Windows Me DDK: System File Protection

System File Protection

Installation programs that are not part of the operating system can overwrite shared system files, even when it is incorrect to do so. This has been a common problem in the history of the Microsoft?Windows?operating systems. Overwriting shared system files with older versions or modified versions of the file can result in unpredictable system performance that ranges from application errors to operating system crashes. The files types that are most commonly affected by this problem are dynamic-link libraries (DLL) and executable files (EXE).

In Windows Millennium Edition, a new feature called System File Protection (SFP) will prevent the unauthorized modification or replacement of critical system files that are essential for basic windows functionality.

SFP protects system files by running in the background and detecting attempts to replace protected system files. System File Protection monitors all file changes and triggers when a file in the protected list is going to be changed. Before allowing the changes, it makes a copy of the original file. Then, SFP looks up the file signature in a catalog file to determine if the new file is the correct Microsoft version. If it is not, the operating system replaces the file with the copy it had made just before the file was modified.

SFP logs all its actions in sfplog.txt which is in the windows/system/sfp directory.

Supported File Replacement Mechanisms

Protected Files can be modified by Authorized packages authored in Microsoft. They will carry certified catalogs and will install these catalogs before changing any files. SFP will then use the new file signatures to validate files.

Protected File List

 

There is a list of around 900 files that are identified to be critical to windows functionality. The list includes files with extensions .sys, .dlls, .exes, .ocx as well as files with other extensions. All these files are auhtored and owned by Microsoft. No 3rd party files are included in this list.

Protected File List

Disabling System File Protection

SFP is not active during OS setup and upgrades. It also is inactive during "Safe" mode sessions.

SFP cannot be disabled by the users or application programs.