Welcome to MSFN

Register now to gain access to all of our features. Once registered and logged in, you will be able to contribute to this site by submitting your own content or replying to existing content. You'll be able to customize your profile, receive reputation points as a reward for submitting content, while also communicating with other members via your own private inbox, plus much more! This message will be removed once you have signed in.


Explorer09

nLite misses a registry entry when integrating KB2641653 (XP x86)

10 posts in this topic

(I'm not sure if this is a place to file bugs. Please let me know if it is not.)

The KB2641653 update for Windows XP x86 checks this registry value and adds it when it's not present.

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

However, this entry is not brought to the installation CD when I use nLite to slipstream the update. This means the value will be missing in your new installed, nLited Windows.

I have a workaround for this:

1. After slipstreaming with nLite, extract the NLITE.IN_ in your i386 folder (of your installation files).

2. Open the extracted NLITE.INF, and add this line to somewhere in the [T] section

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

3. Save the file.

4. Compress the file with NLITE.INF cabarc or makecab, replacing the original NLITE.IN_ .

cabarc -m LZX:21 N "I386\NLITE.IN_" "NLITE.INF"

Update (May 2012): The new KB2676562 update replaces KB2641653, but the registry entry "SessionImageSize" is also present in KB2676562. This means the same bug will happen in slipstreaming KB2676562.

Edited by Explorer09
0

Share this post


Link to post
Share on other sites

Nice find. How did you discover this? The only thing in update_SP3QFE.inf is the regular...

[Product.Add.Reg]
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup", "LogLevel", 0x10001, 0
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentKeyName",0x00000000,"OperatingSystem"
HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentDisplayName",0x00000000,"%PARENT_DISPLAY_NAME%"
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Installed",0x10001,1
HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Comments",0,%SP_TITLE%
etc

There is something in [save.Reg.For.Uninstall]...

[Save.Reg.For.Uninstall]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize"

Windows Update does not ask for the update if the key is removed and mine was set at 18, not 10.

I wonder how it adds it without it being in [Product.Add.Reg]?

My bad. It's further down the inf file...

[win32k.Add.Reg.Session]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Edited by -X-
0

Share this post


Link to post
Share on other sites
[win32k.Add.Reg.Session.Declare]
InstallSection = win32k.Add.Reg.Session
OperationType = CONDITIONAL_REG
ExecuteStage = EXECUTE_AFTERINSTALL

[win32k.Add.Reg.Session.Operation]
AddReg=win32k.Add.Reg.Session

[win32k.Add.Reg.Session]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

[win32k.Session.ExtendedConditional]
Condition=OrOp, win32k.Check.SessionImageSize
ConditionalOperations=win32k.Session.ConditionalOperations

[win32k.Session.ConditionalOperations]
RegOperation=win32k.Add.Reg.Session.Operation

[win32k.Check.SessionImageSize]
NotPresentOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001
LessOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001,"<",0x10

0

Share this post


Link to post
Share on other sites

Yeah I was just correcting my post when you were posting that.

Edited by -X-
0

Share this post


Link to post
Share on other sites

Here's an add-on that adds the entry to nlite.inf - Removed. New nLite now handles this correctly
Contents...

[general]builddate=2012/03/13description=Security Update reg entrylanguage=Englishtitle=KB2641653 reg entryversion:website=http://support.microsoft.com/?kbid=2641653[registry_addreg]HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Guess I need to add it to my UCD script. Tomorrow... Edited by -X-
0

Share this post


Link to post
Share on other sites

-X- and tomasz86, thank you both for help. I was too busy yesterday to post the details.

Yes, I was referring to the [win32k.Add.Reg.Session] section. If I read the inf correctly, it adds the entry when the value is not present, or the value is less than 0x10. My freshly-installed Windows doesn't have this value, so it should be added.

0

Share this post


Link to post
Share on other sites

How did you discover this? Did Windows Update report the update as still missing for you?

0

Share this post


Link to post
Share on other sites

How did you discover this? Did Windows Update report the update as still missing for you?

No it didn't. But I often slipstream updates on my own (without nLite), and I discover this during the process.

(Windows Update have its own problem - there are a few updates that WU cannot detect whether you've installed them correctly. This is one of the cases.)

0

Share this post


Link to post
Share on other sites

Speaking of this update.

(http://xdot.tk/updates.html)

WindowsXP-KB2660465-x86-ENU.exe

[Replaced by] 2641653

[Description]Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution

-X-, you have made an error in your Obsolete Update list. It's 2641653 that replaces 2660465, not the other way around.

(Update: there's no error there.)

Edited by Explorer09
0

Share this post


Link to post
Share on other sites

Yes, I know I'm reviving an old thread...

Went back through -X- lists and downloaded all of the KB's relevant to this problem.

Here is my findings (the problem goes WAAAY back)

:: The -X- nLite CAB "fix" sets SessionImageSize to x10 (16mb) as in the Problem.

:: NOTICE:

:: KB969947 <--Did NOT have the RegEntry!

:: KB979559 (this+above both SP2/SP3) The ORIGINAL culprit (WIN32K.SYS/RegEntry)

:: KB2160329

:: KB981957

:: KB2436673

:: KB2479628

:: KB2506223

:: KB2555917

:: KB2567053

:: KB2639417

:: KB2660465

:: KB2641653 <--First noticed the Problem

::

:: JOINED Several Fixes! (thus causing some confusion)

:: KB2676562 includes Kernels+WIN32K.SYS/RegEntry

:: SPLIT BACK OUT! (thus eliminating the confusion)

:: KB2707511=Kernels

:: KB2709162=WIN32K.SYS/RegEntry

::

:: KB2718523

:: KB2731847

:: KB2731847-v2

:: KB2761226

:: KB2779030

:: KB2778344 <---THIS is the latest!

I should also point out that the following MSFN Topics mention this value "SessionImageSize" -

Both of you assisted in the above for corrections.

This one refers to nVidia and ATI Drivers and says the Fix is to set the value to "x20" -

Please note that the above "fix" is also referenced on MSdotCOM for the same types of errors but also indicates after Driver Updates the Problem "goes away". Google

SessionImageSize site:microsoft.com

Also note that according to the above search this Value is a DWORD and is represented as MegaBytes, so the Value you are Forcing may or may not cause certain (limited number of) folks problems. That is APPARENTLY the reason MS was doing the "size test" in the INF file.

More references (including the "representation" link)

RDP to x20 -

http://support.microsoft.com/kb/2511009 <-Notice THIS one?

OTF to x20 -

http://answers.microsoft.com/en-us/windows/forum/windows_xp-desktop/windows-xp-refusing-to-install-open-type-font-otf/ca525c7b-92ab-4ba3-87ef-6e2dca7664c2

http://social.technet.microsoft.com/Forums/no/winservercore/thread/d7389f8e-02a2-4d54-9cf0-e95090752af9

http://social.microsoft.com/Forums/en-US/whssoftware/thread/99a38f76-87df-43ce-85d6-56d5d0e7bed1/

http://blogs.technet.com/b/brad_rutkowski/archive/2008/01/04/systemroot-system32-rdpdd-dll-failed-to-load.aspx

Sorry, but I HAD to post this since I dug into it (manual installs via $OEM$). This MAY help with anyone having grief with the Value being too low (x10 vs x20) for certain ATI/nVidia Card Drivers(?).

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.