Microsoft KB Archive/927745

= Detailed information for developers who use the Windows Update offline scan file =

Article ID: 927745

Article Last Modified on 2/13/2007

-

APPLIES TO


 * Microsoft Baseline Security Analyzer 2.0
 * Microsoft Systems Management Server 2003
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter x64 Edition
 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Tablet PC Edition
 * Microsoft Windows XP Media Center Edition 2002
 * Microsoft Windows XP Professional x64 Edition
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Datacenter Server

-



SUMMARY
In November 2006, a new version of the Windows Update (WU) offline scan file was released together with the existing WU offline scan file, Wsusscan.cab. The new WU offline scan file, Wsusscn2.cab, has a new format. Any scanning solution that uses the existing WU offline scan file must to be updated to use the new WU offline scan file by March 2007.

Any non-Microsoft solution that uses the WU offline scan file must have the updated Windows Update Agent (WUA) installed for all Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003 operating systems. Computers that have Windows Vista installed will have the updated WUA when the operating system releases. Therefore, Windows Vista will not require an update.

Some non-Microsoft solutions that use the WU offline scan file for offline security update detection may also require the updated version. These solutions need these updated version of the WU offline scan file if they read this file instead of using the Windows Update API. We do not recommend that these solutions read this file directly because the file is subject to change. Instead, we recommend that developers use the WUA offline scan feature. For information about this feature, visit the following MSDN Web site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx



MORE INFORMATION
Microsoft has changed the internal format of the WU offline scan file to solve the problem that is explained in Microsoft Knowledge Base article 926464. Any non-Microsoft solutions that access the this file in ways that are not documented in the public API may require the updated file.

All products, tools, and solutions that use the Wsusscan.cab file by using the documented WUA API must be updated by March 2007. These products, tools, and solutions must be able to use the new Wsusscn2.cab file to download the Wsusscn2.cab file from the new location. Also, all client computers must have the necessary updated WUA client computer version installed. Any Microsoft solutions that access the CAB file directly may need additional changes because of the internal format changes.

Directly accessing the Wsusscn2.cab file
We do not recommend that you access the Wsusscn2.cab file directly because the format of the file is liable to change. However, this article includes information for developers who have existing solutions that directly access the file.

Determine whether the WUA version is the correct version for the Wsusscn2.cab file
If the version of WUA that is installed on the computer does not meet the minimum version requirement of the corresponding scan package format, the installed WUA version will not work with the scan package and the installed version may return WU_E_OL_NEWCLIENT_REQUIRED and other HRESULT codes from its scan package related APIs. In the worst case, the installed version of the WUA API may not support any scan package related functionality. For example, the WUA API may not support the IUpdateServiceManager interface. For information about how to avoid this behavior, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx

This information will help you learn about how the application may set up the latest version of WUA on the computer.

The application may set up the latest version of WUA on the computer before it uses scan packages with the WUA API. For information about how to use scan packages to scan for updates in an offline environment, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa387290.aspx

For more information about the IUpdateCollection interface, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa386107.aspx

For more information about the scan package, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa386821.aspx

For more information about the WUA API, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx

Changes in the CAB file format
The Wsusscan.cab file contains a single CAB file. This file is Package.cab. The Wsusscn2.cab file contains the following files:  An Index.xml file. This file contains the following components:   element

Version attribute (number)

Required? Yes

Meaning: The version number that uses the format of the Index.xml file

Remarks: This value has to be numerically equivalent to Version=&quot;1&quot;  element

Xor attribute (number)

Required? No

Default value: Xor=&quot;0&quot;

Meaning:  Xor=&quot;1&quot; indicates that all the CAB files that are defined by the child  elements, except the Package.cab file, have been obfuscated with a bitwise NOT operation. In other words, all the defined CAB files, except for the Package.cab file, have the 1s and 0s of every single bit of their contents flipped. This behavior occurs to improve the performance of WUA in processing the scan package by skipping the time that some client computer antivirus software takes to scan those CAB files for viruses. Xor=&quot;0&quot; indicates that all CAB files that are defined by the child  elements are not obfuscated with a bitwise NOT operation.</li></ul> </li> <Cab> element

Name attribute (string)

Required? Yes

Meaning: The file name of the CAB file that is defined by the <Cab> element.

Remarks: <ul> The value for the first <Cab> element that is defined in <CabList> must be Package.cab.

Note This value is case-insensitive.</li> Typically, if the value is Xor=&quot;1&quot;, the CAB files that are defined second, third, and so on by <Cab> elements that are named Package2.wu, Package3.wu, and so on. This is true if the elements are present.</li> Typically, if the value is Xor=&quot;0&quot;, the CAB files that are defined second, third, and on by <Cab> elements are named Package2.cab, Package3.cab, and so on. This is true if the elements are present.</li></ul>

RangeStart attribute (number)

Required? No for the Package.cab file, yes for the Package .wu file

Default: (None)

Meaning: <ul> The RevisionId-specific files are the files in the C, E, I, and X folders. These files may span more than one of the CAB files that are defined in the <CabList> element. However, the Wsusscn2.cab specifications require that all the files that are specific to a particular RevisionId must be stored in only one such CAB file. The RangeStart attribute records the lowest RevisionId value of the RevisionId-specific files that the CAB file that corresponds to the <Cab> element contains.</li> A missing attribute value means that no RevisionId-specific files are stored in the corresponding CAB file. The <Cab> element for the Package.cab file typically does not specify a RangeStart attribute value.</li></ul>

Remarks: <ul> If the RangeStart attribute value is present in the first <Cab> element that is listed in the Index.xml file, it must be &quot;0&quot;.</li> If the RangeStart attribute values that are defined in the <Cab> elements are present in the Index.xml file, they have to be in ascending order and must not overlap.</li> By combining the RangeStart attribute values that are defined in the <Cab> elements in the Index.xml file, the application can deduce the continuous, non-overlapping range of RevisionIds that are covered by each of those CAB files. The CAB file that corresponds to the last defined <Cab> element that has a RangeStart attribute value that contains all RevisionId-specific files, starting from the RevisionId value that is specified in the attribute value.</li></ul> </li> FilesDir attribute (number)

Required: No

Default: FilesDir=&quot;0&quot;

Meaning: <ul> FilesDir=&quot;1&quot; indicates that the CAB file that corresponds to the <Cab> element contains the Files folder.</li> FilesDir=&quot;0&quot; indicates that the CAB file that corresponds to the <Cab> element does not contain the Files folder.</li></ul>

Note There is only one <Cab> element that specifies FilesDir=&quot;1&quot;.</li></ul> </li> A Package.cab file or a Package .wu file. These files contain the following components: <ul> Package.xml

The Package.xml file is in the same format and schema as the Package.cab file that is in the Wsusscan.cab file. As in the older format, the file remains in the Package.cab file.</li> The C folder

The C folder contains the same kind of content as the Core folder of the Package.cab file that is in the Wsusscan.cab file. Unlike the older format, the C folder spans one or more Package.cab or Package .wu CAB files. This behavior occurs per the RangeStart attribute values in the corresponding <Cab> elements that are defined in the Index.xml file.</li> The E folder

The E folder contains the same kind of content as the Eula folder of Package.cab in the Wsusscan.cab file. Unlike the older format, the E folder spans one or more Package.cab or Package .wu CAB files, per the RangeStart attribute values in the corresponding <Cab> elements. These elements are defined in the Index.xml file.</li> <li>The Files folder

The File folder contains the same kind of content as the Files folder of the Package.cab in Wsusscan.cab. Unlike the older format, the folder is stored in a single Package.cab or Package .wu CAB file. This behavior occurs per the FilesDir attribute value that is in the corresponding <Cab> element. This element is in the Index.xml file.</li> <li>The I folder

The I folder contains the same kind of content as the Localized folder of the Package.cab file that is in the Wsusscan.cab file. The only difference is that the files that correspond to the non-explicitly-deployable, non-bundle software updates are absent from Wsusscn2.cab for performance’s sake on the end-user computer. The removed localized properties for those updates are auto-generated by WUA during run-time. Unlike the older format, the folder spans one or more Package.cab or Package .wu CAB files, per the RangeStart attribute values in the corresponding <Cab> elements. These elements are defined in the Index.xml file.</li> <li>The X folder

The X folder contains the same kind of content as the Extended folder of Package.cab in Wsusscan.cab. Unlike the older format, the X folder spans one or more Package.cab or Package .wu CAB files. This behavior occurs per the RangeStart attribute values that are in the corresponding <Cab> elements. These elements are defined in the Index.xml file.</li></ul> </li></ul>

For more information about the WUA, visit the following site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx

Keywords: kbhowto kbinfo KB927745

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.