Inside Windows-Update

The tecDump utility reveals that Windows Update uses the POST requests to transmit SOAP (Simple Object Access Protocol) messages to the Microsoft server. SOAP is the XML-based standard protocol for communicating with web services, an elementary building block of Microsoft's .NET strategy. The intercepted messages have the following format.

Code

1

<SOAP:Envelope xmlns:SOAP="x-schema:http://schemas.xmlsoap.org/soap/envelope/">

2

<SOAP:Body>

3

<GetManifest>

4

<clientInfo [...]> [...] </clientInfo>

5

<systemInfo [...]>

6

<computerSystem [...]>

7

[...]

8

</computerSystem>

9

<platform [...]>

10

[...]

11

</platform>

12

<locale [...]>

13

[...]

14

</locale>

15

<devices [...]>

16

[...]

17

</devices>

18

</systemInfo>

19

<query [...]> [...] </query>

20

</GetManifest>

21

</SOAP:Body>

22

</SOAP:Envelope>

Textansicht

The <SOAP:Envelope> and <SOAP:Body> tags are required by the SOAP standard to encapsulate the payload to be transmitted. Windows Update uses the payload to implement a RPC (Remote Procedure Call) mechanism. The SOAP messages posted to the Microsoft server by Windows Update contain the name of a function to be executed on the server and the arguments to be passed to the function. When receiving a message from Windows Update the server then runs the specified function with the specified arguments and encapsulates the result into another SOAP message, which it then transmits back to Windows Update in the HTTP response to the pending POST request.