Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

nLite misses a registry entry when integrating KB2641653 (XP x86)

- - - - -

  • Please log in to reply
9 replies to this topic

#1
Explorer09

Explorer09

    Member

  • Members
  • PipPip
  • 175 posts
(I'm not sure if this is a place to file bugs. Please let me know if it is not.)

The KB2641653 update for Windows XP x86 checks this registry value and adds it when it's not present.

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

However, this entry is not brought to the installation CD when I use nLite to slipstream the update. This means the value will be missing in your new installed, nLited Windows.

I have a workaround for this:
1. After slipstreaming with nLite, extract the NLITE.IN_ in your i386 folder (of your installation files).
2. Open the extracted NLITE.INF, and add this line to somewhere in the [T] section
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10
3. Save the file.
4. Compress the file with NLITE.INF cabarc or makecab, replacing the original NLITE.IN_ .
cabarc -m LZX:21 N "I386\NLITE.IN_" "NLITE.INF"

Update (May 2012): The new KB2676562 update replaces KB2641653, but the registry entry "SessionImageSize" is also present in KB2676562. This means the same bug will happen in slipstreaming KB2676562.

Edited by Explorer09, 10 May 2012 - 07:56 AM.



How to remove advertisement from MSFN

#2
-X-

-X-

    Member

  • Patrons
  • 2,321 posts
  • OS:XP Pro x86
  • Country: Country Flag

Donator

Nice find. How did you discover this? The only thing in update_SP3QFE.inf is the regular...

[Product.Add.Reg]
    HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup", "LogLevel", 0x10001, 0
    HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentKeyName",0x00000000,"OperatingSystem"
    HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentDisplayName",0x00000000,"%PARENT_DISPLAY_NAME%"
    HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Installed",0x10001,1
    HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Comments",0,%SP_TITLE%
etc


There is something in [Save.Reg.For.Uninstall]...

[Save.Reg.For.Uninstall]
    HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize"

Windows Update does not ask for the update if the key is removed and mine was set at 18, not 10.

I wonder how it adds it without it being in [Product.Add.Reg]?


My bad. It's further down the inf file...

[win32k.Add.Reg.Session]
    HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Edited by -X-, 12 April 2012 - 01:13 AM.


#3
tomasz86

tomasz86

    www.windows2000.tk

  • Members
  • PipPipPipPipPipPipPipPip
  • 2,497 posts
  • OS:XP Pro x86
  • Country: Country Flag
[win32k.Add.Reg.Session.Declare]

    InstallSection = win32k.Add.Reg.Session

    OperationType = CONDITIONAL_REG

    ExecuteStage = EXECUTE_AFTERINSTALL



[win32k.Add.Reg.Session.Operation]

    AddReg=win32k.Add.Reg.Session



[win32k.Add.Reg.Session]

    HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10



[win32k.Session.ExtendedConditional]

    Condition=OrOp, win32k.Check.SessionImageSize

    ConditionalOperations=win32k.Session.ConditionalOperations



[win32k.Session.ConditionalOperations]

    RegOperation=win32k.Add.Reg.Session.Operation



[win32k.Check.SessionImageSize]

    NotPresentOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001

    LessOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001,"<",0x10


#4
-X-

-X-

    Member

  • Patrons
  • 2,321 posts
  • OS:XP Pro x86
  • Country: Country Flag

Donator

Yeah I was just correcting my post when you were posting that.

Edited by -X-, 12 April 2012 - 02:38 AM.


#5
-X-

-X-

    Member

  • Patrons
  • 2,321 posts
  • OS:XP Pro x86
  • Country: Country Flag

Donator

Here's an add-on that adds the entry to nlite.inf - Removed. New nLite now handles this correctly
Contents...

[general]
builddate=2012/03/13
description=Security Update reg entry
language=English
title=KB2641653 reg entry
version:
website=http://support.microsoft.com/?kbid=2641653

[registry_addreg]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Guess I need to add it to my UCD script. Tomorrow...

Edited by -X-, 02 September 2013 - 10:57 AM.


#6
Explorer09

Explorer09

    Member

  • Members
  • PipPip
  • 175 posts
-X- and tomasz86, thank you both for help. I was too busy yesterday to post the details.

Yes, I was referring to the [win32k.Add.Reg.Session] section. If I read the inf correctly, it adds the entry when the value is not present, or the value is less than 0x10. My freshly-installed Windows doesn't have this value, so it should be added.

#7
-X-

-X-

    Member

  • Patrons
  • 2,321 posts
  • OS:XP Pro x86
  • Country: Country Flag

Donator

How did you discover this? Did Windows Update report the update as still missing for you?

#8
Explorer09

Explorer09

    Member

  • Members
  • PipPip
  • 175 posts

How did you discover this? Did Windows Update report the update as still missing for you?


No it didn't. But I often slipstream updates on my own (without nLite), and I discover this during the process.

(Windows Update have its own problem - there are a few updates that WU cannot detect whether you've installed them correctly. This is one of the cases.)

#9
Explorer09

Explorer09

    Member

  • Members
  • PipPip
  • 175 posts
Speaking of this update.

(http://xdot.tk/updates.html)
WindowsXP-KB2660465-x86-ENU.exe
[Replaced by] 2641653
[Description]Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution


-X-, you have made an error in your Obsolete Update list. It's 2641653 that replaces 2660465, not the other way around.

(Update: there's no error there.)

Edited by Explorer09, 14 April 2012 - 07:52 AM.


#10
submix8c

submix8c

    Inconceivable!

  • Patrons
  • 3,885 posts
  • OS:none specified
  • Country: Country Flag
Yes, I know I'm reviving an old thread...

Went back through -X- lists and downloaded all of the KB's relevant to this problem.

Here is my findings (the problem goes WAAAY back)
:: The -X- nLite CAB "fix" sets SessionImageSize to x10 (16mb) as in the Problem.
:: NOTICE:
:: KB969947 <--Did NOT have the RegEntry!
:: KB979559 (this+above both SP2/SP3) The ORIGINAL culprit (WIN32K.SYS/RegEntry)
:: KB2160329
:: KB981957
:: KB2436673
:: KB2479628
:: KB2506223
:: KB2555917
:: KB2567053
:: KB2639417
:: KB2660465
:: KB2641653 <--First noticed the Problem
::
:: JOINED Several Fixes! (thus causing some confusion)
:: KB2676562 includes Kernels+WIN32K.SYS/RegEntry
:: SPLIT BACK OUT! (thus eliminating the confusion)
:: KB2707511=Kernels
:: KB2709162=WIN32K.SYS/RegEntry
::
:: KB2718523
:: KB2731847
:: KB2731847-v2
:: KB2761226
:: KB2779030
:: KB2778344 <---THIS is the latest!

I should also point out that the following MSFN Topics mention this value "SessionImageSize" -

http://www.msfn.org/...p/page__st__980
Both of you assisted in the above for corrections.

This one refers to nVidia and ATI Drivers and says the Fix is to set the value to "x20" -
http://www.msfn.org/...king-in-xp-x64/
Please note that the above "fix" is also referenced on MSdotCOM for the same types of errors but also indicates after Driver Updates the Problem "goes away". Google
SessionImageSize site:microsoft.com
Also note that according to the above search this Value is a DWORD and is represented as MegaBytes, so the Value you are Forcing may or may not cause certain (limited number of) folks problems. That is APPARENTLY the reason MS was doing the "size test" in the INF file.

More references (including the "representation" link)
RDP to x20 -
http://support.micro....com/kb/2511009 <-Notice THIS one?
OTF to x20 -
http://answers.micro...ef-6e2dca7664c2
http://social.techne...f0-e95090752af9
http://social.micros...6-56d5d0e7bed1/
http://blogs.technet...ed-to-load.aspx

Sorry, but I HAD to post this since I dug into it (manual installs via $OEM$). This MAY help with anyone having grief with the Value being too low (x10 vs x20) for certain ATI/nVidia Card Drivers(?).




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users



How to remove advertisement from MSFN