[Explorer09]

(I'm not sure if this is a place to file bugs. Please let me know if it is not.)

The KB2641653 update for Windows XP x86 checks this registry value and adds it when it's not present.

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

However, this entry is not brought to the installation CD when I use nLite to slipstream the update. This means the value will be missing in your new installed, nLited Windows.

I have a workaround for this:
1. After slipstreaming with nLite, extract the NLITE.IN_ in your i386 folder (of your installation files).
2. Open the extracted NLITE.INF, and add this line to somewhere in the [T] section

HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

3. Save the file.
4. Compress the file with NLITE.INF cabarc or makecab, replacing the original NLITE.IN_ .

cabarc -m LZX:21 N "I386\NLITE.IN_" "NLITE.INF"

Update (May 2012): The new KB2676562 update replaces KB2641653, but the registry entry "SessionImageSize" is also present in KB2676562. This means the same bug will happen in slipstreaming KB2676562.

This post has been edited by Explorer09: 10 May 2012 - 07:56 AM

[-X-]

Nice find. How did you discover this? The only thing in update_SP3QFE.inf is the regular...

[Product.Add.Reg]
    HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup", "LogLevel", 0x10001, 0
    HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentKeyName",0x00000000,"OperatingSystem"
    HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentDisplayName",0x00000000,"%PARENT_DISPLAY_NAME%"
    HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Installed",0x10001,1
    HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Comments",0,%SP_TITLE%
etc

There is something in [Save.Reg.For.Uninstall]...

[Save.Reg.For.Uninstall]
    HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize"

Windows Update does not ask for the update if the key is removed and mine was set at 18, not 10.

I wonder how it adds it without it being in [Product.Add.Reg]?


My bad. It's further down the inf file...

[win32k.Add.Reg.Session]
    HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

This post has been edited by -X-: 12 April 2012 - 01:13 AM

[tomasz86]

[win32k.Add.Reg.Session.Declare]
    InstallSection = win32k.Add.Reg.Session
    OperationType = CONDITIONAL_REG
    ExecuteStage = EXECUTE_AFTERINSTALL

[win32k.Add.Reg.Session.Operation]
    AddReg=win32k.Add.Reg.Session

[win32k.Add.Reg.Session]
    HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

[win32k.Session.ExtendedConditional]
    Condition=OrOp, win32k.Check.SessionImageSize
    ConditionalOperations=win32k.Session.ConditionalOperations

[win32k.Session.ConditionalOperations]
    RegOperation=win32k.Add.Reg.Session.Operation

[win32k.Check.SessionImageSize]
    NotPresentOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001
    LessOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001,"<",0x10

[-X-]

Yeah I was just correcting my post when you were posting that.

This post has been edited by -X-: 12 April 2012 - 02:38 AM

[-X-]

Here's an add-on that adds the entry to nlite.inf - http://www.mediafire.com/?z1nymzymytn

Contents...

[general]
builddate=2012/03/13
description=Security Update reg entry
language=English
title=KB2641653 reg entry
version:
website=http://support.microsoft.com/?kbid=2641653

[registry_addreg]
HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10

Guess I need to add it to my UCD script. Tomorrow...

[Explorer09]

-X- and tomasz86, thank you both for help. I was too busy yesterday to post the details.

Yes, I was referring to the [win32k.Add.Reg.Session] section. If I read the inf correctly, it adds the entry when the value is not present, or the value is less than 0x10. My freshly-installed Windows doesn't have this value, so it should be added.

[-X-]

How did you discover this? Did Windows Update report the update as still missing for you?

[Explorer09]

-X-, on 13 April 2012 - 02:41 AM, said:

How did you discover this? Did Windows Update report the update as still missing for you?

No it didn't. But I often slipstream updates on my own (without nLite), and I discover this during the process.

(Windows Update have its own problem - there are a few updates that WU cannot detect whether you've installed them correctly. This is one of the cases.)

[Explorer09]

Speaking of this update.

Quote

(http://xdot.tk/updates.html)
WindowsXP-KB2660465-x86-ENU.exe
[Replaced by] 2641653
[Description]Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution

-X-, you have made an error in your Obsolete Update list. It's 2641653 that replaces 2660465, not the other way around.

(Update: there's no error there.)

This post has been edited by Explorer09: 14 April 2012 - 07:52 AM

[submix8c]

Yes, I know I'm reviving an old thread...

Went back through -X- lists and downloaded all of the KB's relevant to this problem.

Here is my findings (the problem goes WAAAY back)
:: The -X- nLite CAB "fix" sets SessionImageSize to x10 (16mb) as in the Problem.
:: NOTICE:
:: KB969947 <--Did NOT have the RegEntry!
:: KB979559 (this+above both SP2/SP3) The ORIGINAL culprit (WIN32K.SYS/RegEntry)
:: KB2160329
:: KB981957
:: KB2436673
:: KB2479628
:: KB2506223
:: KB2555917
:: KB2567053
:: KB2639417
:: KB2660465
:: KB2641653 <--First noticed the Problem
::
:: JOINED Several Fixes! (thus causing some confusion)
:: KB2676562 includes Kernels+WIN32K.SYS/RegEntry
:: SPLIT BACK OUT! (thus eliminating the confusion)
:: KB2707511=Kernels
:: KB2709162=WIN32K.SYS/RegEntry
::
:: KB2718523
:: KB2731847
:: KB2731847-v2
:: KB2761226
:: KB2779030
:: KB2778344 <---THIS is the latest!

I should also point out that the following MSFN Topics mention this value "SessionImageSize" -

http://www.msfn.org/...p/page__st__980
Both of you assisted in the above for corrections.

This one refers to nVidia and ATI Drivers and says the Fix is to set the value to "x20" -
http://www.msfn.org/...king-in-xp-x64/
Please note that the above "fix" is also referenced on MSdotCOM for the same types of errors but also indicates after Driver Updates the Problem "goes away". Google

SessionImageSize site:microsoft.com

Also note that according to the above search this Value is a DWORD and is represented as MegaBytes, so the Value you are Forcing may or may not cause certain (limited number of) folks problems. That is APPARENTLY the reason MS was doing the "size test" in the INF file.

More references (including the "representation" link)
RDP to x20 -
http://support.micro....com/kb/2511009 <-Notice THIS one?
OTF to x20 -
http://answers.micro...ef-6e2dca7664c2
http://social.techne...f0-e95090752af9
http://social.micros...6-56d5d0e7bed1/
http://blogs.technet...ed-to-load.aspx

Sorry, but I HAD to post this since I dug into it (manual installs via $OEM$). This MAY help with anyone having grief with the Value being too low (x10 vs x20) for certain ATI/nVidia Card Drivers(?).