Windows File Protection

~ the eulogy ~

Windows File Protection shipped with Windows 2000 on 17 February 2000 to solve a problem that had a name before it had a fix. DLL hell was what you got when a program's installer decided it needed a particular version of a shared system library, overwrote the one already on the machine with an older copy, and broke something completely unrelated that had been using the newer one.

The fix was a watchdog. WFP sat on the set of files the operating system itself had installed, the DLLs and EXEs and SYS and OCX files, and if anything replaced or deleted one of them without going through an approved channel, Windows restored the original from a cache immediately and silently. You did not get a dialog. You got the file you had before, back where it was, as though your installer had simply failed to do the thing it just did.

It carried that name from Windows 2000 through Windows Server 2003, with Windows Me shipping the same idea under the label System File Protection. Then Windows Vista replaced it with Windows Resource Protection, and consumers got Vista on 30 January 2007.

~ the dossier ~

~ how it worked ~

The cache is the part worth knowing about. On the NT family it lived at %SystemRoot%\System32\Dllcache, a hidden folder holding backup copies of every protected file, which is why a stock XP install ate several hundred megabytes more disk than the files you could see accounted for. Windows Me did it differently and kept the whole compressed cabinet set in %windir%\Options\Install.

Verification was done with code signing rather than by comparing bytes. WFP checked digital signatures against catalog files sitting in a folder named after a GUID, %SystemRoot%\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}, which is the kind of path that turns up in a forum post at two in the morning. Only a short list of components was allowed to replace a protected file at all: the package installer, Update.exe, and Windows Installer, Msiexec.exe. Everything else got quietly reverted. The companion tool was sfc.exe, the System File Checker, and "sfc /scannow" is the one piece of this system that people actually typed.

~ the disc nobody had ~

When the cache did not hold the file WFP wanted, it went looking on the network path it had been installed from, and failing that it asked the user to insert the Windows installation disc.

That prompt assumed the machine in front of you had been installed from a disc you owned and still had on a shelf in the room. I went through university in Turkey between 2003 and 2010, and on most of the machines I saw the honest answer to that request was nothing at all. The Windows on them had come from somewhere else. Nobody had the original media, and downloading a few hundred megabytes to satisfy a dialog box was not a casual act on the connections of the time. So the prompt sat there until you canceled it, and the machine kept running slightly wrong.

~ what replaced it ~

Microsoft's own documentation puts it plainly: Windows Resource Protection is the new name for Windows File Protection, and it replaced it in Vista and Server 2008. The mechanism underneath changed completely. WRP uses access control lists and hands full write permission to a single account called TrustedInstaller, so a bad installer is refused at the file system rather than allowed to write and then quietly reverted. It also covers registry keys, which WFP never did.

The choice not to use ACLs in the first place was deliberate, and Microsoft said so at the time. Permissions would not have worked on FAT32 volumes, which plenty of Windows 2000 and Me machines still were, and refusing a write outright makes a careless installer fail with an error where letting it write and undoing the damage makes it appear to succeed. WFP was built to keep bad software from taking the operating system down with it while letting the bad software believe it had won.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »