From 66c10c4067dbb67f0b38da40b03338b1af0a78ce Mon Sep 17 00:00:00 2001 From: zeffy Date: Sun, 4 Jun 2017 17:59:35 -0700 Subject: [PATCH] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 7872248..f46bb0a 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,7 @@ My patch takes advantage of this result caching behavior by setting the "hasn't ## How it works +- At system boot the wufuc scheduled task runs as the `NT AUTHORITY\SYSTEM` user. - wufuc determines what service host process the Windows Update service (`wuauserv`) runs in, and injects itself into it. - Once injected, it applies a hook to `LoadLibraryEx` that automatically patches `wuaueng.dll` when it is loaded. - Any previously loaded `wuaueng.dll` is also patched.