Detailed information for developers who use the Windows Update offline scan file

View products that this article applies to.

SUMMARY

In November 2006, a new version of the Windows Update (WU) offline scan file was released together with the existing WU offline scan file, Wsusscan.cab. The new WU offline scan file, Wsusscn2.cab, has a new format. Any scanning solution that uses the existing WU offline scan file must to be updated to use the new WU offline scan file by March 2007.

Any non-Microsoft solution that uses the WU offline scan file must have the updated Windows Update Agent (WUA) installed for all Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003 operating systems. Computers that have Windows Vista installed will have the updated WUA when the operating system releases. Therefore, Windows Vista will not require an update.

Some non-Microsoft solutions that use the WU offline scan file for offline security update detection may also require the updated version. These solutions need these updated version of the WU offline scan file if they read this file instead of using the Windows Update API. We do not recommend that these solutions read this file directly because the file is subject to change. Instead, we recommend that developers use the WUA offline scan feature. For information about this feature, visit the following MSDN Web site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx (http://msdn2.microsoft.com/en-us/library/aa387099.aspx)

Back to the top

MORE INFORMATION

Microsoft has changed the internal format of the WU offline scan file to solve the problem that is explained in Microsoft Knowledge Base article 926464. Any non-Microsoft solutions that access the this file in ways that are not documented in the public API may require the updated file.

All products, tools, and solutions that use the Wsusscan.cab file by using the documented WUA API must be updated by March 2007. These products, tools, and solutions must be able to use the new Wsusscn2.cab file to download the Wsusscn2.cab file from the new location. Also, all client computers must have the necessary updated WUA client computer version installed. Any Microsoft solutions that access the CAB file directly may need additional changes because of the internal format changes.

Back to the top

Directly accessing the Wsusscn2.cab file

We do not recommend that you access the Wsusscn2.cab file directly because the format of the file is liable to change. However, this article includes information for developers who have existing solutions that directly access the file.

Back to the top

Determine whether the WUA version is the correct version for the Wsusscn2.cab file

If the version of WUA that is installed on the computer does not meet the minimum version requirement of the corresponding scan package format, the installed WUA version will not work with the scan package and the installed version may return WU_E_OL_NEWCLIENT_REQUIRED and other HRESULT codes from its scan package related APIs. In the worst case, the installed version of the WUA API may not support any scan package related functionality. For example, the WUA API may not support the IUpdateServiceManager interface. For information about how to avoid this behavior, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx (http://msdn2.microsoft.com/en-us/library/aa387099.aspx)

This information will help you learn about how the application may set up the latest version of WUA on the computer.

The application may set up the latest version of WUA on the computer before it uses scan packages with the WUA API. For information about how to use scan packages to scan for updates in an offline environment, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa387290.aspx (http://msdn2.microsoft.com/en-us/library/aa387290.aspx)

For more information about the IUpdateCollection interface, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa386107.aspx (http://msdn2.microsoft.com/en-us/library/aa386107.aspx)

For more information about the scan package, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa386821.aspx (http://msdn2.microsoft.com/en-us/library/aa386821.aspx)

For more information about the WUA API, visit the following Web site:

http://msdn2.microsoft.com/en-us/library/aa387099.aspx (http://msdn2.microsoft.com/en-us/library/aa387099.aspx)

Back to the top

Changes in the CAB file format

The Wsusscan.cab file contains a single CAB file. This file is Package.cab. The Wsusscn2.cab file contains the following files:

An Index.xml file. This file contains the following components:
- <Index> element
  Version attribute (number)
  Required? Yes
  Meaning: The version number that uses the format of the Index.xml file
  Remarks: This value has to be numerically equivalent to Version="1"
- <CabList> element
  Xor attribute (number)
  Required? No
  Default value: Xor="0"
  Meaning:
  - Xor="1" indicates that all the CAB files that are defined by the child <Cab> elements, except the Package.cab file, have been obfuscated with a bitwise NOT operation. In other words, all the defined CAB files, except for the Package.cab file, have the 1s and 0s of every single bit of their contents flipped. This behavior occurs to improve the performance of WUA in processing the scan package by skipping the time that some client computer antivirus software takes to scan those CAB files for viruses.
  - Xor="0" indicates that all CAB files that are defined by the child <Cab> elements are not obfuscated with a bitwise NOT operation.
- <Cab> element
  Name attribute (string)
  Required? Yes
  Meaning: The file name of the CAB file that is defined by the <Cab> element.
  Remarks:
  - The value for the first <Cab> element that is defined in <CabList> must be Package.cab.
    
    Note This value is case-insensitive.
  - Typically, if the value is Xor="1" , the CAB files that are defined second, third, and so on by <Cab> elements that are named Package2.wu, Package3.wu, and so on. This is true if the elements are present.
  - Typically, if the value is Xor="0", the CAB files that are defined second, third, and on by <Cab> elements are named Package2.cab, Package3.cab, and so on. This is true if the elements are present.
  RangeStart attribute (number)
  Required? No for the Package.cab file, yes for the PackageVersionNumber.wu file
  Default: (None)
  Meaning:
  - The RevisionId-specific files are the files in the C, E, I, and X folders. These files may span more than one of the CAB files that are defined in the <CabList> element. However, the Wsusscn2.cab specifications require that all the files that are specific to a particular RevisionId must be stored in only one such CAB file. The RangeStart attribute records the lowest RevisionId value of the RevisionId-specific files that the CAB file that corresponds to the <Cab> element contains.
  - A missing attribute value means that no RevisionId-specific files are stored in the corresponding CAB file. The <Cab> element for the Package.cab file typically does not specify a RangeStart attribute value.
  Remarks:
  - If the RangeStart attribute value is present in the first <Cab> element that is listed in the Index.xml file, it must be "0".
  - If the RangeStart attribute values that are defined in the <Cab> elements are present in the Index.xml file, they have to be in ascending order and must not overlap.
  - By combining the RangeStart attribute values that are defined in the <Cab> elements in the Index.xml file, the application can deduce the continuous, non-overlapping range of RevisionIds that are covered by each of those CAB files. The CAB file that corresponds to the last defined <Cab> element that has a RangeStart attribute value that contains all RevisionId-specific files, starting from the RevisionId value that is specified in the attribute value.
- FilesDir attribute (number)
  Required: No
  Default: FilesDir="0"
  Meaning:
  - FilesDir="1" indicates that the CAB file that corresponds to the <Cab> element contains the Files folder.
  - FilesDir="0" indicates that the CAB file that corresponds to the <Cab> element does not contain the Files folder.
  Note There is only one <Cab> element that specifies FilesDir="1".
A Package.cab file or a PackageVersionNumber.wu file. These files contain the following components:
- Package.xml
  The Package.xml file is in the same format and schema as the Package.cab file that is in the Wsusscan.cab file. As in the older format, the file remains in the Package.cab file.
- The C folder
  The C folder contains the same kind of content as the Core folder of the Package.cab file that is in the Wsusscan.cab file. Unlike the older format, the C folder spans one or more Package.cab or PackageVersionNumber.wu CAB files. This behavior occurs per the RangeStart attribute values in the corresponding <Cab> elements that are defined in the Index.xml file.
- The E folder
  The E folder contains the same kind of content as the Eula folder of Package.cab in the Wsusscan.cab file. Unlike the older format, the E folder spans one or more Package.cab or PackageVersionNumber.wu CAB files, per the RangeStart attribute values in the corresponding <Cab> elements. These elements are defined in the Index.xml file.
- The Files folder
  The File folder contains the same kind of content as the Files folder of the Package.cab in Wsusscan.cab. Unlike the older format, the folder is stored in a single Package.cab or PackageVersionNumber.wu CAB file. This behavior occurs per the FilesDir attribute value that is in the corresponding <Cab> element . This element is in the Index.xml file.
- The I folder
  The I folder contains the same kind of content as the Localized folder of the Package.cab file that is in the Wsusscan.cab file. The only difference is that the files that correspond to the non-explicitly-deployable, non-bundle software updates are absent from Wsusscn2.cab for performance’s sake on the end-user computer. The removed localized properties for those updates are auto-generated by WUA during run-time. Unlike the older format, the folder spans one or more Package.cab or PackageVersionNumber.wu CAB files, per the RangeStart attribute values in the corresponding <Cab> elements. These elements are defined in the Index.xml file.
- The X folder
  The X folder contains the same kind of content as the Extended folder of Package.cab in Wsusscan.cab . Unlike the older format, the X folder spans one or more Package.cab or PackageVersionNumber.wu CAB files. This behavior occurs per the RangeStart attribute values that are in the corresponding <Cab> elements. These elements are defined in the Index.xml file.