Missing DllCache folder / a flaw in WFP

[Silenti]

Hello,

nLite is very usefull program. I welcome this program. Great thanks to Nuhi !

Now I have a few questions.

1. 
   
   
2. Why does the switch "Remove duplicate files" that is found in a Misc section of Options tab show no inpact neihter in a size of produced ISO file nor in installed Windows [suppose, the only difference in presets is only in that switch position]? Does it work?
   
3. My nLited Windows has no DllCache folder. I tried various presets, but never got that folder existed. How can I get it existed and filled, of course, with files? Maybe there's no option for that staff in the nLite...
   
   

Components I dealt with:

- Windows XP MCE v3 [2004]

- RyanVM Post-SP2 Update Pack 2.1.6

- RogueSpear's .Net 2.0 + V.Java 2.0 integrator addon

added:

It was used nLite v.1.3rc2, OS tested on VMWare v.5.5.

If OS installed in VMware from original XP MCE CD, then it had DllCache folder with 494MB of files in system32 directory.

Two Last_session files included differ only in mentioned 'duplication' switch setting.

Last_Sessions.rar

Edited February 13, 2007 by Silenti

[Silenti]

...I tried various presets, but never got that folder presented.

Well, every time it got existed in system32 folder, but… I simply forgot to uncheck "Hide protected operating system files" in Folder Options > View. There was obviously no bug at all. Besides I found something interesting and I will report about strange behaviour of WFP a bit later, because not all of my tests have finished yet.

[Silenti]

Now finally I finished my testing work. There are results.

It was used nLite v.1.3rc2, OS tested on VMWare v.5.5.

Components for integration:

- Windows XP MCE v3 [2004]

- RyanVM WMP10 addon 3.1

- RyanVM DirectX 9.0c addon 1.1

- RyanVM Post-SP2 Update Pack 2.1.6

- RogueSpear's .Net 2.0 + V.Java 2.0 integrator addon

On a fresh OS install into VMWare DllCache folder contains 2056 files in total of 380MB. If you run Windows File Protection command sfc /scannow [or /scanonce – no matter's] this folder groves in size filled with… mostly of files with common name OLDxx.tmp or OLDxxx.tmp, where x represents hex digit. About 600 files ussually is added to every sequent scan. What a focus-pocus OS is playing up ?

Second, if you set limit in DllCache size, for example 250MB, further run sfc /purgecache and next run sfc /scannow with an installation_CD.iso loaded into VMWare virtual drive, it would get as much as 250MB of files. Moreover, if you hit to run scan once again, now cache folder exceedes this limit of 250MB filled mainly [but not only] with those OLDxxx. How nice WFP works! :-) By the way, it seems not caused by nLite integration. To prove that I performed another test set.

1. Folder with my installation CD files converted into boot_iso image with UltraISO.

2. Installed into VMWare.

3. Checked out DllCache folder: 494MB [compressed 318MB], 2544 files – screenshot 1.

There Windows explorer window left open through all the further testing period in order to see, what new files have been added in.

4. Run sfc /scannow.

[it have run very long, ~0,5 hour.]

5. Checked out DllCache folder again: 677MB, 3879 files - screenshot 2.

You could see a huge amount of new files added after the last "zoneoc.dll" that represents dividing line of originally installed ones. There again, like in case with nLited OS, is a lot of those OLDxxx files mixed with system new drivers taken from CD.

What conclusions could be made?

It is obvious that Windows File Protection service is not working flawless. This service plays, I suppose it could not be argued, the most importand role in securing stable functioning of Windows XP. What are guarantees that this explored "hole" is the only bug in WFP routines? Hystory with Windows OSes hints some pros & cons.

So, is it only an illusion for my dream to configure, set & tweak OS transforming it into stable working PC?

Any opinion would be welcome

WFP_test.rar

Edited February 7, 2007 by Silenti

[nuhi]

Ok, since I have to review some SFC popups as well this will come in handy, thx.

[Silenti]

Once again on WFP

There are links to the pictures mentioned above.

screenshot 1 – Just installed

screenshot – SFC works

screenshot 2 – DllCache after scan

On a screenshot 1 ["Just installed"] is seen DllCache of installed Windows from original CD (XP Pro MCE SP2). The last file of this folder is "zoneoc.dll". SFC scan has not been performed yet.

On a screenshot 2 ("DllCache after scan") this file from original installation is marked again. As scan was performed with a command sfc_/scannow and still being Windows Explorer window opened, there below this file is seen a lot of added new ones – as much as 1335 (before the scan was 2544 files and after the scan – 3879).

Again, this added new portion has a big part of those mysteriuos OLDxx(x).tmp. Do temporary files, as seen by extention, are useful for WFP system? I don't think they are. This is a sign something is wrong with the system (it has to be pointed up – this is a fresh installation). Interestingly, what extent it does to?

As noted above, the situation was the same, if the latest post-SP2 hotfix pack has been integrated with the original XP SP2 installation CD. It means that this Windows vulnarability is not covered by any patch. Is it new and critical to system stability? Information about such a flaw I have never found or heard before. Perhaps Microsoft could answer comprehensively. So they have been informed about it.

Another strange behaviour of WFP was noticed in tests when it was randomly set size of DllCache. It is possible to do that by modifying the options through a Group Policy Editor: Start menu > Run box > type in gpedit.msc and click on the Ok button. Then go: Computer configuration > Administrative templates > System > Windows File Protection > Settings.

Another way is to use XPlite. Finally, whatever way is used the same effect of adding various OLDxx(x).tmp here appears too, as described in previous post.

Does bugy WFP prevent from OS disintegration?

About impact to system stability... Actually, that vulnarability doesn't cause system to crash the next time you install a new program, but day after day system entropy becames worse and worse through a process of dayly routine run. There is seemingly no way to escape final crash, or system became unusable, because the system is not self-regulating properly – this means, system core is permanently degrading. And by no means could no any system cleaning application improve the situation. (It must be taken into account, those implications are accompanied with the facts from a real life including my experience, too.) Let's look at an example from nature - mountain avalanche. It starts, when only a single and even though a little stone starts to roll downhill & base is not stable enough to resist the lethal movement. Perhaps the only difference is that avalance groves exponencialy, whereas Windows stability slips down seemingly by non-linear law.