Explorer09 Posted April 12, 2012 Share Posted April 12, 2012 (edited) (I'm not sure if this is a place to file bugs. Please let me know if it is not.)The KB2641653 update for Windows XP x86 checks this registry value and adds it when it's not present.HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10However, this entry is not brought to the installation CD when I use nLite to slipstream the update. This means the value will be missing in your new installed, nLited Windows.I have a workaround for this:1. After slipstreaming with nLite, extract the NLITE.IN_ in your i386 folder (of your installation files).2. Open the extracted NLITE.INF, and add this line to somewhere in the [T] sectionHKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x103. Save the file.4. Compress the file with NLITE.INF cabarc or makecab, replacing the original NLITE.IN_ .cabarc -m LZX:21 N "I386\NLITE.IN_" "NLITE.INF"Update (May 2012): The new KB2676562 update replaces KB2641653, but the registry entry "SessionImageSize" is also present in KB2676562. This means the same bug will happen in slipstreaming KB2676562. Edited May 10, 2012 by Explorer09 Link to comment Share on other sites More sharing options...
Guest Posted April 12, 2012 Share Posted April 12, 2012 (edited) Nice find. How did you discover this? The only thing in update_SP3QFE.inf is the regular...[Product.Add.Reg] HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Setup", "LogLevel", 0x10001, 0 HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentKeyName",0x00000000,"OperatingSystem" HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%SP_SHORT_TITLE%","ParentDisplayName",0x00000000,"%PARENT_DISPLAY_NAME%" HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Installed",0x10001,1 HKLM,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\%SP_SHORT_TITLE%,"Comments",0,%SP_TITLE%etcThere is something in [save.Reg.For.Uninstall]...[Save.Reg.For.Uninstall] HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize"Windows Update does not ask for the update if the key is removed and mine was set at 18, not 10.I wonder how it adds it without it being in [Product.Add.Reg]?My bad. It's further down the inf file...[win32k.Add.Reg.Session] HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10 Edited April 12, 2012 by -X- Link to comment Share on other sites More sharing options...
tomasz86 Posted April 12, 2012 Share Posted April 12, 2012 [win32k.Add.Reg.Session.Declare] InstallSection = win32k.Add.Reg.Session OperationType = CONDITIONAL_REG ExecuteStage = EXECUTE_AFTERINSTALL[win32k.Add.Reg.Session.Operation] AddReg=win32k.Add.Reg.Session[win32k.Add.Reg.Session] HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10[win32k.Session.ExtendedConditional] Condition=OrOp, win32k.Check.SessionImageSize ConditionalOperations=win32k.Session.ConditionalOperations[win32k.Session.ConditionalOperations] RegOperation=win32k.Add.Reg.Session.Operation[win32k.Check.SessionImageSize] NotPresentOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001 LessOp=CheckReg, HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001,"<",0x10 Link to comment Share on other sites More sharing options...
Guest Posted April 12, 2012 Share Posted April 12, 2012 (edited) Yeah I was just correcting my post when you were posting that. Edited April 12, 2012 by -X- Link to comment Share on other sites More sharing options...
Guest Posted April 12, 2012 Share Posted April 12, 2012 (edited) Here's an add-on that adds the entry to nlite.inf - Removed. New nLite now handles this correctlyContents...[general]builddate=2012/03/13description=Security Update reg entrylanguage=Englishtitle=KB2641653 reg entryversion:website=http://support.microsoft.com/?kbid=2641653[registry_addreg]HKLM, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management", "SessionImageSize", 0x10001, 0x10Guess I need to add it to my UCD script. Tomorrow... Edited September 2, 2013 by -X- Link to comment Share on other sites More sharing options...
Explorer09 Posted April 13, 2012 Author Share Posted April 13, 2012 -X- and tomasz86, thank you both for help. I was too busy yesterday to post the details.Yes, I was referring to the [win32k.Add.Reg.Session] section. If I read the inf correctly, it adds the entry when the value is not present, or the value is less than 0x10. My freshly-installed Windows doesn't have this value, so it should be added. Link to comment Share on other sites More sharing options...
Guest Posted April 13, 2012 Share Posted April 13, 2012 How did you discover this? Did Windows Update report the update as still missing for you? Link to comment Share on other sites More sharing options...
Explorer09 Posted April 13, 2012 Author Share Posted April 13, 2012 How did you discover this? Did Windows Update report the update as still missing for you?No it didn't. But I often slipstream updates on my own (without nLite), and I discover this during the process.(Windows Update have its own problem - there are a few updates that WU cannot detect whether you've installed them correctly. This is one of the cases.) Link to comment Share on other sites More sharing options...
Explorer09 Posted April 14, 2012 Author Share Posted April 14, 2012 (edited) Speaking of this update.(http://xdot.tk/updates.html)WindowsXP-KB2660465-x86-ENU.exe[Replaced by] 2641653[Description]Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution-X-, you have made an error in your Obsolete Update list. It's 2641653 that replaces 2660465, not the other way around.(Update: there's no error there.) Edited April 14, 2012 by Explorer09 Link to comment Share on other sites More sharing options...
submix8c Posted February 23, 2013 Share Posted February 23, 2013 Yes, I know I'm reviving an old thread...Went back through -X- lists and downloaded all of the KB's relevant to this problem.Here is my findings (the problem goes WAAAY back):: The -X- nLite CAB "fix" sets SessionImageSize to x10 (16mb) as in the Problem.:: NOTICE::: KB969947 <--Did NOT have the RegEntry!:: KB979559 (this+above both SP2/SP3) The ORIGINAL culprit (WIN32K.SYS/RegEntry):: KB2160329:: KB981957:: KB2436673:: KB2479628:: KB2506223:: KB2555917:: KB2567053:: KB2639417:: KB2660465:: KB2641653 <--First noticed the Problem:::: JOINED Several Fixes! (thus causing some confusion):: KB2676562 includes Kernels+WIN32K.SYS/RegEntry:: SPLIT BACK OUT! (thus eliminating the confusion):: KB2707511=Kernels:: KB2709162=WIN32K.SYS/RegEntry:::: KB2718523:: KB2731847:: KB2731847-v2:: KB2761226:: KB2779030:: KB2778344 <---THIS is the latest!I should also point out that the following MSFN Topics mention this value "SessionImageSize" -Both of you assisted in the above for corrections.This one refers to nVidia and ATI Drivers and says the Fix is to set the value to "x20" -Please note that the above "fix" is also referenced on MSdotCOM for the same types of errors but also indicates after Driver Updates the Problem "goes away". GoogleSessionImageSize site:microsoft.comAlso note that according to the above search this Value is a DWORD and is represented as MegaBytes, so the Value you are Forcing may or may not cause certain (limited number of) folks problems. That is APPARENTLY the reason MS was doing the "size test" in the INF file.More references (including the "representation" link)RDP to x20 -http://support.microsoft.com/kb/2511009 <-Notice THIS one?OTF to x20 -http://answers.microsoft.com/en-us/windows/forum/windows_xp-desktop/windows-xp-refusing-to-install-open-type-font-otf/ca525c7b-92ab-4ba3-87ef-6e2dca7664c2http://social.technet.microsoft.com/Forums/no/winservercore/thread/d7389f8e-02a2-4d54-9cf0-e95090752af9http://social.microsoft.com/Forums/en-US/whssoftware/thread/99a38f76-87df-43ce-85d6-56d5d0e7bed1/http://blogs.technet.com/b/brad_rutkowski/archive/2008/01/04/systemroot-system32-rdpdd-dll-failed-to-load.aspxSorry, but I HAD to post this since I dug into it (manual installs via $OEM$). This MAY help with anyone having grief with the Value being too low (x10 vs x20) for certain ATI/nVidia Card Drivers(?). Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now