I think there are some people in this forum who wonder how nLite slipstream updates. (such as these people) Personally I don't use nLite much. I prefer slipstreaming the updates myself rather than using such tool (just because I cannot trust the latter). However I did some experiments with nLite and I can share what I found here. My OS is Windows XP Professional SP3 (x86). I only tried the "Hotfixes, Add-ons and Update Packs" feature, which I'm interested in the most. Then I use Process Monitor and file difference tools to track nLite's actions. Here is the result - how nLite slipstream (regular) Windows XP updates. (Please note that there might be errors in the info below.) 1. Extracting the update contents nLite extracts all update packages by running this command with each package: "windowsxp-kbXXXXXX-x86-enu.exe" -q /X:"%CDPath%\hottemp" (Assume %CDPath% is the path to your Windows installation CD files, and your Windows XP is English version.) Then, nLite will check whether it is possible to use steps 2 to 4 below to integrate the update. In a few cases, nLite will say it cannot and asks user if he wants to use the regular integration methods. The "regular integration methods" provided by nLite is actually running this command: "windowsxp-kbXXXXXX-x86-enu.exe" -q /integrate:"%CDPath%" 2. Extracting the cabinets For some updates, it is necessary to extract the cabinets. nLite first tests them using 7-zip: 7z.exe t I386\%cab_file_to_extract%.cab Then they are extracted internally. nLite seems to invoke functions in the library called cabinet.dll. Extracted contents of DRIVER.CAB is stored in "%CDPath%\drivertmp". Extracted contents of SP3.CAB is stored in "%CDPath%\sp3tmp". 3. Replacing patched files nLite picks the files of the SP3QFE branch only. GDR branches are generally ignored. For each patched files, nLite looks up the files of the same name in I386 folder or the temp folders in previous step, extract it and compare the versions. nLite gives a warning when the version of CD files is newer than the patch, and asks user whether to replace the files. 4. Creating the registry patch file - nLite.inf The registry changes in each update can be found in the [Product.Add.Reg] section of the "update_SP3QFE.inf" file. nLite reads this and stores the registry entries in nLite.inf. (Unfortunately this causes a bug, see this thread.) nLite.inf is meant to be installed at the same time when Windows installs optional components. nLite.inf and nHelper.exe are compressed and copied to the CD. (NLITE.IN_ and NHELPER.EX_) 5. Updating INF files These files are changed by nLite (in chronological order): HIVECLS.INF (Only optimizes the file. No entries are added or removed.) HIVEUSD.INF (Only optimizes the file. No entries are added or removed.) SVCPACK.INF (Adds the catalog files to be installed.) NLITE.INF SYSOC.INF (Adds this entry, then optimizes.) [Components] nLite = ocgen.dll,OcEntry,nLite.inf,HIDE,7 6. Compressing cabinets DRIVER.CAB and SP3.CAB are re-compressed by nLite. (This takes a REALLY long time on my computer.) 7. Updating INF files again FONT.INF (Only optimizes the file. No entries are added or removed.) HIVESYS.INF (Only optimizes the file. No entries are added or removed.) INTL.INF (Only optimizes the file. No entries are added or removed.) WBEMOC.INF (Two entries are commented out by nLite, I don't know the reason.) [WBEM.CopyMOFs] ;napclientprov.mof ;napclientschema.mof TXTSETUP.SIF - nLite did three things here. First, in [FileFlags] section, some additional file flags are added. Second nLite adds these two entries in the [sourceDisksFiles] section: [SourceDisksFiles] nhelper.exe = 1,,,,,,,2,0,0 nlite.inf = 1,,,,,,,20,0,0 Third, the TXTSETUP.SIF file is opimized. DOSNET.INF (Adds these entries, then optimizes.) [Files] d1,nhelper.exe d1,nlite.inf [OptionalSrcDirs] svcpack HIVEDEF.INF (Only optimizes the file. No entries are added or removed.) HIVESFT.INF (Adds this entry, then optimizes.) [AddReg] HKLM,"SOFTWARE\Microsoft\Driver Signing","Policy",0x00000001,0 SVCPACK\HFINT.DAT (Only updates that are done using "regular integration methods" will have entries here.) 8. nLite deletes the file "nl_proc.log" in I386 folder. "nl_proc.log" is a temporary file that is used to indicate an unfinished nLite session. ----