Jump to content

nLite misses a registry entry when integrating KB2641653 (XP x86)


Explorer09

Recommended Posts

(I'm not sure if this is a place to file bugs. Please let me know if it is not.)

The KB2641653 update for Windows XP x86 checks this registry value and adds it when it's not present.

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

However, this entry is not brought to the installation CD when I use nLite to slipstream the update. This means the value will be missing in your new installed, nLited Windows.

I have a workaround for this:

1. After slipstreaming with nLite, extract the NLITE.IN_ in your i386 folder (of your installation files).

2. Open the extracted NLITE.INF, and add this line to somewhere in the [T] section

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

3. Save the file.

4. Compress the file with NLITE.INF cabarc or makecab, replacing the original NLITE.IN_ .

cabarc -m LZX:21 N "I386\NLITE.IN_" "NLITE.INF"

Update (May 2012): The new KB2676562 update replaces KB2641653, but the registry entry "SessionImageSize" is also present in KB2676562. This means the same bug will happen in slipstreaming KB2676562.

Edited by Explorer09
Link to comment
Share on other sites


Nice find. How did you discover this? The only thing in update_SP3QFE.inf is the regular...

[Product.Add.Reg]
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup", "LogLevel", 0x10001, 0
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentKeyName",0x00000000,"OperatingSystem"
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentDisplayName",0x00000000,"%PARENT_DISPLAY_NAME%"
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Installed",0x10001,1
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Comments",0,%SP_TITLE%
etc

There is something in [save.Reg.For.Uninstall]...

[Save.Reg.For.Uninstall]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize"

Windows Update does not ask for the update if the key is removed and mine was set at 18, not 10.

I wonder how it adds it without it being in [Product.Add.Reg]?

My bad. It's further down the inf file...

[win32k.Add.Reg.Session]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Edited by -X-
Link to comment
Share on other sites

[win32k.Add.Reg.Session.Declare]
InstallSection = win32k.Add.Reg.Session
OperationType = CONDITIONAL_REG
ExecuteStage = EXECUTE_AFTERINSTALL

[win32k.Add.Reg.Session.Operation]
AddReg=win32k.Add.Reg.Session

[win32k.Add.Reg.Session]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

[win32k.Session.ExtendedConditional]
Condition=OrOp, win32k.Check.SessionImageSize
ConditionalOperations=win32k.Session.ConditionalOperations

[win32k.Session.ConditionalOperations]
RegOperation=win32k.Add.Reg.Session.Operation

[win32k.Check.SessionImageSize]
NotPresentOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001
LessOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001,"<",0x10

Link to comment
Share on other sites

Here's an add-on that adds the entry to nlite.inf - Removed. New nLite now handles this correctly
Contents...

[general]builddate=2012/03/13description=Security Update reg entrylanguage=Englishtitle=KB2641653 reg entryversion:website=http://support.microsoft.com/?kbid=2641653[registry_addreg]HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Guess I need to add it to my UCD script. Tomorrow... Edited by -X-
Link to comment
Share on other sites

-X- and tomasz86, thank you both for help. I was too busy yesterday to post the details.

Yes, I was referring to the [win32k.Add.Reg.Session] section. If I read the inf correctly, it adds the entry when the value is not present, or the value is less than 0x10. My freshly-installed Windows doesn't have this value, so it should be added.

Link to comment
Share on other sites

How did you discover this? Did Windows Update report the update as still missing for you?

No it didn't. But I often slipstream updates on my own (without nLite), and I discover this during the process.

(Windows Update have its own problem - there are a few updates that WU cannot detect whether you've installed them correctly. This is one of the cases.)

Link to comment
Share on other sites

Speaking of this update.

(http://xdot.tk/updates.html)

WindowsXP-KB2660465-x86-ENU.exe

[Replaced by] 2641653

[Description]Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution

-X-, you have made an error in your Obsolete Update list. It's 2641653 that replaces 2660465, not the other way around.

(Update: there's no error there.)

Edited by Explorer09
Link to comment
Share on other sites

  • 10 months later...

Yes, I know I'm reviving an old thread...

Went back through -X- lists and downloaded all of the KB's relevant to this problem.

Here is my findings (the problem goes WAAAY back)

:: The -X- nLite CAB "fix" sets SessionImageSize to x10 (16mb) as in the Problem.

:: NOTICE:

:: KB969947 <--Did NOT have the RegEntry!

:: KB979559 (this+above both SP2/SP3) The ORIGINAL culprit (WIN32K.SYS/RegEntry)

:: KB2160329

:: KB981957

:: KB2436673

:: KB2479628

:: KB2506223

:: KB2555917

:: KB2567053

:: KB2639417

:: KB2660465

:: KB2641653 <--First noticed the Problem

::

:: JOINED Several Fixes! (thus causing some confusion)

:: KB2676562 includes Kernels+WIN32K.SYS/RegEntry

:: SPLIT BACK OUT! (thus eliminating the confusion)

:: KB2707511=Kernels

:: KB2709162=WIN32K.SYS/RegEntry

::

:: KB2718523

:: KB2731847

:: KB2731847-v2

:: KB2761226

:: KB2779030

:: KB2778344 <---THIS is the latest!

I should also point out that the following MSFN Topics mention this value "SessionImageSize" -

Both of you assisted in the above for corrections.

This one refers to nVidia and ATI Drivers and says the Fix is to set the value to "x20" -

Please note that the above "fix" is also referenced on MSdotCOM for the same types of errors but also indicates after Driver Updates the Problem "goes away". Google

SessionImageSize site:microsoft.com

Also note that according to the above search this Value is a DWORD and is represented as MegaBytes, so the Value you are Forcing may or may not cause certain (limited number of) folks problems. That is APPARENTLY the reason MS was doing the "size test" in the INF file.

More references (including the "representation" link)

RDP to x20 -

http://support.microsoft.com/kb/2511009 <-Notice THIS one?

OTF to x20 -

http://answers.microsoft.com/en-us/windows/forum/windows_xp-desktop/windows-xp-refusing-to-install-open-type-font-otf/ca525c7b-92ab-4ba3-87ef-6e2dca7664c2

http://social.technet.microsoft.com/Forums/no/winservercore/thread/d7389f8e-02a2-4d54-9cf0-e95090752af9

http://social.microsoft.com/Forums/en-US/whssoftware/thread/99a38f76-87df-43ce-85d6-56d5d0e7bed1/

http://blogs.technet.com/b/brad_rutkowski/archive/2008/01/04/systemroot-system32-rdpdd-dll-failed-to-load.aspx

Sorry, but I HAD to post this since I dug into it (manual installs via $OEM$). This MAY help with anyone having grief with the Value being too low (x10 vs x20) for certain ATI/nVidia Card Drivers(?).

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...