and-free-up-disk-space-with-a-new-update-for-windows-7-sp1-clients/ https://blogs.technet.microsoft.com/askpfeplat/2013/10/08/br...
  - chris_wot 10y ago
    Oh, I stand corrected then!

lightbyte 10y ago

I doubt it, this isn't exactly revolutionary. All he did was modify a dll to return a 1 for the "is_os_supported" function instead of what it used to it.

chris_wot 10y ago

The question is: why would you want put yourself through that level of hell? I don't mean working for Microsoft, that would be pretty amazing! What I mean is, why would anyone want to become a specialist in Windows Update and winsxs technologies? Seriously, it's kludge after kludge. Windows 7 uses the WSUS protocol (which is a hairball set of web services) to figure out which updates it needs to apply - of which it does through recursively querying what base packages are on the system and goes some way to explain the incredibly slow updates people see... but it gets its latest package list and after Microsoft realised they had so many security patches they were releasing they discovered their CAB file format needed to be rearchitected as it could hold enough files... hence WSUSCAN2.CAB now must be downloaded along with something like a third or fourth attempt at getting the windows agent written correctly. But it gets worse, because somehow it must check what it has downloaded in a gigantic (over 1GB) opaque ESE edb file, which it synchronised with the sift are distribution cache in the Windows directory. Here it looks up the Componebt Based Services registry, along with a CONPONENTS hive that only the Windows Update service loads and you generally can't see when you open Regedit. Except that there is a set of keys in the HKLM\Software\Microsoft\CurrentControlSet\Conponebt Based Services - consisting of an ApplicabilityCache, a list of packages, a package index, a set of package detection keys, and a set of componebt detection keys. Once you begin to decipher a current and applicable state, you must work out how it relates to the package index list in the registry, which in turn somehow related to the packages keys, which have their own interesting binary keys that Microsoft set... So once you've worked that out then you need to decipher the manifest files in the Windows Sude by Side system. These are signed with CAT files, abdysuslly have Microsoft Update files that go along with actually payload files. Somehow these relate to a set of session XML files, which are meant to help you troubleshoot when things go wrong and package states go awry. Except the XML format isntvfocumebted except in a few tantalising blogs which aren't in any way complete and some of which seem to becMicrosidt developers reverse engineering the file format themselves... WinSxS itself holds every files ever installed by Windows Uodate in the %systemroot%\winsxs folder, which is a bunch of folders with NTFS hardkinks back to the C:\Windows\system32 files. Microsoft originally wanted to see the state of an installation so they made the decision that when the kinks to newer files were updated they would keep The of files around so they could know the system state and presumably try to allow rolling forwards and backwards o a snapshot of time - they reasoned this was ok because they released the dism.exe took to remove of hitfixee and updates from previous service packs. Unfortunately that switch never got used because the DISM got released in Windows 7 SP1 and sonebody in Mucrosodt decided to go with rolling updates, and no more service packs. Consequently there are often 8 or 9 GBof unneeded and unused files in most Windows 7 systems (depending on the age and how frequently updated the system has been maintained)... and evidently someone st Microsofy realised this because about 4 or 5 months ago they released an update for, or all things, the Windows Disk Cleanup Woizard to remove these old packages. You must run it, then reboot and depending on the amount if packages it removes has been known to have edb ysers stuck in "100% of updates have been installed" for 15 to 45 minutes whilst it cranks through the cleanup process. Of course most end users think there PC has crashed and Windows is "stuck" so they reboot it half way through, to varying results. There are three different tools to check corruption - the sfc utility, the dism utility and a variety of Windows diagnostics that old you can download and that are a bunch of Powershell of VBscriot scripts that attempt to slowly fix the plethora of issues that can prevent Microsoft Update from working. No, kernel reversing engineering is fun, but poking around Windows Update is not. I wouldn't recommend getting hired to untangle it...

chris_wot 10y ago
Wow, I got all that out and look at the typos!
- tunap 10y ago
  Thank you for taking the time, typos & all. I was unaware Disk Cleanup now has the ability to clean that ginormous mess up! Am off to attempt to 'not crash' an old bloated laptop.
frik 10y ago
Thank you!
ch4ck 10y ago
Disk cleanup wizard WinSXS addon for W7 SP1 was released in October 2013... https://blogs.technet.microsoft.com/askpfeplat/2013/10/08/breaking-news-reduce-the-size-of-the-winsxs-directory-and-free-up-disk-space-with-a-new-update-for-windows-7-sp1-clients/ https://blogs.technet.microsoft.com/askpfeplat/2013/10/08/br...
- chris_wot 10y ago
  Oh, I stand corrected then!