Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place.
I am analyzing a Windows security patch. Having never examined a windows security patch, and being unaware of their structure I am trying to figure it out for myself.
In the patch I have (this week's I.E patch) I have these files:
_manifest.cix.xml <- obviously a manifest for the patch. Binary files numbered 0 - 130 Dozens of files with similar names to this: amd64_1d07faac344e137a0d122aad24eb4e6e_31bf3856ad364e35_11.2.9600.17280_none_eaadf6b3ac7d9c33.manifest <- I am assuming that these are architecture specific changes. package_1_for_kb2977629~31bf3856ad364e35~amd64~~22.214.171.124.cat <- A catalog of some sort. Not sure how it's used by the update. package_1_for_kb2977629~31bf3856ad364e35~amd64~~126.96.36.199.mum <- more information about the update.
My question is: Is there comprehensive documentation for how all of these parts work together, if not, how do all of these parts work together?
I imagine, what has to happen is that some mechanism has to tell the update where in the binary to patch, and then one of those files numbered 0-130 is the code to overwrite. I'm sure there is a standard format so that I can interpret these files.
<?xml version="1.0" encoding="utf-8"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0"> <assemblyIdentity name="1d07faac344e137a0d122aad24eb4e6e" version="11.2.9600.17280" processorArchitecture="amd64" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" /> <deployment /> <dependency discoverable="false"> <dependentAssembly dependencyType="install"> <assemblyIdentity name="Microsoft-Windows-IE-MemoryAnalyzer" version="11.2.9600.17280" processorArchitecture="amd64" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" /> </dependentAssembly> </dependency> </assembly>
Would seem to suggest that we are about to patch assembly 1d07faac344e137a0d122aad24eb4e6e which might be named "Microsoft-Windows-IE-MemoryAnalyzer. That's just a guess! I don't see any reference in here to the code to patch. I imagine one way of doing that is to just read through these manifests in order, and apply the patches in the order the manifests are read. First manifest gets binary file 0 and so on. That seems janky, and I bet I'm wrong about that.
Based on the size of the files themselves, I would imagine that they aren't rewriting the whole module, although they might be compressed. Without any reference I haven't a clue as to their structure. I imagine there would be snippets of code, and offsets for where to rewrite the DLLs/Exes in question. Of course I ran strings on the binaries, but didn't find anything.
What I would most like to figure out through this is which particular functions are being patched in IE.