Minimal object containing this commit
Commit Diff
commit f52bafa8d517152eb30f9897bb2a84f8c971742b7ae6cc6bcb9e6b1e1849a2dc
Author: yihanwu1024 <yihanwu1024>
Date: Fri Sep 15 00:00:00 2023 +0000
create memo about Windows servicing stack internals
diff --git a/0237be9edfd303dbdc32df8b793220dcebc362a5d5d67e643337d7081cc8ffcb b/0237be9edfd303dbdc32df8b793220dcebc362a5d5d67e643337d7081cc8ffcb
new file mode 100644
index 0000000..aa68a66
--- /dev/null
+++ b/0237be9edfd303dbdc32df8b793220dcebc362a5d5d67e643337d7081cc8ffcb
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="0237be9edfd303dbdc32df8b793220dcebc362a5d5d67e643337d7081cc8ffcb">
+<title>Component Store (<literal>%SYSTEMROOT%\WinSxS</literal>) and Component Servicing Infrastructure (CSI)</title>
+<para>Component Based Servicing (CBS) was introduced in Windows Vista.
+Utilizing the side-by-side assembly specification from Windows XP, it was not completely built from the ground up.</para>
+<para>The component store consists of <literal>%SYSTEMROOT%\WinSxS</literal> only.
+The registry hive <literal>%SYSTEMROOT%\System32\Config\COMPONENTS</literal> is completely derived from files within <literal>%SYSTEMROOT%\WinSxS</literal> to aid Component Based Servicing.</para>
+<para>The whole Windows installation is made of hard link projections from <literal>%SYSTEMROOT%\WinSxS</literal>.
+The components and hard link projections are manipulated by the Component Servicing Infrastructure (CSI) when required.</para>
+<para>There is no published documentation to work with CSI.
+However, the servicing stack files <literal>wcp.dll</literal> (“Windows Componentization Platform Servicing API”, a major CSI executable) and <literal>turbostack.dll</literal> expose potentially useful APIs.</para>
+</section>
diff --git a/56b01efce3c3ade26bf166ee670d0eeae8d28b0d6126b5e2bb286d22d11b896e b/56b01efce3c3ade26bf166ee670d0eeae8d28b0d6126b5e2bb286d22d11b896e
new file mode 100644
index 0000000..966a973
--- /dev/null
+++ b/56b01efce3c3ade26bf166ee670d0eeae8d28b0d6126b5e2bb286d22d11b896e
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="56b01efce3c3ade26bf166ee670d0eeae8d28b0d6126b5e2bb286d22d11b896e">
+<title>Naïve Approaches</title>
+<para>The Windows operating system has a giant pile of program files.
+Upon naïve examination, one may find the following:</para>
+<itemizedlist>
+<listitem>
+<para>When searching for the name of a system file inside a Windows installation, there are at least two results.
+For example, if you target <literal>%SYSTEMROOT%\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ClockFlyoutExperience.dll</literal> and search for <literal>ClockFlyoutExperience.dll</literal>, you will find at least one other file at <literal>%SYSTEMROOT%\WinSxS\amd64_microsoft-windows-s..ncehost.shellcommon_31bf3856ad364e35_<version>_none_<hash>\ClockFlyoutExperience.dll</literal>.
+They have the same content.
+These extra copies always appear inside the <literal>%SYSTEMROOT%\WinSxS</literal> directory.</para>
+<itemizedlist>
+<listitem>
+<para><literal>microsoft-windows-s..ncehost.shellcommon</literal> appears to be truncated from a longer name.</para>
+</listitem>
+</itemizedlist>
+</listitem>
+<listitem>
+<para>Surprisingly, system directory names, such as <literal>ShellExperienceHost_cw5n1h2txyewy</literal>, will not appear elsewhere in a search, although they will appear as part of the file name in <literal>%SYSTEMROOT%\WinSxS\FileMaps</literal>.</para>
+</listitem>
+<listitem>
+<para>Most files in the Windows installation are owned and only writable by the user <literal>TrustedInstaller</literal>, not any administrator or <literal>SYSTEM</literal>.
+This makes it harder (but not impossible) to modify these files.</para>
+</listitem>
+<listitem>
+<para>When different Windows editions are compared, certain relevant registry entries differ according to their files.
+For example, if you compare installation images of Windows 10 Home 1809 against Windows 10 Enterprise LTSC 2019, you will find the latter missing not only <literal>OneDriveSetup.exe</literal> but also a collection of relevant registry entries.
+This strongly hints at a mechanism for feature management that is not merely file management.</para>
+</listitem>
+</itemizedlist>
+</section>
diff --git a/8dbf053a25e13d7894ded41606b688e6167f56ec88521b2732c95bbe41c949f2 b/8dbf053a25e13d7894ded41606b688e6167f56ec88521b2732c95bbe41c949f2
new file mode 100644
index 0000000..9c1bb46
--- /dev/null
+++ b/8dbf053a25e13d7894ded41606b688e6167f56ec88521b2732c95bbe41c949f2
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="8dbf053a25e13d7894ded41606b688e6167f56ec88521b2732c95bbe41c949f2">
+<title>Manual Package Update on Broken System</title>
+<para>To update only applicable packages contained in an update, i.e.
+excluding broken or missing packages, all non-conflicting MUM files must be added with <literal>DISM /Add-Package</literal>.
+<link xmlns:xlink="http://www.w3.org/1999/xlink" linkend="ref-psfextractor">PSFExtractor</link> may be used to extract those individual packages.</para>
+</section>
diff --git a/bd006d1cea3fe32176769d1cade10804842da617adb265ff6cd7fc7ab0e90046 b/bd006d1cea3fe32176769d1cade10804842da617adb265ff6cd7fc7ab0e90046
new file mode 100644
index 0000000..8c12bb7
--- /dev/null
+++ b/bd006d1cea3fe32176769d1cade10804842da617adb265ff6cd7fc7ab0e90046
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="bd006d1cea3fe32176769d1cade10804842da617adb265ff6cd7fc7ab0e90046">
+<title>Packages</title>
+<para>Packages ship components in a more manageable way.
+Packages refer to components.
+A package has a manifest that is similar to the component manifest, but in plain text XML with a MUM extension.
+They appear to use different parts of the same general schema.
+MUM files are signed via a catalog.</para>
+<para>Package MUM files are stored in <literal>%SYSTEMROOT%\servicing\Packages</literal>.
+Derived data is stored in <literal>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing</literal>.</para>
+<para>Unlike components, packages do not depend on one another but are <emphasis>owned</emphasis> (parented) by one another in a tree structure.
+Owned packages cannot be removed directly unless marked as standalone.
+However, ownership relations are not cryptographically signed in the registry once a package is installed.
+Therefore, with only administrator privilege, any subtree can be removed without breaking the <literal>ScanHealth</literal> integrity of the package tree (but potentially breaking the operating system.)
+This was implemented by install_wim_tweak.exe and CBSEnum, making arbitrary package removal possible.
+These tools simply delete <literal>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\<package>\Owners\*</literal>, and then the package can be removed with DISM.</para>
+</section>
diff --git a/c79231bb3dcf96368df282d3286aecdcd70e8f7c2c79743ea88f68250352e3a0 b/c79231bb3dcf96368df282d3286aecdcd70e8f7c2c79743ea88f68250352e3a0
new file mode 100644
index 0000000..952f5a6
--- /dev/null
+++ b/c79231bb3dcf96368df282d3286aecdcd70e8f7c2c79743ea88f68250352e3a0
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="c79231bb3dcf96368df282d3286aecdcd70e8f7c2c79743ea88f68250352e3a0">
+<title>Components</title>
+<para>The subdirectories of <literal>%SYSTEMROOT%\WinSxS</literal> with extremely long names are part of Windows XP <phrase>side-by-side assemblies</phrase>, or also <phrase>components</phrase> after Vista.
+When a side-by-side assembly is a part of the Windows operating system, it is called a component.
+A component is completely defined by the following parts:</para>
+<itemizedlist>
+<listitem>
+<para>Manifest, located inside <literal>%SYSTEMROOT%\WinSxS\Manifests</literal>.
+Manifests located here are additionally encoded; see <link linkend="ref-sxsexp">SXSEXP</link>.
+The manifest specifies the component’s full name (not truncated), dependencies, the install location and security properties of its files, as well as its registry content.</para>
+</listitem>
+<listitem>
+<para>Files, located inside subdirectories of <literal>%SYSTEMROOT%\WinSxS</literal> with extremely long names.</para>
+<itemizedlist>
+<listitem>
+<para>A side-by-side assembly does not have to contain files.
+You will find certain manifests that do not have a corresponding file directory.
+These manifests may create folders or registry entries.</para>
+</listitem>
+<listitem>
+<para>The manifest specifies the actual install location of the files.</para>
+</listitem>
+</itemizedlist>
+</listitem>
+<listitem>
+<para>Security Catalog, located inside <literal>%SYSTEMROOT%\WinSxS\Catalogs</literal>.
+A side-by-side assembly must be signed via a catalog.</para>
+</listitem>
+</itemizedlist>
+<include xmlns="http://www.w3.org/2001/XInclude" href="0237be9edfd303dbdc32df8b793220dcebc362a5d5d67e643337d7081cc8ffcb"/>
+</section>
diff --git a/d98a2bbb135459f29a9cd32533c68fa699f3871b6091ec2c3e5893a9f92b869f b/d98a2bbb135459f29a9cd32533c68fa699f3871b6091ec2c3e5893a9f92b869f
new file mode 100644
index 0000000..1608fe8
--- /dev/null
+++ b/d98a2bbb135459f29a9cd32533c68fa699f3871b6091ec2c3e5893a9f92b869f
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="d98a2bbb135459f29a9cd32533c68fa699f3871b6091ec2c3e5893a9f92b869f">
+<title>Other Observations</title>
+<itemizedlist>
+<listitem>
+<para>When DISM is used to service an offline image (i.e.
+not the current running system), it will execute the servicing stack inside the offline image.
+This can make debugging easier.</para>
+</listitem>
+<listitem>
+<para><literal>TrustedInstaller</literal> and <literal>TiWorker</literal> are children of <literal>svchost</literal> on the live system.</para>
+</listitem>
+<listitem>
+<para><link xlink:href="https://borncity.com/win/2016/10/21/windows-updates-fehlende-deinstallation-erzwingen/">A breach was achieved in Windows 7</link>, pending modern reproduction.
+It appears from this post that Windows did not verify the MUM signature to uninstall a package.</para>
+</listitem>
+</itemizedlist>
+</section>
diff --git a/eed0346d9f036fdc7a79accfc4695ffc0bebdf7b5f6ca0fd1c8ac88253deaefe b/eed0346d9f036fdc7a79accfc4695ffc0bebdf7b5f6ca0fd1c8ac88253deaefe
new file mode 100644
index 0000000..dfe215c
--- /dev/null
+++ b/eed0346d9f036fdc7a79accfc4695ffc0bebdf7b5f6ca0fd1c8ac88253deaefe
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="eed0346d9f036fdc7a79accfc4695ffc0bebdf7b5f6ca0fd1c8ac88253deaefe">
+<title>Servicing Stack</title>
+<para>The Windows Servicing Stack is the infrastructure used to manage Windows installations.
+Servicing Stack Updates (SSU) cannot be uninstalled.
+A list of servicing stack versions is kept in <literal>HKLM\COMPONENTS\ServicingStackVersions</literal>, and Windows will use the latest version.
+The files for the servicing stack are located in <literal>%SYSTEMROOT%\WinSxS\<arch>_microsoft-windows-servicingstack_31bf3856ad364e35_<version>_none_<hash></literal>.</para>
+<para>Open the Properties :: Details panel to read a Microsoft-supplied description for each Servicing Stack executable.</para>
+</section>
diff --git a/f51326828413eb9be5ef95935b360035c5ed20b7474002b073d1e1423833c69f b/f51326828413eb9be5ef95935b360035c5ed20b7474002b073d1e1423833c69f
new file mode 100644
index 0000000..ddc8a93
--- /dev/null
+++ b/f51326828413eb9be5ef95935b360035c5ed20b7474002b073d1e1423833c69f
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<article xmlns="http://docbook.org/ns/docbook" xml:id="f51326828413eb9be5ef95935b360035c5ed20b7474002b073d1e1423833c69f">
+<title>Windows Servicing Stack Exploration Notes</title>
+<para>There is little documentation around since much of this topic is an internal working of the Windows operating system and not supposed to be publicly documented.</para>
+<include xmlns="http://www.w3.org/2001/XInclude" href="56b01efce3c3ade26bf166ee670d0eeae8d28b0d6126b5e2bb286d22d11b896e"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="eed0346d9f036fdc7a79accfc4695ffc0bebdf7b5f6ca0fd1c8ac88253deaefe"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="c79231bb3dcf96368df282d3286aecdcd70e8f7c2c79743ea88f68250352e3a0"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="f94ca61d0e771e834f5b7efb469eb1b65b0ba51cb6ea7937c5a1c8d86510e898"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="d98a2bbb135459f29a9cd32533c68fa699f3871b6091ec2c3e5893a9f92b869f"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="f8a83981158dc6e798e2424f682ad53333b6a380e352e973b1fc9af76741d88e"/>
+</article>
diff --git a/f8a83981158dc6e798e2424f682ad53333b6a380e352e973b1fc9af76741d88e b/f8a83981158dc6e798e2424f682ad53333b6a380e352e973b1fc9af76741d88e
new file mode 100644
index 0000000..0eebb92
--- /dev/null
+++ b/f8a83981158dc6e798e2424f682ad53333b6a380e352e973b1fc9af76741d88e
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="f8a83981158dc6e798e2424f682ad53333b6a380e352e973b1fc9af76741d88e">
+<title>References</title>
+<para>
+<link xlink:href="https://learn.microsoft.com/en-us/windows/win32/sbscs">Isolated Applications and Side-by-side Assemblies</link>
+</para>
+<para>
+<link xlink:href="https://stackoverflow.com/questions/3348107/can-you-programmatically-interact-with-component-based-servicing-trustedinstall">Can you programmatically interact with Component-Based Servicing (TrustedInstaller)?
+[closed]</link>
+</para>
+<para><link xlink:href="https://web.archive.org/web/20110703083303/http://msdn.microsoft.com/en-us/library/Aa903048.aspx">Component Based Servicing Reference</link> (Outdated and incomplete)</para>
+<para>
+<link xlink:href="https://web.archive.org/web/20080622223410/http://blogs.technet.com/askperf/archive/2008/04/23/understanding-component-based-servicing.aspx">Understanding Component-Based Servicing</link>
+</para>
+<para>
+<link xlink:href="https://web.archive.org/web/20100526063809/http://blogs.technet.com/b/askcore/archive/2008/09/17/what-is-the-winsxs-directory-in-windows-2008-and-windows-vista-and-why-is-it-so-large.aspx">What is the WINSXS directory in Windows 2008 and Windows Vista and why is it so large?</link>
+</para>
+<para>
+<link xlink:href="https://github.com/hfiref0x/SXSEXP">SXSEXP</link>
+</para>
+<para>
+<link xlink:href="https://github.com/Secant1006/PSFExtractor">PSFExtractor</link>
+</para>
+<para>
+<link xlink:href="https://bsodtutorials.wordpress.com/2022/07/26/understanding-dism-servicing-stack-interaction/">Understanding DISM / Servicing Stack Interaction</link>
+</para>
+</section>
diff --git a/f94ca61d0e771e834f5b7efb469eb1b65b0ba51cb6ea7937c5a1c8d86510e898 b/f94ca61d0e771e834f5b7efb469eb1b65b0ba51cb6ea7937c5a1c8d86510e898
new file mode 100644
index 0000000..e5f607d
--- /dev/null
+++ b/f94ca61d0e771e834f5b7efb469eb1b65b0ba51cb6ea7937c5a1c8d86510e898
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="f94ca61d0e771e834f5b7efb469eb1b65b0ba51cb6ea7937c5a1c8d86510e898">
+<title>Component Based Servicing (CBS)</title>
+<para>Component Based Servicing runs as <literal>TrustedInstaller</literal> on the live system.</para>
+<include xmlns="http://www.w3.org/2001/XInclude" href="bd006d1cea3fe32176769d1cade10804842da617adb265ff6cd7fc7ab0e90046"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="ffac38ceaae60a743364805a99a037c89822866716097a0adbecee8374bb26b7"/>
+<include xmlns="http://www.w3.org/2001/XInclude" href="8dbf053a25e13d7894ded41606b688e6167f56ec88521b2732c95bbe41c949f2"/>
+</section>
diff --git a/ffac38ceaae60a743364805a99a037c89822866716097a0adbecee8374bb26b7 b/ffac38ceaae60a743364805a99a037c89822866716097a0adbecee8374bb26b7
new file mode 100644
index 0000000..845aa6c
--- /dev/null
+++ b/ffac38ceaae60a743364805a99a037c89822866716097a0adbecee8374bb26b7
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="ffac38ceaae60a743364805a99a037c89822866716097a0adbecee8374bb26b7">
+<title>Windows Update</title>
+<para>The built-in Windows Update can target any packages or introduce new packages.
+If a broken or missing package is targeted in the update, the update will fail and the whole update will be rolled back, without possibility to install a partial update or fixing the package.</para>
+</section>