DCS string in Inf file

B

Bournesup

Member
I have noticed several files in the winsxs folder that have an inf file extension that are very unusual.

These files are suppose to be text files. However, for example cmbatt.inf contents start as follows

DCS À @ À 7 .¢ò ªµGF÷YZ¯²ÍÌÒ8&d]HÀÈ8¹

Please note the string DCS at the beginning.

I have checked these files with total virus, and emsisoft emergency kit and nothing. No viruses detected. However, this was after a host refresh install completed early this morning.
 
Based on its magic number, looks like normal Windows Update compression. I found this reference: https://github.com/hfiref0x/SXSEXP
  • Header Sign: 0x44 0x43 0x4E 0x01, DCN 01 (packed IPD PA30)
  • Header Sign: 0x44 0x43 0x4D 0x01, DCM 01 (packed IPD PA30, source manifest required, wcp)
  • Header Sign: 0x44 0x43 0x53 0x01, DCS 01 (packed LZMS, can have multiple blocks)
  • Header Sign: 0x44 0x43 0x44 0x01, DCD 01 (packed IPD PA30, delta, source file required)
  • Header Sign: 0x44 0x43 0x48 0x01, DCH 01 (not packed, header only)
  • Header Sign: 0x44 0x43 0x58 0x01, DCX 01 (unknown, only supported by Windows 10)
 
Last edited:
Thankyou for the info. I did do a google search, but came up empty. I did read the article, yep, your right, windows update compression.
 
Also, when you use dism /online /cleanup-image /startcomponentcleanup will initiate the windows update compression in the winsxs folder
 
If one does a google search on LZMS, you will find that it was introduced by microsoft in 2012.

Here is an excerpt.

LZMS

LZMS is an undocumented compression format that Microsoft released in 2012 or 2013. It perhaps could be described as Microsoft's answer to LZMA (i.e. the format used in 7z and xz files), although LZMS usually produces a worse compression ratio than LZMA. Like LZMA, LZMS is an LZ77-based algorithm. It achieves a relatively high compression ratio by relying on a large LZ77 dictionary size (up to 67,108,864 bytes) and statistically modelling the LZ77 stream of literals and matches. Unlike LZMA but like some LZMA competitors such as LZHAM, LZMS uses Huffman coding in addition to the more concise arithmetic coding, presumably to make decompression faster. The Huffman codes are rebuilt periodically and are not stored with the compressed data. The format includes a preprocessing step for x86 and x86_64 machine code. It does not include a "delta" filter for multimedia data but rather allows a special "delta" match type in addition to the traditional LZ77 match type.
 
W10 introduced delta compression, which adds binary diff'ing to the mix. Distributing a differential update and compressing that results in even smaller files. It's not so much to save you disk space, but W10's software as a service model requires a crap load of constant updates, and the network cost to everyone is not trivial.

Again, it's not a new idea but you can compare that to W7 monthly updates are over 300MB and you have to download the whole bloat just to get that month's fractional changes. Delta updates do require you not trashing WinSxS in order to work.
 
You must log in or register to reply here.
Back
Top