Inside Windows-Update

The systemInfo argument consists of four parts - computerSystem, platform, locale, and devices.

computerSystem - This part is very short and contains only general information, e.g. the make and model of the computer that is being updated or the free space on its harddrives. However, there also is a mysterious PID attribute that consists of 76 seemingly random (and therefore probably encrypted) bytes that are represented by a string of 152 hex digits. We will have an in-depth look at this later.

platform - This part summarizes the basic facts about the operating system, e.g. the processor architecture on which it is running, the build number, or the installed service pack.

locale - Since updates are typically language-specific this part specifies the language of the operating system.

devices - This is by far the longest part. It is only present if GetManifest is run at the DriverUpdates level. In order to be able to determine the driver updates that are relevant for the computer that is being updated the Microsoft server needs to know which hardware components, e.g. which graphics adapter or which sound card, are installed in the computer. This section contains a complete list of all detected hardware devices. In contrast to the hardware hash transmitted to Microsoft during Windows Product Activation this list has to reveal the make and model of each device in order to be of any use. For mass storage devices the IDE ID or SCSI ID is given, which explicitly contains the make and model. This is illustrated by the following excerpt, which shows an IDE ID that represents the SD-C2002 DVD-ROM drive by Toshiba.

Code

1

<hwid rank="0">

2

IDE\\CdRomTOSHIBA_DVD-ROM_SD-C2002________________1120____

3

</hwid>

Textansicht

For plug & play devices the numeric vendor ID and device ID are listed, which can easily be mapped to the make and model, respectively. The following excerpt represents a Cyber 9397 notebook graphics adapter (device ID 9397) by Trident (vendor ID 1023).

Code

1

<hwid rank="0">

2

PCI\\VEN_1023&DEV_9397&SUBSYS_00000000&REV_F3

3

</hwid>

Textansicht