Inside Windows-Update

To further explore the capabilities of Windows Update we now have a look at the COM component. The component is implemented by the iuctl.dll dynamic link library, which can be found in the System32 folder. The iuctl.dll library is a COM wrapper around iuengine.dll , which is stored in the same folder.

Using the COM component takes a bit more work than usual, because it expects to be used from within Internet Explorer. Moreover the component can only be used in web-pages that have a URL that begins with http://v4.windowsupdate.microsoft.com . To be precise the COM component examines the [IUServerURLs] section in the file Program Files\\WindowsUpdate\\V4\\iuident.txt . If the URL of a web-page begins with one of the entries in this section, the component agrees to be used from within this web-page. By default only http://v4.windowsupdate.microsoft.com is contained in the section.

We therefore create a bogus WebBrowserApp object to emulate a running instance of Internet Explorer and implement a special LocationUrl() function that always returns http://v4.windowsupdate.microsoft.com . Then we make the COM component believe that it is run from within our fake Internet Explorer by calling the SetSite() function of the IObjectWithSite interface of the COM component to set its site to our bogus WebBrowserApp object. When determining the URL of the web-page that it is being used in, the component will call our special LocationUrl() function and believe that it is being used in a web-page with a valid URL.