1

I am dealing with a program that patches core Windows system files. I don't advocate it, but it is what I am dealing with.

My question is, when we run a Service Pack, will it brick the system, or just update the core files with unpatched versions? A guide into how a service packs install would be beneficial.

The modifications are mostly to system DLLs and are best described as API hooks.

unixman83
  • 1,932
  • 8
  • 25
  • 33

1 Answers1

2

That changes a bit based on Windows version. Windows 2000/2003 do it one way, where 2008+ do it another. In short, when Microsoft releases a patch, be it a patch or a full up service-pack, it releases them as full files rather than bit-level patches. For multi-file patches, they do have some logic in them to figure out which files to update based on what's already on the system (by querying the installed updates list, examining file dates, or both). So yes, when it comes time to service-pack a system, if the SP touches files you've modified they'll get overwritten by the Microsoft-supplied files.

Also, Windows 2008 is very touchy about modifying files in System32. You may find it significantly harder than in 2003.

sysadmin1138
  • 133,124
  • 18
  • 176
  • 300
  • *File dates*, didn't think of that one. What about version numbers and authenticode signature checking? – unixman83 May 08 '11 at 07:14
  • @unixman83 Authenticode is what causes 2008+ to complain bitterly when attempting to replace system binaries but I *think* service-packs replace willy-nilly. Could very well be wrong there. – sysadmin1138 May 08 '11 at 12:53