RE: Hfnetchk scans every file

From: M. Burnett (mb@xato.net)
Date: 05/22/02


From: "M. Burnett" <mb@xato.net>
To: <darrydoo@aci.on.ca>, "'Greene, Michael'" <MGreene@lrs.com>, "'Dennis M. Depp'" <dwd@ornl.gov>
Date: Wed, 22 May 2002 12:48:53 -0600


>You've got it right -- manual installs are cached locally in
>%SYSTEMROOT%\SERVICEPACKFILES, as discussed in Q274215. However,
>some components of CD or network (or slipstreamed, for that matter)
>installs, specifically drivers, are cached locally, in the SPx.CAB
>files. So, with a CD install, or a network install where the source
>isn't available, new drivers (anything done through Windows Setup or
>Control Panel, in other words) should install without source.
>So, technically, there are times where SP files aren't locally
>cached...
>but one could use HfNetChk to catch those hopefully rare occasions.

You are partially correct on this. What you said is true for
drivers, but not for components such as IIS. Here's a quick
explanation:

The file locations depend on how you install the service pack and
which file you are talking about. When a service pack is
slipstreamed, most files become part of the source installation. One
exception, as you mentioned, is with drivers.

Normally, drivers are stored in drivers.cab, but SP2 adds updated
drivers. Since the cAB files are digitally signed, SP2 cannot just
update the CAB. Instead, it adds a new CAB file, SP2.cab, and updates
layout.inf to point to that when a newer driver is available.

In the case of IIS, SMTP, and NNTP services, there are other cab
files: iis.cab, ims.cab, and ins.cab. If there is a newer file added
with SP2, it puts the file either in the servicepackfiles directory
or, if slipstreamed, in the original i386 directory and updates the
appropriate INF files with the new location.

If you look in the [SourceDisksNames] section of iis.inf, you will
see the following:

0="%SOURCEDISKSNAMES_DESC%","",0
4="%SP_SOURCEDISKSNAMES_DESC%","",0
1="%SOURCEDISKSNAMES_DESC%","iis5_01.cab",0
2="%SOURCEDISKSNAMES_DESC%","iis5_02.cab",0
3="%SOURCEDISKSNAMES_DESC%","iis5_03.cab",0

Depending on how you installed the service pack, these lines may
vary. For example, you may see something like this:

0="%SERVICEPACK_DESC%","\cdromsp2.tst",0,%34000%,1

If you do see this, when a file (in the [SourceDisksFiles] section)
points to Disk ID 0, it will look for the disk that contains the file
"cdromsp2.txt" in the root directory or it will look in the
servicepackfiles directory on your hard drive, depending on the value
of the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Ser
vicePackSourcePath registry key. If it cannot find either, it will
prompt for the disk or location.

If that second field is blank, it will look at the normal i386 source
directory. If that field contains a cab file name, it will look in
that cab file. Again, if it cannot find either, it will prompt.

So if you install a post-sp2 hotfix and do not want the files
replaced, you simply create a directory for all the hotfix files and
point the appropriate INF file to that directory. Whenever you add or
reinstall components, the newest file will always be used.

As a side note, the KB article Q293723 talks a bit about installing
hotfixes with a service pack, but the procedure mentioned there will
not work because it does not address files that are located in CABs.

Mark Burnett
IIS Security Consultant
www.xato.net



Relevant Pages

  • Re: Reinstalled Win XP SP2 and ONLY boots to SAFE MODE
    ... Disabled sound drivers. ... Download and install SP3. ... "Windows Live" ones for now. ... Windows XP Service Pack 3 - ISO-9660 CD Image File ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: old xp home computers
    ... > clean install ....i hope. ... utilities on the Internet for the type of BIOS you have. ... You also have hardware on your machine that requires drivers to interface ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Format Fdsik XP
    ... you can install it first thing. ... patch/install the drivers you prepared with earlier. ... network drivers and finally your video card drivers. ... of the hardware drivers from here - always go to the actual manufacturers ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Problems using command format c:
    ... you can install it first thing. ... patch/install the drivers you prepared with earlier. ... network drivers and finally your video card drivers. ... of the hardware drivers from here - always go to the actual manufacturers ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: 0x0000007B
    ... Pro install should have reconized the USB flash disk as a removable device. ... The two devices which Intel provided drivers for do end up with question ...
    (microsoft.public.windowsxp.embedded)