remove detours

2018-02-15 19:22:34 -08:00
parent 9d5a41e3f7
commit d2b0bae9e5
18 changed files with 396 additions and 108 deletions
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,18 +1,17 @@
 # Contributing guidelines

-This document is also available in [简体中文], [繁体中文], [русский], [Español] and [more...](https://github.com/zeffy/wufuc/wiki)
+[:de:] [:es:] [:fr:] [:it:] [:hungary:] [:brazil:] [:ru:] [:cn:] [:taiwan:]

 ## Reporting an issue [![](https://isitmaintained.com/badge/resolution/zeffy/wufuc.svg)](https://isitmaintained.com/project/zeffy/wufuc)

-#### Before you create an issue, please make sure of the following:
+### Before you create an issue, please make sure of the following:

 - Are you using at least the [latest stable version](https://github.com/zeffy/wufuc/releases/latest)?
 - Have you tried restarting your computer?

-#### After you've confirmed those things, please create an issue and include the following information:
+### After you've confirmed those things, please create an issue and include the following information:

- Navigate to where you installed wufuc, and attach all the `*.log` files to your issue.
- What build are you using? Stable release or unstable AppVeyor builds?
+- Navigate to where you installed wufuc, and attach `wufuc.log` to your issue.
 - What is the file version and/or SHA-1 hash of `C:\Windows\System32\wuaueng.dll`?
 - Any other information you feel is relevant to your issue.

@@ -21,7 +20,12 @@ This document is also available in [简体中文], [繁体中文], [русски
 - Issues that don't have the information requested above (when applicable) will be closed immediately and the poster directed to the contributing guidelines.
 - Issues that go a week without a response from original poster are subject to closure at my discretion.

-[简体中文]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(%E7%AE%80%E4%BD%93%E4%B8%AD%E6%96%87)
-[繁体中文]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(%E7%B9%81%E9%AB%94%E4%B8%AD%E6%96%87)
-[русский]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9)
-[Español]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Espa%C3%B1ol)
+[:de:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Deutsch)
+[:es:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Espa%C3%B1ol)
+[:fr:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Fran%C3%A7ais)
+[:it:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Italiano)
+[:hungary:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Magyar)
+[:brazil:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(Portugu%C3%AAs%20Brasileiro)
+[:ru:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(%D1%80%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9)
+[:cn:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(%E7%AE%80%E4%BD%93%E4%B8%AD%E6%96%87)
+[:taiwan:]: https://github.com/zeffy/wufuc/wiki/CONTRIBUTING-(%E7%B9%81%E9%AB%94%E4%B8%AD%E6%96%87)
--- a/src/wufuc/callbacks.c
+++ b/src/wufuc/callbacks.c
@@ -1,15 +1,12 @@
 #include "stdafx.h"
 #include "callbacks.h"
-#include "hooks.h"
-#include "hlpmisc.h"
 #include "hlpmem.h"
+#include "hlpmisc.h"
 #include "hlpsvc.h"
+#include "hooks.h"

 VOID CALLBACK ServiceNotifyCallback(PSERVICE_NOTIFYW pNotifyBuffer)
 {
-        trace(L"Enter service notify callback. (NotifyStatus=%ld ServiceStatus=%ld)",
-                pNotifyBuffer->dwNotificationStatus, pNotifyBuffer->ServiceStatus);
-
        switch ( pNotifyBuffer->dwNotificationStatus ) {
        case ERROR_SUCCESS:
                if ( pNotifyBuffer->ServiceStatus.dwProcessId )
@@ -25,7 +22,29 @@ VOID CALLBACK ServiceNotifyCallback(PSERVICE_NOTIFYW pNotifyBuffer)
                LocalFree((HLOCAL)pNotifyBuffer->pszServiceNames);
 }

-DWORD WINAPI ThreadStartCallback(LPVOID pParam)
+DWORD WINAPI PipeLoopThreadCallback(LPVOID pParam)
+{
+        HANDLE hPipe = (HANDLE)pParam;
+        BOOL fSuccess;
+        wchar_t  chBuf[512];
+        while (true) {
+                // Read from the pipe. 
+
+                fSuccess = ReadFile(
+                        hPipe,    // pipe handle 
+                        chBuf,    // buffer to receive reply 
+                        BUFSIZE * sizeof(wchar_t),  // size of buffer 
+                        &cbRead,  // number of bytes read 
+                        NULL);    // not overlapped 
+
+                if ( !fSuccess && GetLastError() != ERROR_MORE_DATA )
+                        break;;
+
+                _tprintf(TEXT("\"%s\"\n"), chBuf);
+        } 
+}
+
+DWORD WINAPI StartThreadCallback(LPVOID pParam)
 {
        ContextHandles ctx;
        SC_HANDLE hSCM;
@@ -33,8 +52,9 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)
        DWORD dwProcessId;
        LPQUERY_SERVICE_CONFIGW pServiceConfig;
        DWORD dwServiceType;
-        LPWSTR str;
+        wchar_t *str;
        HMODULE hModule;
+        wchar_t Filename[MAX_PATH];
        DWORD result;

        // get mutex and unload event handles from virtual memory
@@ -55,7 +75,7 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)

        hSCM = OpenSCManagerW(NULL, NULL, SC_MANAGER_CONNECT);
        if ( !hSCM ) {
-                trace(L"Failed to open SCM. (GetLastError=%ul)", GetLastError());
+                trace(L"Failed to open SCM. (GetLastError=%lu)", GetLastError());
                goto release;
        }

@@ -91,7 +111,7 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)

        // query the ServiceDll path after applying our compat hook so that it
        // is correct
-        str = (LPWSTR)RegQueryValueExAlloc(HKEY_LOCAL_MACHINE,
+        str = (wchar_t *)RegQueryValueExAlloc(HKEY_LOCAL_MACHINE,
                L"SYSTEM\\CurrentControlSet\\services\\wuauserv\\Parameters",
                L"ServiceDll", NULL, NULL);
        g_pszWUServiceDll = ExpandEnvironmentStringsAlloc(str, NULL);
@@ -105,9 +125,8 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)
                DetourAttach(&(PVOID)g_pfnLoadLibraryExW, LoadLibraryExW_hook);

        if ( g_pszWUServiceDll ) {
-                hModule = GetModuleHandleW(g_pszWUServiceDll);
-                if ( hModule ) {
-                        if ( FindIDSFunctionPointer(hModule, &(PVOID)g_pfnIsDeviceServiceable) ) {
+                if ( GetModuleHandleExW(0, g_pszWUServiceDll, &hModule) ) {
+                        if ( FindIDSFunctionAddress(hModule, &(PVOID)g_pfnIsDeviceServiceable) ) {
                                trace(L"Matched pattern for %ls!IsDeviceServiceable. (%p)",
                                        PathFindFileNameW(g_pszWUServiceDll),
                                        g_pfnIsDeviceServiceable);
@@ -115,6 +134,7 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)
                        } else {
                                trace(L"No pattern matched!");
                        }
+                        FreeLibrary(hModule);
                }

        }
@@ -125,7 +145,6 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)
        // intentionally leave parent mutex open until this thread ends, at
        // which point it becomes abandoned again.
        result = WaitForMultipleObjects(_countof(ctx.handles), ctx.handles, FALSE, INFINITE);
-
        trace(L"Unload condition has been met.");

        // unhook
@@ -137,9 +156,19 @@ DWORD WINAPI ThreadStartCallback(LPVOID pParam)
                if ( g_pfnLoadLibraryExW )
                        DetourDetach(&(PVOID)g_pfnLoadLibraryExW, LoadLibraryExW_hook);

-                if ( g_pfnIsDeviceServiceable )
-                        DetourDetach(&(PVOID)g_pfnIsDeviceServiceable, IsDeviceServiceable_hook);
+                // check to see if the last known address of IsDeviceServiceable
+                // is still in the address space of wuaueng.dll before 
+                // attempting to unhook the function.
+                if ( g_pfnIsDeviceServiceable
+                        && GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,
+                        (LPWSTR)g_pfnIsDeviceServiceableLastKnown, &hModule) ) {

+                        if ( GetModuleFileNameW(hModule, Filename, _countof(Filename))
+                                && (!_wcsicmp(Filename, g_pszWUServiceDll)
+                                        || !_wcsicmp(Filename, PathFindFileNameW(g_pszWUServiceDll))) )
+                                DetourDetach(&(PVOID)g_pfnIsDeviceServiceable, IsDeviceServiceable_hook);
+                        FreeLibrary(hModule);
+                }
                if ( g_pfnRegQueryValueExW )
                        DetourDetach(&(PVOID)g_pfnRegQueryValueExW, RegQueryValueExW_hook);

@@ -151,8 +180,10 @@ release:
        ReleaseMutex(ctx.hChildMutex);
 close_handles:
        CloseHandle(ctx.hChildMutex);
-        CloseHandle(ctx.hParentMutex);
        CloseHandle(ctx.hUnloadEvent);
+        CloseHandle(ctx.hParentMutex);
+        if ( g_hTracingMutex )
+                CloseHandle(g_hTracingMutex);
 unload:
        trace(L"Freeing library and exiting main thread.");
        FreeLibraryAndExitThread(PIMAGEBASE, 0);
--- a/src/wufuc/hlpmem.c
+++ b/src/wufuc/hlpmem.c
@@ -1,11 +1,11 @@
 #include "stdafx.h"
-#include "hlpmisc.h"
+#include "callbacks.h"
 #include "hlpmem.h"
+#include "hlpmisc.h"
 #include "hlpver.h"
 #include "hooks.h"
-#include "callbacks.h"

-bool FindIDSFunctionPointer(HMODULE hModule, PVOID *ppfnIsDeviceServiceable)
+bool FindIDSFunctionAddress(HMODULE hModule, PVOID *ppfnIsDeviceServiceable)
 {
        bool result = false;
        bool is_win7 = false;
@@ -61,23 +61,26 @@ bool FindIDSFunctionPointer(HMODULE hModule, PVOID *ppfnIsDeviceServiceable)
                pffi = GetVersionInfoFromHModuleAlloc(hModule, L"\\", &cbffi);
                if ( !pffi ) {
                        trace(L"Failed to allocate version information from hmodule.");
-                        continue;
+                        break;
                }
+                trace(L"Windows Update Agent version: %hu.%hu.%hu.%hu",
+                        HIWORD(pffi->dwProductVersionMS),
+                        LOWORD(pffi->dwProductVersionMS),
+                        HIWORD(pffi->dwProductVersionLS),
+                        LOWORD(pffi->dwProductVersionLS));

                // assure wuaueng.dll is at least the minimum supported version
                tmp = ((is_win7 && ProductVersionCompare(pffi, 7, 6, 7601, 23714) != -1)
                        || (is_win81 && ProductVersionCompare(pffi, 7, 9, 9600, 18621) != -1));
                free(pffi);
                if ( !tmp ) {
-                        trace(L"Module does not meet the minimum supported version.");
-                        continue;
+                        trace(L"Windows Update Agent does not meet the minimum supported version.");
+                        break;
                }
-
                if ( !GetModuleInformation(hProcess, hModule, &modinfo, sizeof modinfo) )
                        break;

-                offset = patternfind(modinfo.lpBaseOfDll,
-                        modinfo.SizeOfImage,
+                offset = patternfind(modinfo.lpBaseOfDll, modinfo.SizeOfImage,
 #ifdef _WIN64
                        "FFF3 4883EC?? 33DB 391D???????? 7508 8B05????????"
 #else
@@ -87,7 +90,8 @@ bool FindIDSFunctionPointer(HMODULE hModule, PVOID *ppfnIsDeviceServiceable)
 #endif
                );
                if ( offset != -1 ) {
-                        *ppfnIsDeviceServiceable = (PVOID)((uint8_t *)modinfo.lpBaseOfDll + offset);
+                        g_pfnIsDeviceServiceableLastKnown = (PVOID)((uint8_t *)modinfo.lpBaseOfDll + offset);
+                        *ppfnIsDeviceServiceable = g_pfnIsDeviceServiceableLastKnown;
                        result = true;
                }
                break;
--- a/src/wufuc/hlpmem.h
+++ b/src/wufuc/hlpmem.h
@@ -27,7 +27,7 @@ typedef struct
        WORD wCodePage;
 } LANGANDCODEPAGE, *PLANGANDCODEPAGE;

-bool FindIDSFunctionPointer(HMODULE hModule, PVOID *ppfnIsDeviceServiceable);
+bool FindIDSFunctionAddress(HMODULE hModule, PVOID *ppfnIsDeviceServiceable);
 HANDLE GetRemoteHModuleFromTh32ModuleSnapshot(HANDLE hSnapshot, const wchar_t *pLibFileName);
 bool InjectLibraryAndCreateRemoteThread(
        HANDLE hProcess,
--- a/src/wufuc/hlpmisc.c
+++ b/src/wufuc/hlpmisc.c
@@ -2,7 +2,7 @@
 #include "hlpmisc.h"
 #include <sddl.h>

-bool InitializeMutex(bool InitialOwner, LPCWSTR pMutexName, HANDLE *phMutex)
+bool InitializeMutex(bool InitialOwner, const wchar_t *pMutexName, HANDLE *phMutex)
 {
        HANDLE hMutex;

@@ -22,10 +22,10 @@ bool InitializeMutex(bool InitialOwner, LPCWSTR pMutexName, HANDLE *phMutex)
 }

 bool CreateEventWithStringSecurityDescriptor(
-        LPCWSTR pStringSecurityDescriptor,
+        const wchar_t *pStringSecurityDescriptor,
        bool ManualReset,
        bool InitialState,
-        LPCWSTR pName,
+        const wchar_t *pName,
        HANDLE *phEvent)
 {
        SECURITY_ATTRIBUTES sa = { sizeof sa };
@@ -48,8 +48,8 @@ bool CreateEventWithStringSecurityDescriptor(

 PVOID RegGetValueAlloc(
        HKEY hkey,
-        LPCWSTR pSubKey,
-        LPCWSTR pValue,
+        const wchar_t *pSubKey,
+        const wchar_t *pValue,
        DWORD dwFlags,
        LPDWORD pdwType,
        LPDWORD pcbData)
@@ -75,8 +75,8 @@ PVOID RegGetValueAlloc(

 LPBYTE RegQueryValueExAlloc(
        HKEY hKey,
-        LPCWSTR pSubKey,
-        LPCWSTR pValueName,
+        const wchar_t *pSubKey,
+        const wchar_t *pValueName,
        LPDWORD pType,
        LPDWORD pcbData)
 {
@@ -136,9 +136,9 @@ PVOID NtQueryKeyAlloc(
        return result;
 }

-LPWSTR ExpandEnvironmentStringsAlloc(LPCWSTR src, LPDWORD pcchLength)
+wchar_t *ExpandEnvironmentStringsAlloc(const wchar_t *src, LPDWORD pcchLength)
 {
-        LPWSTR result;
+        wchar_t *result;
        DWORD buffersize;
        DWORD size;

--- a/src/wufuc/hlpmisc.h
+++ b/src/wufuc/hlpmisc.h
@@ -1,27 +1,27 @@
 #pragma once

-bool InitializeMutex(bool InitialOwner, LPCWSTR pMutexName, HANDLE *phMutex);
+bool InitializeMutex(bool InitialOwner, const wchar_t *pMutexName, HANDLE *phMutex);
 bool CreateEventWithStringSecurityDescriptor(
-        LPCWSTR pStringSecurityDescriptor,
+        const wchar_t *pStringSecurityDescriptor,
        bool ManualReset,
        bool InitialState,
-        LPCWSTR pName,
+        const wchar_t *pName,
        HANDLE *phEvent);
 PVOID RegGetValueAlloc(
        HKEY hkey,
-        LPCWSTR pSubKey,
-        LPCWSTR pValue,
+        const wchar_t *pSubKey,
+        const wchar_t *pValue,
        DWORD dwFlags,
        LPDWORD pdwType,
        LPDWORD pcbData);
 LPBYTE RegQueryValueExAlloc(
        HKEY hKey,
-        LPCWSTR pSubKey,
-        LPCWSTR pValueName,
+        const wchar_t *pSubKey,
+        const wchar_t *pValueName,
        LPDWORD pType,
        LPDWORD pcbData);
 PVOID NtQueryKeyAlloc(
        HANDLE KeyHandle,
        KEY_INFORMATION_CLASS KeyInformationClass,
        PULONG pResultLength);
-LPWSTR ExpandEnvironmentStringsAlloc(LPCWSTR src, LPDWORD pcchLength);
+wchar_t *ExpandEnvironmentStringsAlloc(const wchar_t *src, LPDWORD pcchLength);
--- a/src/wufuc/hlpsvc.c
+++ b/src/wufuc/hlpsvc.c
@@ -68,12 +68,12 @@ bool QueryServiceStatusProcessInfoByName(

 bool QueryServiceGroupName(
        const LPQUERY_SERVICE_CONFIGW pServiceConfig,
-        LPWSTR *pGroupName,
+        wchar_t **pGroupName,
        HLOCAL *hMem)
 {
        bool result = false;
        int NumArgs;
-        LPWSTR *argv;
+        wchar_t **argv;

        argv = CommandLineToArgvW(pServiceConfig->lpBinaryPathName, &NumArgs);
        if ( argv ) {
@@ -126,7 +126,7 @@ DWORD HeuristicServiceGroupProcessId(SC_HANDLE hSCM, const wchar_t *pGroupNameSe
        DWORD cbBufSize;
        LPQUERY_SERVICE_CONFIGW pServiceConfig;
        bool success = false;
-        LPWSTR pGroupName;
+        wchar_t *pGroupName;
        HLOCAL hMem;

        pData = RegGetValueAlloc(HKEY_LOCAL_MACHINE,
@@ -165,7 +165,7 @@ DWORD HeuristicServiceProcessId(SC_HANDLE hSCM, SC_HANDLE hService)
 {
        DWORD result = 0;
        LPQUERY_SERVICE_CONFIGW pServiceConfig;
-        LPWSTR pGroupName;
+        wchar_t *pGroupName;
        HLOCAL hMem;

        result = QueryServiceProcessId(hSCM, hService);
--- a/src/wufuc/hlpsvc.h
+++ b/src/wufuc/hlpsvc.h
@@ -14,7 +14,7 @@ bool QueryServiceStatusProcessInfoByName(
        LPSERVICE_STATUS_PROCESS pServiceStatus);
 bool QueryServiceGroupName(
        const LPQUERY_SERVICE_CONFIGW pServiceConfig,
-        LPWSTR *pGroupName,
+        wchar_t **pGroupName,
        HLOCAL *hMem);
 DWORD QueryServiceProcessId(SC_HANDLE hSCM, SC_HANDLE hService);
 DWORD QueryServiceProcessIdByName(SC_HANDLE hSCM, const wchar_t *pServiceName);
--- a/src/wufuc/hlpver.c
+++ b/src/wufuc/hlpver.c
@@ -14,7 +14,7 @@ int ProductVersionCompare(VS_FIXEDFILEINFO *pffi, WORD wMajor, WORD wMinor, WORD
        return 0;
 }

-bool GetVersionInfoFromHModule(HMODULE hModule, LPCWSTR pszSubBlock, LPVOID pData, PUINT pcbData)
+bool GetVersionInfoFromHModule(HMODULE hModule, const wchar_t *pszSubBlock, LPVOID pData, PUINT pcbData)
 {
        bool result = false;
        UINT cbData;
@@ -68,7 +68,7 @@ cleanup:
        return result;
 }

-LPVOID GetVersionInfoFromHModuleAlloc(HMODULE hModule, LPCWSTR pszSubBlock, PUINT pcbData)
+LPVOID GetVersionInfoFromHModuleAlloc(HMODULE hModule, const wchar_t *pszSubBlock, PUINT pcbData)
 {
        UINT cbData = 0;
        LPVOID result = NULL;
--- a/src/wufuc/hlpver.h
+++ b/src/wufuc/hlpver.h
@@ -1,6 +1,6 @@
 #pragma once

 int ProductVersionCompare(VS_FIXEDFILEINFO *pffi, WORD wMajor, WORD wMinor, WORD wBuild, WORD wRev);
-bool GetVersionInfoFromHModule(HMODULE hModule, LPCWSTR pszSubBlock, LPVOID pData, PUINT pcbData);
-LPVOID GetVersionInfoFromHModuleAlloc(HMODULE hModule, LPCWSTR pszSubBlock, PUINT pcbData);
+bool GetVersionInfoFromHModule(HMODULE hModule, const wchar_t *pszSubBlock, LPVOID pData, PUINT pcbData);
+LPVOID GetVersionInfoFromHModuleAlloc(HMODULE hModule, const wchar_t *pszSubBlock, PUINT pcbData);
 bool IsWindowsVersion(WORD wMajorVersion, WORD wMinorVersion, WORD wServicePackMajor);
--- a/src/wufuc/hooks.c
+++ b/src/wufuc/hooks.c
@@ -1,17 +1,18 @@
 #include "stdafx.h"
-#include "hooks.h"
-#include "hlpmisc.h"
 #include "hlpmem.h"
+#include "hlpmisc.h"
+#include "hooks.h"

-LPWSTR g_pszWUServiceDll;
+wchar_t *g_pszWUServiceDll;

 LPFN_REGQUERYVALUEEXW g_pfnRegQueryValueExW;
 LPFN_LOADLIBRARYEXW g_pfnLoadLibraryExW;
 LPFN_ISDEVICESERVICEABLE g_pfnIsDeviceServiceable;
+LPFN_ISDEVICESERVICEABLE g_pfnIsDeviceServiceableLastKnown;

 LSTATUS WINAPI RegQueryValueExW_hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
 {
-        PWCH pBuffer;
+        wchar_t *pBuffer;
        DWORD MaximumLength = 0;
        LSTATUS result;
        ULONG ResultLength;
@@ -19,8 +20,8 @@ LSTATUS WINAPI RegQueryValueExW_hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpR
        size_t NameCount;
        int current;
        int pos;
-        LPWSTR fname;
-        const WCHAR realpath[] = L"%systemroot%\\system32\\wuaueng.dll";
+        wchar_t *fname;
+        const wchar_t realpath[] = L"%systemroot%\\system32\\wuaueng.dll";
        wchar_t *expandedpath;
        DWORD cchLength;

@@ -59,13 +60,17 @@ LSTATUS WINAPI RegQueryValueExW_hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpR
                        || !_wcsicmp(fname, L"WuaCpuFix.dll")) ) {

                        expandedpath = ExpandEnvironmentStringsAlloc(realpath, &cchLength);
+                        if ( expandedpath ) {
+                                if ( PathFileExistsW(expandedpath)
+                                        && SUCCEEDED(StringCbCopyW(pBuffer, MaximumLength, expandedpath)) ) {
                                        
-                        trace(L"Fixed path to wuauserv ServiceDll: %ls -> %ls", fname, PathFindFileNameW(expandedpath));
-                        if ( SUCCEEDED(StringCbCopyW(pBuffer, MaximumLength, expandedpath)) )
                                        *lpcbData = cchLength * (sizeof *expandedpath);
+                                        trace(L"Fixed path to Windows Update service library.");
+                                }
                                free(expandedpath);
                        }
                }
+        }
        free(pkni);
        return result;
 }
@@ -79,9 +84,10 @@ HMODULE WINAPI LoadLibraryExW_hook(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFla
        trace(L"Loaded library: %ls (%p)", lpFileName, result);

        if ( g_pszWUServiceDll
-                && !_wcsicmp(lpFileName, g_pszWUServiceDll) ) {
+                && (!_wcsicmp(lpFileName, g_pszWUServiceDll)
+                        || !_wcsicmp(lpFileName, PathFindFileNameW(g_pszWUServiceDll))) ) {

-                if ( FindIDSFunctionPointer(result, &(PVOID)g_pfnIsDeviceServiceable) ) {
+                if ( FindIDSFunctionAddress(result, &(PVOID)g_pfnIsDeviceServiceable) ) {
                        trace(L"Matched pattern for %ls!IsDeviceServiceable. (%p)",
                                PathFindFileNameW(lpFileName),
                                g_pfnIsDeviceServiceable);
--- a/src/wufuc/hooks.h
+++ b/src/wufuc/hooks.h
@@ -5,11 +5,12 @@ typedef LSTATUS(WINAPI *LPFN_REGQUERYVALUEEXW)(HKEY, LPCWSTR, LPDWORD, LPDWORD,
 typedef HMODULE(WINAPI *LPFN_LOADLIBRARYEXW)(LPCWSTR, HANDLE, DWORD);
 typedef BOOL(WINAPI *LPFN_ISDEVICESERVICEABLE)(void);

-extern LPWSTR g_pszWUServiceDll;
+extern wchar_t *g_pszWUServiceDll;

 extern LPFN_REGQUERYVALUEEXW g_pfnRegQueryValueExW;
 extern LPFN_LOADLIBRARYEXW g_pfnLoadLibraryExW;
 extern LPFN_ISDEVICESERVICEABLE g_pfnIsDeviceServiceable;
+extern LPFN_ISDEVICESERVICEABLE g_pfnIsDeviceServiceableLastKnown;

 LSTATUS WINAPI RegQueryValueExW_hook(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
 HMODULE WINAPI LoadLibraryExW_hook(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags);
--- a/src/wufuc/rundll32.c
+++ b/src/wufuc/rundll32.c
@@ -1,7 +1,7 @@
 #include "stdafx.h"
 #include "callbacks.h"
-#include "hlpmisc.h"
 #include "hlpmem.h"
+#include "hlpmisc.h"
 #include "hlpsvc.h"

 void CALLBACK RUNDLL32_StartW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, int nCmdShow)
@@ -17,18 +17,20 @@ void CALLBACK RUNDLL32_StartW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, in

        if ( !InitializeMutex(true,
                L"Global\\25020063-b5a7-4227-9fdf-25cb75e8c645",
-                &ctx.hParentMutex) ) {
-
-                trace(L"Failed to initialize main mutex. (GetLastError=%ul)", GetLastError());
+                &ctx.hParentMutex) )
                return;
-        };
+
+        if ( !start_traing() )
+                itrace(L"Could not create tracing pipe!");
+                return;
+
        if ( !CreateEventWithStringSecurityDescriptor(L"D:(A;;0x001F0003;;;BA)",
                true,
                false,
                L"Global\\wufuc_UnloadEvent",
                &ctx.hUnloadEvent) ) {

-                trace(L"Failed to create unload event. (GetLastError=%ul)", GetLastError());
+                trace(L"Failed to create unload event. (GetLastError=%lu)", GetLastError());
                goto close_mutex;
        }
        dwDesiredAccess = SERVICE_QUERY_STATUS | SERVICE_QUERY_CONFIG;
@@ -36,13 +38,13 @@ void CALLBACK RUNDLL32_StartW(HWND hwnd, HINSTANCE hinst, LPWSTR lpszCmdLine, in
                Lagging = false;
                hSCM = OpenSCManagerW(NULL, NULL, SC_MANAGER_ENUMERATE_SERVICE);
                if ( !hSCM ) {
-                        trace(L"Failed to open SCM. (GetLastError=%ul)", GetLastError());
+                        trace(L"Failed to open SCM. (GetLastError=%lu)", GetLastError());
                        goto close_event;
                }

                hService = OpenServiceW(hSCM, L"wuauserv", dwDesiredAccess);
                if ( !hService ) {
-                        trace(L"Failed to open service. (GetLastError=%ul)", GetLastError());
+                        trace(L"Failed to open service. (GetLastError=%lu)", GetLastError());
                        goto close_scm;
                }
                if ( (dwDesiredAccess & SERVICE_QUERY_CONFIG) == SERVICE_QUERY_CONFIG ) {
@@ -79,6 +81,8 @@ close_event:
        CloseHandle(ctx.hUnloadEvent);
 close_mutex:
        ReleaseMutex(ctx.hParentMutex);
+        if ( g_hTracingMutex )
+                CloseHandle(g_hTracingMutex);
        CloseHandle(ctx.hParentMutex);
 }

@@ -100,7 +104,7 @@ void CALLBACK RUNDLL32_DeleteFileW(
        int nCmdShow)
 {
        int argc;
-        LPWSTR *argv;
+        wchar_t **argv;

        argv = CommandLineToArgvW(lpszCmdLine, &argc);
        if ( argv ) {
--- a/src/wufuc/stdafx.h
+++ b/src/wufuc/stdafx.h
@@ -18,6 +18,8 @@
 #include <stdio.h>
 #include <stdbool.h>
 #include <stdint.h>
+#include <time.h>
+#include <share.h>

 #include <strsafe.h>
 #include <shellapi.h>
--- a/src/wufuc/tracing.c
+++ b/src/wufuc/tracing.c
@@ -1,7 +1,8 @@
 #include "stdafx.h"
 #include "tracing.h"
+#include <Shlobj.h>

-void trace_(const wchar_t *const format, ...)
+void itrace_(const wchar_t *const format, ...)
 {
        va_list argptr;
        int count;
@@ -17,3 +18,217 @@ void trace_(const wchar_t *const format, ...)
        OutputDebugStringW(buffer);
        free(buffer);
 }
+
+HANDLE g_hTracingMutex;
+wchar_t path[MAX_PATH];
+wchar_t exepath[MAX_PATH];
+
+DWORD WINAPI tracing_thread(LPVOID pParam)
+{
+        wchar_t *folder;
+        HANDLE file;
+        DWORD dwProcessId;
+        wchar_t *exename;
+        int count;
+
+        if ( !*path ) {
+                SHGetKnownFolderPath(&FOLDERID_ProgramData, 0, NULL, &folder);
+                wcscpy_s(path, _countof(path), folder);
+                CoTaskMemFree(folder);
+                PathAppendW(path, L"wufuc");
+                CreateDirectoryW(path, NULL);
+                PathAppendW(path, L"wufuc.log");
+        }
+        if ( !*exepath )
+                GetModuleFileNameW(NULL, exepath, _countof(exepath));
+
+        file = CreateFileW(path, FILE_APPEND_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+        itrace(L"CreateFileW=%p", file);
+        dwProcessId = GetCurrentProcessId();
+        exename = PathFindFileNameW(exepath);
+
+        va_start(argptr, format);
+        count = _vscwprintf(format, argptr) + 1;
+        buf1 = calloc(count, sizeof *buf1);
+        vswprintf_s(buf1, count, format, argptr);
+        va_end(argptr);
+
+        count = _scwprintf(fmt, datebuf, timebuf, dwProcessId, exename, buf1);
+        buf2 = calloc(count + 1, sizeof *buf2);
+        swprintf_s(buf2, count + 1, fmt, datebuf, timebuf, dwProcessId, exename, buf1);
+        free(buf1);
+        itrace(L"WriteFile=%d", WriteFile(file, buf2, count * (sizeof *buf2), &written, NULL));
+        free(buf2);
+        itrace(L"FlushFileBuffers=%d", FlushFileBuffers(file));
+        itrace(L"CloseHandle=%d", CloseHandle(file));
+        itrace(L"ReleaseMutex=%d", ReleaseMutex(g_hTracingMutex));
+
+
+        HANDLE hHeap = GetProcessHeap();
+        TCHAR* pchRequest = (TCHAR*)HeapAlloc(hHeap, 0, 512 * sizeof(TCHAR));
+
+        DWORD cbBytesRead = 0, cbReplyBytes = 0, cbWritten = 0;
+        BOOL fSuccess = FALSE;
+        HANDLE hPipe = NULL;
+
+        // Do some extra error checking since the app will keep running even if this
+        // thread fails.
+
+        if ( pParam == NULL ) {
+                itrace(L"\nERROR - Pipe Server Failure:");
+                itrace(L"   InstanceThread got an unexpected NULL value in lpvParam.");
+                itrace(L"   InstanceThread exitting.");
+                if ( pchRequest != NULL ) HeapFree(hHeap, 0, pchRequest);
+                return -1;
+        }
+
+        // Print verbose messages. In production code, this should be for debugging only.
+        printf("InstanceThread created, receiving and processing messages.\n");
+
+        // The thread's parameter is a handle to a pipe object instance. 
+
+        hPipe = (HANDLE)pParam;
+
+        // Loop until done reading
+        while ( true ) {
+                // Read client requests from the pipe. This simplistic code only allows messages
+                // up to BUFSIZE characters in length.
+                fSuccess = ReadFile(
+                        hPipe,        // handle to pipe 
+                        pchRequest,    // buffer to receive data 
+                        512 * sizeof(TCHAR), // size of buffer 
+                        &cbBytesRead, // number of bytes read 
+                        NULL);        // not overlapped I/O 
+
+                if ( !fSuccess || cbBytesRead == 0 ) {
+                        if ( GetLastError() == ERROR_BROKEN_PIPE ) {
+                                itrace(L"InstanceThread: client disconnected.");
+                        } else {
+                                itrace(L"InstanceThread ReadFile failed, GLE=%d.", GetLastError());
+                        }
+                        break;
+                }
+
+                _wstrdate_s(datebuf, _countof(datebuf));
+                _wstrtime_s(timebuf, _countof(timebuf));
+
+                if ( !fSuccess ) {
+                        itrace(L"InstanceThread WriteFile failed, GLE=%d.", GetLastError());
+                        break;
+                }
+        }
+
+        // Flush the pipe to allow the client to read the pipe's contents 
+        // before disconnecting. Then disconnect the pipe, and close the 
+        // handle to this pipe instance. 
+
+        FlushFileBuffers(hPipe);
+        DisconnectNamedPipe(hPipe);
+        CloseHandle(hPipe);
+
+        HeapFree(hHeap, 0, pchRequest);
+
+        printf("InstanceThread exitting.\n");
+        return 1;
+}
+
+bool start_tracing(const wchar_t *pipename)
+{
+        HANDLE hPipe;
+        HANDLE hPipe = INVALID_HANDLE_VALUE;
+        HANDLE hThread = NULL;
+
+        while ( true ) {
+                hPipe = CreateNamedPipeW(pipename,
+                        PIPE_ACCESS_INBOUND, 0, PIPE_UNLIMITED_INSTANCES, 512, 0, 512, NULL);
+                if ( hPipe == INVALID_HANDLE_VALUE ) {
+                        itrace(L"CreateNamedPipe failed, GLE=%d.\n"), GetLastError();
+                        return false;
+                }
+
+                if ( ConnectNamedPipe(hPipe, NULL) ||
+                        GetLastError() == ERROR_PIPE_CONNECTED ) {
+                        itrace(L"Client connected, creating a processing thread.");
+
+                        // Create a thread for this client. 
+                        hThread = CreateThread(
+                                NULL,             // no security attribute 
+                                0,                // default stack size 
+                                tracing_thread,   // thread proc
+                                (LPVOID)hPipe,    // thread parameter 
+                                0,                // not suspended 
+                                NULL);            // returns thread ID 
+
+                        if ( hThread == NULL ) {
+                                itrace(L"CreateThread failed, GLE=%d.\n"), GetLastError();
+                                return false;
+                        } else {
+                                CloseHandle(hThread);
+                        }
+                } else {
+                        // The client could not connect, so close the pipe. 
+                        CloseHandle(hPipe);
+                }
+        }
+        return true;
+}
+
+void trace_(const wchar_t *const format, ...)
+{
+        va_list argptr;
+        wchar_t *folder;
+        wchar_t datebuf[9];
+        wchar_t timebuf[9];
+        HANDLE file;
+        DWORD dwProcessId;
+        wchar_t *exename;
+        int count;
+        DWORD written;
+        const wchar_t fmt[] = L"%ls %ls [%lu] Exe(%ls) %ls";
+        wchar_t *buf1;
+        wchar_t *buf2;
+
+        va_start(argptr, format);
+        itrace_(format);
+        va_end(argptr);
+
+        if ( !*path ) {
+                SHGetKnownFolderPath(&FOLDERID_ProgramData, 0, NULL, &folder);
+                wcscpy_s(path, _countof(path), folder);
+                CoTaskMemFree(folder);
+                PathAppendW(path, L"wufuc");
+                CreateDirectoryW(path, NULL);
+                PathAppendW(path, L"wufuc.log");
+        }
+        if ( !*exepath )
+                GetModuleFileNameW(NULL, exepath, _countof(exepath));
+
+        if ( !g_hTracingMutex )
+                g_hTracingMutex = CreateMutexW(NULL, FALSE, L"Global\\6b2f5740-7435-47f7-865c-dbd825292f32");
+
+        itrace(L"WaitForSingleObject=%lu", WaitForSingleObject(g_hTracingMutex, INFINITE));
+
+        _wstrdate_s(datebuf, _countof(datebuf));
+        _wstrtime_s(timebuf, _countof(timebuf));
+
+        file = CreateFileW(path, FILE_APPEND_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+        itrace(L"CreateFileW=%p", file);
+        dwProcessId = GetCurrentProcessId();
+        exename = PathFindFileNameW(exepath);
+
+        va_start(argptr, format);
+        count = _vscwprintf(format, argptr) + 1;
+        buf1 = calloc(count, sizeof *buf1);
+        vswprintf_s(buf1, count, format, argptr);
+        va_end(argptr);
+
+        count = _scwprintf(fmt, datebuf, timebuf, dwProcessId, exename, buf1);
+        buf2 = calloc(count + 1, sizeof *buf2);
+        swprintf_s(buf2, count + 1, fmt, datebuf, timebuf, dwProcessId, exename, buf1);
+        free(buf1);
+        itrace(L"WriteFile=%d", WriteFile(file, buf2, count * (sizeof *buf2), &written, NULL));
+        free(buf2);
+        itrace(L"FlushFileBuffers=%d", FlushFileBuffers(file));
+        itrace(L"CloseHandle=%d", CloseHandle(file));
+        itrace(L"ReleaseMutex=%d", ReleaseMutex(g_hTracingMutex));
+}
--- a/src/wufuc/tracing.h
+++ b/src/wufuc/tracing.h
@@ -2,13 +2,14 @@

 #include <phnt_windows.h>

-extern IMAGE_DOS_HEADER __ImageBase;
-#define HMODULE_THISCOMPONENT ((HMODULE)&__ImageBase);
+extern HANDLE g_hTracingMutex;

+void itrace_(const wchar_t *const format, ...);
 void trace_(const wchar_t *const format, ...);

 #define STRINGIZEW_(x) L#x
 #define STRINGIZEW(x) STRINGIZEW_(x)

 #define LINEWSTR STRINGIZEW(__LINE__)
-#define trace(format, ...) trace_(__FILEW__ L":" LINEWSTR L"(" __FUNCTIONW__ L"): " format L"\n", ##__VA_ARGS__)
+#define itrace(format, ...) itrace_(__FILEW__ L":" LINEWSTR L"(" __FUNCTIONW__ L"): " format L"\r\n", ##__VA_ARGS__)
+#define trace(format, ...) trace_(__FILEW__ L":" LINEWSTR L"(" __FUNCTIONW__ L"): " format L"\r\n", ##__VA_ARGS__)
--- a/src/wufuc_setup/wufuc_setup.aip
+++ b/src/wufuc_setup/wufuc_setup.aip
@@ -8,6 +8,7 @@
    <ROW Property="AI_ThemeStyle" Value="aero" MsiKey="AI_ThemeStyle"/>
    <ROW Property="ALLUSERS" Value="1"/>
    <ROW Property="ARPCOMMENTS" Value="Enables Windows Update on PCs with unsupported processors." ValueLocId="*"/>
+    <ROW Property="ARPCONTACT" Value="https://t.me/joinchat/HEo6LUvV_83O92WzbYXLeQ"/>
    <ROW Property="ARPHELPLINK" Value="https://github.com/zeffy/wufuc/issues"/>
    <ROW Property="ARPNOMODIFY" MultiBuildValue="x64Build:1"/>
    <ROW Property="ARPPRODUCTICON" Value="msiexec.exe" Type="8"/>
@@ -24,16 +25,16 @@
    <ROW Property="UpgradeCode" Value="{4C52972C-251E-4D1B-AD09-EAA765719DCC}"/>
    <ROW Property="WindowsType9X" MultiBuildValue="x64Build:Windows 9x/ME#x86Build:Windows 9x/ME" ValueLocId="-"/>
    <ROW Property="WindowsType9XDisplay" MultiBuildValue="x64Build:Windows 9x/ME#x86Build:Windows 9x/ME" ValueLocId="-"/>
-    <ROW Property="WindowsTypeNT" MultiBuildValue="x64Build:Windows XP SP3 x86, Windows Server 2003 SP2 x86, Windows Vista x86, Windows Server 2008 x86, Windows 8 x86, Windows 10 x86#x86Build:Windows XP SP3 x86, Windows Server 2003 SP2 x86, Windows Vista x86, Windows Server 2008 x86, Windows 8 x86, Windows 10 x86" ValueLocId="-"/>
+    <ROW Property="WindowsTypeNT" MultiBuildValue="x64Build:Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86#x86Build:Windows XP SP3 x86, Windows Server 2003 SP2 x86, Windows Vista x86, Windows Server 2008 x86, Windows 8 x86, Windows 10 x86" ValueLocId="-"/>
    <ROW Property="WindowsTypeNT40" MultiBuildValue="x64Build:Windows NT 4.0#x86Build:Windows NT 4.0" ValueLocId="-"/>
    <ROW Property="WindowsTypeNT40Display" MultiBuildValue="x64Build:Windows NT 4.0#x86Build:Windows NT 4.0" ValueLocId="-"/>
    <ROW Property="WindowsTypeNT50" MultiBuildValue="x64Build:Windows 2000#x86Build:Windows 2000" ValueLocId="-"/>
    <ROW Property="WindowsTypeNT50Display" MultiBuildValue="x64Build:Windows 2000#x86Build:Windows 2000" ValueLocId="-"/>
    <ROW Property="WindowsTypeNT5X" MultiBuildValue="x64Build:Windows XP/2003 RTM, Windows XP/2003 SP1, Windows XP SP2 x86#x86Build:Windows XP/2003 RTM, Windows XP/2003 SP1, Windows XP SP2 x86" ValueLocId="-"/>
    <ROW Property="WindowsTypeNT5XDisplay" MultiBuildValue="x64Build:Windows XP/2003 RTM, Windows XP/2003 SP1, Windows XP SP2 x86#x86Build:Windows XP/2003 RTM, Windows XP/2003 SP1, Windows XP SP2 x86" ValueLocId="-"/>
-    <ROW Property="WindowsTypeNT64" MultiBuildValue="x64Build:Windows XP SP2 x64, Windows Server 2003 SP2 x64, Windows Vista x64, Windows Server 2008 x64, Windows 8 x64, Windows Server 2012 x64, Windows 10 x64, Windows Server 2016 x64#x86Build:Windows XP SP2 x64, Windows Server 2003 SP2 x64, Windows Vista x64, Windows Server 2008 x64, Windows 8 x64, Windows Server 2012 x64, Windows 10 x64, Windows Server 2016 x64" ValueLocId="-"/>
-    <ROW Property="WindowsTypeNT64Display" MultiBuildValue="x64Build:Windows XP SP2 x64, Windows Server 2003 SP2 x64, Windows Vista x64, Windows Server 2008 x64, Windows 8 x64, Windows Server 2012 x64, Windows 10 x64, Windows Server 2016 x64#x86Build:Windows XP SP2 x64, Windows Server 2003 SP2 x64, Windows Vista x64, Windows Server 2008 x64, Windows 8 x64, Windows Server 2012 x64, Windows 10 x64, Windows Server 2016 x64" ValueLocId="-"/>
-    <ROW Property="WindowsTypeNTDisplay" MultiBuildValue="x64Build:Windows XP SP3 x86, Windows Server 2003 SP2 x86, Windows Vista x86, Windows Server 2008 x86, Windows 8 x86, Windows 10 x86#x86Build:Windows XP SP3 x86, Windows Server 2003 SP2 x86, Windows Vista x86, Windows Server 2008 x86, Windows 8 x86, Windows 10 x86" ValueLocId="-"/>
+    <ROW Property="WindowsTypeNT64" MultiBuildValue="x64Build:Windows XP SP2 x64, Windows Server 2003 SP2 x64, Windows Vista x64, Windows Server 2008 x64, Windows 8 x64, Windows Server 2012 x64, Windows 10 x64, Windows Server 2016 x64#x86Build:Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64" ValueLocId="-"/>
+    <ROW Property="WindowsTypeNT64Display" MultiBuildValue="x64Build:Windows XP SP2 x64, Windows Server 2003 SP2 x64, Windows Vista x64, Windows Server 2008 x64, Windows 8 x64, Windows Server 2012 x64, Windows 10 x64, Windows Server 2016 x64#x86Build:64-bit Windows versions" ValueLocId="-"/>
+    <ROW Property="WindowsTypeNTDisplay" MultiBuildValue="x64Build:32-bit Windows versions#x86Build:Windows XP SP3 x86, Windows Server 2003 SP2 x86, Windows Vista x86, Windows Server 2008 x86, Windows 8 x86, Windows 10 x86" ValueLocId="-"/>
    <ROW Property="wufuc_TaskName" Value="wufuc.{72EEE38B-9997-42BD-85D3-2DD96DA17307}"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiDirsComponent">
@@ -61,12 +62,15 @@
    <ROW File="wufuc32.dll" Component_="wufuc32.dll" FileName="wufuc32.dll" Attributes="0" SourcePath="wufuc32.dll" SelfReg="false" NextFile="wufuc64.dll"/>
    <ROW File="wufuc64.dll" Component_="wufuc64.dll" FileName="wufuc64.dll" Attributes="0" SourcePath="wufuc64.dll" SelfReg="false"/>
  </COMPONENT>
+  <COMPONENT cid="caphyon.advinst.custcomp.MsiShortcutPropertyComponent">
+    <ROW MsiShortcutProperty="Uninstallwufuc1" Shortcut_="Uninstallwufuc" PropertyKey="[AiPreventAutoPin]" PropVariantValue="1"/>
+  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.BootstrOptComponent">
    <ROW BootstrOptKey="GlobalOptions" DownloadFolder="[AppDataFolder][|Manufacturer]\[|ProductName]\prerequisites" Options="2"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.BuildComponent">
-    <ROW BuildKey="x64Build" BuildName="x64" BuildOrder="1" BuildType="1" PackageFileName="[|ProductName]_v[|ProductVersion]-[|AI_BUILD_NAME]" Languages="en;ca;zh;zh_TW;nl;fi;fr;de;hu;it;ja;ko;pl;pt;pt_BR;ru;sl;es" LangOpt="1" InstallationType="4" UseLargeSchema="true" MsiPackageType="x64"/>
-    <ROW BuildKey="x86Build" BuildName="x86" BuildOrder="2" BuildType="1" PackageFileName="[|ProductName]_v[|ProductVersion]-[|AI_BUILD_NAME]" Languages="en;ca;zh;zh_TW;nl;fi;fr;de;hu;it;ja;ko;pl;pt;pt_BR;ru;sl;es" LangOpt="1" InstallationType="4" UseLargeSchema="true"/>
+    <ROW BuildKey="x64Build" BuildName="x64" BuildOrder="1" BuildType="1" PackageFileName="wufuc_v[|ProductVersion]-[|AI_BUILD_NAME]" Languages="en;ca;zh;zh_TW;nl;fi;fr;de;hu;it;ja;ko;pl;pt;pt_BR;ru;sl;es" LangOpt="1" InstallationType="4" UseLargeSchema="true" MsiPackageType="x64"/>
+    <ROW BuildKey="x86Build" BuildName="x86" BuildOrder="2" BuildType="1" PackageFileName="wufuc_v[|ProductVersion]-[|AI_BUILD_NAME]" Languages="en;ca;zh;zh_TW;nl;fi;fr;de;hu;it;ja;ko;pl;pt;pt_BR;ru;sl;es" LangOpt="1" InstallationType="4" UseLargeSchema="true"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.DictionaryComponent">
    <ROW Path="&lt;AI_DICTS&gt;ui.ail"/>
@@ -114,6 +118,7 @@
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiBinaryComponent">
    <ROW Name="AdvancedInstallerHelper.dll" SourcePath="AdvancedInstallerHelper.dll"/>
+    <ROW Name="Prereq.dll" SourcePath="&lt;AI_CUSTACTS&gt;Prereq.dll"/>
    <ROW Name="ShortcutFlags.dll" SourcePath="&lt;AI_CUSTACTS&gt;ShortcutFlags.dll"/>
    <ROW Name="aicustact.dll" SourcePath="&lt;AI_CUSTACTS&gt;aicustact.dll"/>
    <ROW Name="viewer.exe" SourcePath="&lt;AI_CUSTACTS&gt;viewer.exe"/>
@@ -154,6 +159,7 @@
    <ROW Directory_="X64FeatureItems_Dir" Component_="X64FeatureItems" ManualDelete="false"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiCustActComponent">
+    <ROW Action="AI_AppSearchEx" Type="1" Source="Prereq.dll" Target="DoAppSearchEx"/>
    <ROW Action="AI_ApplyShortcutFlags" Type="3073" Source="ShortcutFlags.dll" Target="UpdateShortcutFlags" WithoutSeq="true"/>
    <ROW Action="AI_BACKUP_AI_SETUPEXEPATH" Type="51" Source="AI_SETUPEXEPATH_ORIGINAL" Target="[AI_SETUPEXEPATH]"/>
    <ROW Action="AI_DATA_SETTER" Type="51" Source="CustomActionData" Target="[~]"/>
@@ -187,10 +193,12 @@
    <ROW Action="AdvancedInstallerHelper.dll" Type="3073" Source="AdvancedInstallerHelper.dll" Target="UnloadCustomAction"/>
    <ROW Action="CreateScheduledTask" Type="3074" Source="viewer.exe" Target="/HideWindow schtasks.exe /Create /XML &quot;[APPDIR]wufuc_ScheduledTask.xml&quot; /TN &quot;[wufuc_TaskName]&quot; /F" Options="1"/>
    <ROW Action="DeleteScheduledTask" Type="3138" Source="viewer.exe" Target="/HideWindow schtasks.exe /Delete /TN &quot;[wufuc_TaskName]&quot; /F" Options="1"/>
+    <ROW Action="RunSFCScan" Type="3138" Source="viewer.exe" Target="/HideWindow sfc.exe /SCANFILE=c:\windows\system32\wuaueng.dll" Options="1"/>
    <ROW Action="RunScheduledTask" Type="3074" Source="viewer.exe" Target="/HideWindow schtasks.exe /Run /TN &quot;[wufuc_TaskName]&quot;" Options="1"/>
    <ROW Action="SET_APPDIR" Type="307" Source="APPDIR" Target="[ProgramFilesFolder][Manufacturer]\[ProductName]" MultiBuildTarget="x64Build:[ProgramFiles64Folder]\[ProductName]#x86Build:[ProgramFilesFolder]\[ProductName]"/>
    <ROW Action="SET_SHORTCUTDIR" Type="307" Source="SHORTCUTDIR" Target="[ProgramMenuFolder][ProductName]"/>
    <ROW Action="SET_TARGETDIR_TO_APPDIR" Type="51" Source="TARGETDIR" Target="[APPDIR]"/>
+    <ROW Action="SetRebootProperty" Type="51" Source="REBOOT" Target="Force"/>
    <ROW Action="StartWindowsUpdateService" Type="3073" Source="aicustact.dll" Target="StartWinService" Options="1" AdditionalSeq="AI_DATA_SETTER_3"/>
    <ROW Action="StopWindowsUpdateService" Type="3073" Source="aicustact.dll" Target="StopWinService" Options="1" AdditionalSeq="AI_DATA_SETTER_2"/>
  </COMPONENT>
@@ -201,9 +209,11 @@
    <ROW IniFile="URL" FileName="Donate.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://github.com/zeffy/wufuc/blob/master/DONATE.md" Action="0" Component_="SHORTCUTDIR"/>
    <ROW IniFile="URL_1" FileName="Homepage.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://github.com/zeffy/wufuc" Action="0" Component_="SHORTCUTDIR"/>
    <ROW IniFile="URL_2" FileName="Readme.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://github.com/zeffy/wufuc/blob/master/README.md" Action="0" Component_="SHORTCUTDIR"/>
+    <ROW IniFile="URL_3" FileName="TRANSL~1.URL|Translations.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="URL" Value="https://github.com/zeffy/wufuc/wiki" Action="0" Component_="X64FeatureItems"/>
    <ROW IniFile="WorkingDirectory" FileName="Donate.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="WorkingDirectory" Value="[SHORTCUTDIR]" Action="0" Component_="SHORTCUTDIR"/>
    <ROW IniFile="WorkingDirectory_1" FileName="Homepage.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="WorkingDirectory" Value="[SHORTCUTDIR]" Action="0" Component_="SHORTCUTDIR"/>
    <ROW IniFile="WorkingDirectory_2" FileName="Readme.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="WorkingDirectory" Value="[SHORTCUTDIR]" Action="0" Component_="SHORTCUTDIR"/>
+    <ROW IniFile="WorkingDirectory_3" FileName="TRANSL~1.URL|Translations.url" DirProperty="SHORTCUTDIR" Section="InternetShortcut" Key="WorkingDirectory" Value="[SHORTCUTDIR]" Action="0" Component_="X64FeatureItems"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiInstExSeqComponent">
    <ROW Action="AI_DOWNGRADE" Condition="AI_NEWERPRODUCTFOUND AND (UILevel &lt;&gt; 5)" Sequence="210"/>
@@ -221,13 +231,16 @@
    <ROW Action="AI_XmlUninstall" Condition="(REMOVE)" Sequence="3102"/>
    <ROW Action="AI_DATA_SETTER_1" Condition="(REMOVE)" Sequence="3101"/>
    <ROW Action="CreateScheduledTask" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE &lt;&gt; &quot;ALL&quot; AND AI_INSTALL_MODE &lt;&gt; &quot;Remove&quot; ) )" Sequence="5826"/>
-    <ROW Action="DeleteScheduledTask" Sequence="3603"/>
+    <ROW Action="DeleteScheduledTask" Sequence="3604"/>
    <ROW Action="AdvancedInstallerHelper.dll" Sequence="1601"/>
-    <ROW Action="StopWindowsUpdateService" Sequence="3602"/>
-    <ROW Action="AI_DATA_SETTER_2" Sequence="3601"/>
-    <ROW Action="StartWindowsUpdateService" Sequence="6402"/>
-    <ROW Action="AI_DATA_SETTER_3" Sequence="6401"/>
+    <ROW Action="StopWindowsUpdateService" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE &lt;&gt; &quot;ALL&quot; AND AI_INSTALL_MODE &lt;&gt; &quot;Remove&quot; ) )" Sequence="3602"/>
+    <ROW Action="AI_DATA_SETTER_2" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE &lt;&gt; &quot;ALL&quot; AND AI_INSTALL_MODE &lt;&gt; &quot;Remove&quot; ) )" Sequence="3601"/>
    <ROW Action="RunScheduledTask" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE &lt;&gt; &quot;ALL&quot; AND AI_INSTALL_MODE &lt;&gt; &quot;Remove&quot; ) )" Sequence="5827"/>
+    <ROW Action="RunSFCScan" Sequence="3603"/>
+    <ROW Action="AI_AppSearchEx" Sequence="101"/>
+    <ROW Action="SetRebootProperty" Condition="NONDEFAULT_SERVICEDLL" Sequence="201"/>
+    <ROW Action="StartWindowsUpdateService" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE &lt;&gt; &quot;ALL&quot; AND AI_INSTALL_MODE &lt;&gt; &quot;Remove&quot; ) )" Sequence="6402"/>
+    <ROW Action="AI_DATA_SETTER_3" Condition="( ( NOT Installed ) OR ( Installed AND REMOVE &lt;&gt; &quot;ALL&quot; AND AI_INSTALL_MODE &lt;&gt; &quot;Remove&quot; ) )" Sequence="6401"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiInstallUISequenceComponent">
    <ROW Action="AI_RESTORE_LOCATION" Condition="APPDIR=&quot;&quot;" Sequence="749"/>
@@ -235,19 +248,22 @@
    <ROW Action="AI_DpiContentScale" Sequence="52"/>
    <ROW Action="AI_EnableDebugLog" Sequence="51"/>
    <ROW Action="AI_BACKUP_AI_SETUPEXEPATH" Sequence="99"/>
-    <ROW Action="AI_RESTORE_AI_SETUPEXEPATH" Condition="AI_SETUPEXEPATH_ORIGINAL" Sequence="101"/>
+    <ROW Action="AI_RESTORE_AI_SETUPEXEPATH" Condition="AI_SETUPEXEPATH_ORIGINAL" Sequence="102"/>
+    <ROW Action="AI_AppSearchEx" Sequence="101"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiLaunchConditionsComponent">
-    <ROW Condition="( Version9X OR ( NOT VersionNT64 ) OR ( VersionNT64 AND ((VersionNT64 &lt;&gt; 502) OR (ServicePackLevel &lt;&gt; 2) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 502) OR (ServicePackLevel &lt;&gt; 2) OR (MsiNTProductType = 1)) AND ((VersionNT64 &lt;&gt; 600) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 600) OR (MsiNTProductType = 1)) AND ((VersionNT64 &lt;&gt; 602) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 602) OR (MsiNTProductType = 1)) AND ((VersionNT64 &lt;&gt; 1000) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 1000) OR (ServicePackLevel &lt;&gt; 0) OR (MsiNTProductType = 1)) ) )" Description="[ProductName] cannot be installed on the following Windows versions: [WindowsTypeNT64Display]." DescriptionLocId="AI.LaunchCondition.NoSpecificNT64" IsPredefined="true" Builds="x64Build;x86Build"/>
-    <ROW Condition="( Version9X OR VersionNT64 OR ( VersionNT AND ((VersionNT &lt;&gt; 501) OR (ServicePackLevel &lt;&gt; 3)) AND ((VersionNT &lt;&gt; 502) OR (ServicePackLevel &lt;&gt; 2)) AND ((VersionNT &lt;&gt; 600) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT &lt;&gt; 600) OR (MsiNTProductType = 1)) AND (VersionNT &lt;&gt; 602) AND (VersionNT &lt;&gt; 1000) ) )" Description="[ProductName] cannot be installed on the following Windows versions: [WindowsTypeNTDisplay]." DescriptionLocId="AI.LaunchCondition.NoSpecificNT" IsPredefined="true" Builds="x64Build;x86Build"/>
+    <ROW Condition="( Version9X OR ( NOT VersionNT64 ) OR ( VersionNT64 AND ((VersionNT64 &lt;&gt; 502) OR (ServicePackLevel &lt;&gt; 2) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 502) OR (ServicePackLevel &lt;&gt; 2) OR (MsiNTProductType = 1)) AND ((VersionNT64 &lt;&gt; 600) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 600) OR (MsiNTProductType = 1)) AND ((VersionNT64 &lt;&gt; 602) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 602) OR (MsiNTProductType = 1)) AND ((VersionNT64 &lt;&gt; 1000) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT64 &lt;&gt; 1000) OR (ServicePackLevel &lt;&gt; 0) OR (MsiNTProductType = 1)) ) )" Description="[ProductName] cannot be installed on the following Windows versions: [WindowsTypeNT64Display]." DescriptionLocId="AI.LaunchCondition.NoSpecificNT64" IsPredefined="true" Builds="x64Build"/>
+    <ROW Condition="( Version9X OR (VersionNT AND (NOT VersionNT64)) )" Description="[ProductName] cannot be installed on [WindowsTypeNT64Display]." DescriptionLocId="AI.LaunchCondition.NoNT64" IsPredefined="true" Builds="x86Build"/>
+    <ROW Condition="( Version9X OR VersionNT64 )" Description="[ProductName] cannot be installed on [WindowsTypeNTDisplay]." DescriptionLocId="AI.LaunchCondition.NoNT" IsPredefined="true" Builds="x64Build"/>
+    <ROW Condition="( Version9X OR VersionNT64 OR ( VersionNT AND ((VersionNT &lt;&gt; 501) OR (ServicePackLevel &lt;&gt; 3)) AND ((VersionNT &lt;&gt; 502) OR (ServicePackLevel &lt;&gt; 2)) AND ((VersionNT &lt;&gt; 600) OR (MsiNTProductType &lt;&gt; 1)) AND ((VersionNT &lt;&gt; 600) OR (MsiNTProductType = 1)) AND (VersionNT &lt;&gt; 602) AND (VersionNT &lt;&gt; 1000) ) )" Description="[ProductName] cannot be installed on the following Windows versions: [WindowsTypeNTDisplay]." DescriptionLocId="AI.LaunchCondition.NoSpecificNT" IsPredefined="true" Builds="x86Build"/>
    <ROW Condition="(VersionNT &lt;&gt; 400)" Description="[ProductName] cannot be installed on [WindowsTypeNT40Display]." DescriptionLocId="AI.LaunchCondition.NoNT40" IsPredefined="true" Builds="x64Build;x86Build"/>
    <ROW Condition="(VersionNT &lt;&gt; 500)" Description="[ProductName] cannot be installed on [WindowsTypeNT50Display]." DescriptionLocId="AI.LaunchCondition.NoNT50" IsPredefined="true" Builds="x64Build;x86Build"/>
    <ROW Condition="(VersionNT64 OR ((VersionNT &lt;&gt; 501) OR (ServicePackLevel = 3))) AND ((VersionNT &lt;&gt; 502) OR (ServicePackLevel = 2))" Description="[ProductName] cannot be installed on [WindowsTypeNT5XDisplay]." DescriptionLocId="AI.LaunchCondition.NoNT5X" IsPredefined="true" Builds="x64Build;x86Build"/>
    <ROW Condition="VersionNT" Description="[ProductName] cannot be installed on [WindowsType9XDisplay]." DescriptionLocId="AI.LaunchCondition.No9X" IsPredefined="true" Builds="x64Build;x86Build"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiRegsComponent">
-    <ROW Registry="Path" Root="-1" Key="Software\[Manufacturer]\[ProductName]" Name="Path" Value="[APPDIR]" Component_="ProductInformation"/>
-    <ROW Registry="Version" Root="-1" Key="Software\[Manufacturer]\[ProductName]" Name="Version" Value="[ProductVersion]" Component_="ProductInformation"/>
+    <ROW Registry="Path" Root="-1" Key="Software\[ProductName]" Name="Path" Value="[APPDIR]" Component_="ProductInformation"/>
+    <ROW Registry="Version" Root="-1" Key="Software\[ProductName]" Name="Version" Value="[ProductVersion]" Component_="ProductInformation"/>
  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.MsiShortsComponent">
    <ROW Shortcut="Uninstallwufuc" Directory_="SHORTCUTDIR" Name="UNINST~2|Uninstall [|ProductName]" Component_="ProductInformation" Target="[SystemFolder]msiexec.exe" Arguments="/x [ProductCode]" Hotkey="0" Icon_="msiexec.exe" IconIndex="0" ShowCmd="1" CustomFlags="1"/>
@@ -259,6 +275,9 @@
    <ROW UpgradeCode="[|UpgradeCode]" VersionMin="0.0.1" VersionMax="[|ProductVersion]" Attributes="257" ActionProperty="OLDPRODUCTS"/>
    <ROW UpgradeCode="[|UpgradeCode]" VersionMin="[|ProductVersion]" Attributes="2" ActionProperty="AI_NEWERPRODUCTFOUND"/>
  </COMPONENT>
+  <COMPONENT cid="caphyon.advinst.msicomp.PreReqSearchComponent">
+    <ROW SearchKey="_" SearchType="9" SearchString="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wuauserv\Parameters\ServiceDll" RefContent="D%systemroot%\system32\wuaueng.dll" Order="1" Property="NONDEFAULT_SERVICEDLL"/>
+  </COMPONENT>
  <COMPONENT cid="caphyon.advinst.msicomp.XmlAttributeComponent">
    <ROW XmlAttribute="Context" XmlElement="Actions" Name="Context" Flags="14" Order="0" Value="Author"/>
    <ROW XmlAttribute="Context_1" XmlElement="Actions_1" Name="Context" Flags="14" Order="0" Value="Author"/>
--- a/src/wufuc_setup_bat/.gitignore
+++ b/src/wufuc_setup_bat/.gitignore
@@ -1,3 +1,4 @@
 # Other
 *.dll
+*.exe
 *.zip