I am looking into Microsoft Windows updates, and how they are applied, after extracting the .msu file, we get some .cab files with patches (in PA30 format), and informations on the file attributes, paths and so on. Forward and reverse patches are applied to the files present on the Windows installation.

My question: How does Windows determine if a patch is compatible with a file, say we have something like:

<File id="19562" name="amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22621.963_none_ce32ec967d51ffce\f\ntoskrnl.exe" length="524644" time="133144997320000000" attr="128">
  <Hash alg="SHA256" value="62FA6AAD80E7856024D55B0020585E3B1543FF48240EA825A3F3942C05A0DEE1" />
    <Source type="RAW" offset="127071210" length="524644">
      <Hash alg="SHA256" value="62FA6AAD80E7856024D55B0020585E3B1543FF48240EA825A3F3942C05A0DEE1" />

From the .psf file, the delta is the part highlighted in yellow (first 4 bytes should be a CRC32, what follows is the actual patch):


Is there any way to retrieve the file ntoskrnl.exe that the patch should be applied on? How does Windows Updates ensure that it's applying patches on the right versions of the files? (I wasn't able to find a digest of the files before patches are applied)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.