Wowsers, You Won't Believe What Broke Software Protection Service (SPP)

T

tted

Member
After an intense debugging effort I nailed or extremely narrowed down a new bug either having to do with new updates or new builds of NTLite.
Updates included:
Code: 
SSU-19041.4289-x64.cab
Windows10.0-KB5019180-x64_PSFX.cab
windows10.0-kb5032906-x64_6c7f60ce1a9cd3a52c1f478bd8e346ef6c7f4e71.cab
Windows10.0-KB5036608-x64-NDP48.cab
Windows10.0-KB5036892-x64.cab

It turns out one or several of these components are responsible:
Code: 
		<c>driver_prnms005.inf</c>
		<c>driver_prnms007.inf</c>
		<c>driver_rdlsbuscbs.inf</c>
		<c>driver_rdpidd.inf</c>
		<c>driver_rdvgwddmdx11.inf</c>
		<c>driver_termkbd.inf</c>
		<c>driver_termmou.inf</c>
		<c>driver_ts_generic.inf</c>
		<c>driver_tsgenericusbdriver.inf</c>
		<c>driver_tsprint.inf</c>
		<c>driver_tsusbhub.inf</c>
		<c>driver_tsusbhubfilter.inf</c>
		<c>driver_wbdiusb.inf</c>
		<c>driver_wstorvsp.inf</c>
		<c>driver_wsynth3dvsc.inf</c>
		<c>driver_wvid.inf</c>
		<c>driver_wvkrnlintvsc.inf</c>
		<c>driver_wvkrnlintvsp.inf</c>
		<c>driver_wvmbus.inf</c>
		<c>driver_wvmic_guestinterface.inf</c>
		<c>driver_wvmic_heartbeat.inf</c>
		<c>driver_wvmic_kvpexchange.inf</c>
		<c>driver_wvmic_shutdown.inf</c>
		<c>driver_wvmic_timesync.inf</c>
		<c>driver_wvpcivsp.inf</c>

NTLite version: 2024.4.9860
Windows 10 LTSC 2021 IoT

Normally you can fix Software Protection with a reg tweak basically resetting the service configuration.
Not this time, not only that but marrying all original SPP and SMLGR back into release so it would look just like retail did nothing.
You think Ah NTLite deleted something critical you can clearly see a file count difference in SPP in Windows Directory between Original and NTlited version but no...fixing that did nothing.

If we rule out the unlikely then some of these are the culprits:
Code: 
        <c>driver_rdlsbuscbs.inf</c>
        <c>driver_ts_generic.inf</c>
		<c>driver_rdpidd.inf</c>
		<c>driver_rdvgwddmdx11.inf</c>
		<c>driver_wstorvsp.inf</c>
		<c>driver_wvid.inf</c>
		<c>driver_wvkrnlintvsc.inf</c>
		<c>driver_wvkrnlintvsp.inf</c>
		<c>driver_wvmbus.inf</c>
		<c>driver_wvmic_guestinterface.inf</c>
		<c>driver_wvmic_heartbeat.inf</c>
		<c>driver_wvmic_kvpexchange.inf</c>
		<c>driver_wvmic_shutdown.inf</c>
		<c>driver_wvmic_timesync.inf</c>
		<c>driver_wvpcivsp.inf</c>

wstorvsp.inf
Appears to be a new file; not present on base release.

huh, so too are:
wvkrnlintvsc.inf
wvkrnlintvsp.inf
wvpcivsp.inf

hmmm

If you notice 3 of those components end with: vsp (Virtual Software Protection)?

Well might as well ask a question while i'm at it.
Are any of these useful to any windows component?
Or what precisely do they do?
Code: 
wvmic_guestinterface.inf
wvmic_heartbeat.inf

wvmic_kvpexchange.inf (needed for Hyper-V)
 
Last edited:
Wowsers indeed, so much to unpack from a single post.

tted said:
Updates included:
SSU-19041.4289-x64.cab
Windows10.0-KB5019180-x64_PSFX.cab
windows10.0-kb5032906-x64_6c7f60ce1a9cd3a52c1f478bd8e346ef6c7f4e71.cab
Windows10.0-KB5036608-x64-NDP48.cab
Windows10.0-KB5036892-x64.cab
Click to expand...
- SSU is the Servicing Stack (DISM)
- KB5019180 is the Intel MMIO security fix
- KB5032906 is Dynamic Update
- NDP is .NET Platform

None of these affect SPP. Of course the April 2024 CU will include updated SPP files, it's a Cumulative Update after all.

tted said:
It turns out one or several of these components are responsible:
<c>driver_prnms005.inf</c>
<c>driver_prnms007.inf</c>
Click to expand...
Virtual print devices.

tted said:
<c>driver_rdlsbuscbs.inf</c>
<c>driver_rdpidd.inf</c>
<c>driver_rdvgwddmdx11.inf</c>
<c>driver_termkbd.inf</c>
<c>driver_termmou.inf</c>
<c>driver_ts_generic.inf</c>
<c>driver_tsgenericusbdriver.inf</c>
<c>driver_tsprint.inf</c>
<c>driver_tsusbhub.inf</c>
<c>driver_tsusbhubfilter.inf</c>
Click to expand...
Most of these are RDP (Terminal Services) devices.

tted said:
<c>driver_wbdiusb.inf</c>
<c>driver_wstorvsp.inf</c>
<c>driver_wsynth3dvsc.inf</c>
<c>driver_wvid.inf</c>
<c>driver_wvkrnlintvsc.inf</c>
<c>driver_wvkrnlintvsp.inf</c>
<c>driver_wvmbus.inf</c>
<c>driver_wvmic_guestinterface.inf</c>
<c>driver_wvmic_heartbeat.inf</c>
<c>driver_wvmic_kvpexchange.inf</c>
<c>driver_wvmic_shutdown.inf</c>
<c>driver_wvmic_timesync.inf</c>
<c>driver_wvpcivsp.inf</c>
Click to expand...
Most of these are Hyper-V or virtualization drivers.

tted said:
wstorvsp.inf
Appears to be a new file; not present on base release.

huh, so too are:
wvkrnlintvsc.inf
wvkrnlintvsp.inf
wvpcivsp.inf

hmmm

If you notice 3 of those components end with: vsp (Virtual Software Protection)?
Click to expand...
No. wvpcivsp.inf = Virtual PCI (VPCI) virtual service provider (VSP).
These are Hyper-V drivers that pass thru physical device access up to be shared by multiple VM's.

You're noticing Windows is throwing in more Hyper-V drivers to support enterprise-level features which are ignored by 99.98% of the general PC population out there.

tted said:
Well might as well ask a question while i'm at it.
Are any of these useful to any windows component?
Or what precisely do they do?
Code: 
wvmic_guestinterface.inf
wvmic_heartbeat.inf

wvmic_kvpexchange.inf (needed for Hyper-V)
Click to expand...
I believe you're reading too much into this long drivers list. It's still entirely possible that SPP depends on a kernel feature, which is then impacted by one of these driver removals. But this list is too long.

What you should do is begin testing a preset with NO driver removals, to first confirm if SPP is broken. Then gradually remove kernel drivers in small batches until you notice a problem appearing. When it breaks, you can backtrack to the last set of removals, and narrow the list further.
 
garlin
Even if most or all of what you say is true, doesn't change the fact that one of those component removals killed Software Protection service. You can agree to disagree, but truly it is incontrovertible. One builds works (Software Protection works), the other doesn't and the only difference is the component list I gave. Nevertheless, thanks for your input; continuous learning.

Do you know anything about these:

wvmic_guestinterface.inf
wvmic_heartbeat.inf
 
Last edited:
learn.microsoft.com

Hyper-V Integration Services

Reference for Hyper-V Integration Services
learn.microsoft.com

These are services to Hyper-V:
<c>driver_wvmic_guestinterface.inf</c>
<c>driver_wvmic_heartbeat.inf</c>
<c>driver_wvmic_kvpexchange.inf</c>
<c>driver_wvmic_shutdown.inf</c>
<c>driver_wvmic_timesync.inf</c>
 
tted said:
garlin
Even if most or all of what you say is true, doesn't change the fact that one of those component removals killed Software Protection service. You can agree to disagree, but truly it is incontrovertible. One builds works (Software Protection works), the other doesn't and the only difference is the component list I gave. Nevertheless, thanks for your input; continuous learning.
Click to expand...
Which is why I suggested you whittle down the removals list in small batches until you arrive at the offending driver.
 
You must log in or register to reply here.
Back
Top