那一场呼啸而过的青春

工程师分析 Win11 争议后台服务：用于性能诊断，含 84 个诊断脚本_我的网站

A |      8 月 26 日消息，逆向工程师 Xusheng Li 于 8 月 15 日发布博文，深度分析了 Windows Health and Optimized Experiences 服务。    WASHINGTON -- President Joe Biden postponed a trip to Colorado on Monday to stay in Washington and focus on the growing conflict in the Middle East, setting aside an opportunity to pitch his economic accomplishments as he runs for reelection.Biden had been heading to the district of Rep. Lauren Boebert, where he was to visit CS Wind, the world's largest facility for wind tower manufacturing. But the White House said just a few hours before Biden was set to take off for the trip that it would be rescheduled. Instead, Biden is expected to hold a series of high-level meetings with aides on Israel and the growing humanitarian concerns in Gaza. The Democratic president is weighing a decision to visit the region in what would be a striking symbol of support for Israel following the Oct. 7 attack by Hamas that killed more than 1,400 Israelis. More than 2,300 Palestinians have died in the ensuing Israeli bombardment of Gaza, which is bracing for a ground invasion. At least 30 U.S. citizens have also died, and 13 remain missing, the State Department says.It’s rare for presidential travel, which is meticulously planned for security and logistical purposes, to be called off at the last minute. Biden's decision reflects the competing pressure that he faces as he tries to manage bloody conflicts in Ukraine, where the Russian invasion is in its second year, and now the Middle East, always one of the world's most combustible regions. There are concerns that a second front could open in Israel's north, which neighbors the Hezbollah-controlled territory in Lebanon's south. There have already been reports of sporadic fighting along the border. Iran backs both Hamas and Hezbollah. Two U.S. aircraft carrier strike groups have been dispatched to the Eastern Mediterranean in an effort to deter a widening war.Domestic and foreign policy priorities have collided for Biden before.He was scheduled to visit Papua New Guinea and Australia after attending the Group of Seven meeting in Japan earlier this year, but the two stops were scrubbed because of the standoff over the debt ceiling back in Washington. Rather than deepening ties with countries in the Indo-Pacific region, Biden jetted home to hash out a deal with Republicans to prevent a first-ever default. The change in Monday's schedule costs Biden a chance to turn Boebert into a political foil as he showcases the Inflation Reduction Act, his signature domestic legislation and the source of hundreds of billions of dollars for clean energy incentives.Boebert has called the law “a massive failure” that “needs to be repealed.” But Biden was planning to demonstrate otherwise when he visits CS Wind in the town of Pueblo. The company is undergoing a $200 million expansion that is expected to create 850 jobs by 2026 with help from the tax benefits in the law.Pueblo is one of the anchors of Colorado's sprawling 3rd Congressional District, which covers more ground than Pennsylvania. Boebert won her seat in 2020 and barely held on to it during the 2022 midterms. There's maximum chaos in Congress right now for House Republicans, who ousted Rep. Kevin McCarthy of California as their speaker but have been unable to settle on a replacement. Rep. Jim Jordan of Ohio, a prominent ally of Donald Trump, is the current leading candidate to replace McCarthy, but victory for him is uncertain. Despite low unemployment and slowing inflation, Biden has been struggling to convince Americans that his policies are good for the U.S. economy.An August poll from The Associated Press-NORC Center for Public Affairs Research said just 36% of U.S. adults approve of Biden's handling of the economy, roughly where his numbers have stood for a year and a half. The president and other top administration officials have been traveling the country to promote their Investing in America agenda. Last week, the president visited a marine terminal in Philadelphia, where he announced that the area would become one of seven regional hubs for producing and delivering hydrogen fuel.“I truly believe this country is about to take off," Biden said. "For the first time in a long time we’re actually investing in America.”。曾于 8 月 3 日报道，微软为 Win11 系统新增上述后台服务，网友反馈该服务会在电脑每次开机时自启动，持续监控 CPU 使用率、温度和电池情况，并每隔 15 分钟将数据发给微软。

B | 微软副总裁斯科特 · 汉塞尔曼回应表示该功能上线于 2025 年，用途主要是采集性能诊断数据。逆向工程师 Xusheng Li 逆向该服务的 whesvc，其结果基本印证了微软的说明，但也发现其底层架构比普通性能诊断工具复杂得多。whesvc 服务的核心功能位于 windiag.dll（229 KB），该动态链接库内嵌 Lua 5.4.7 脚本语言。微软还提供 whesvc_assets.dll，其中包含 84 个已编译 Lua 脚本，用于处理不同诊断场景。

C | 脚本引擎公开了 79 个原生函数，可访问 Windows 的多类系统能力。该服务可以读取和修改 Windows 注册表，执行文件操作，创建并交互进程，查询 WMI（Windows 管理规范），收集 ETW（Windows 事件跟踪）记录，检查安全令牌，获取电源和温度信息，下载符号文件，创建 .cab 文件，并发起 HTTP 请求。服务还提供通用 FFI（外部函数接口），允许脚本调用原生动态链接库，并操作多种 Windows 句柄。不过，Li 没有发现微软利用这些能力随机修改文件或注册表，现有脚本主要执行常规诊断任务。这些脚本可以在应用停止响应后采集跟踪记录，监控输入延迟和显示异常，识别启动缓慢的应用，并检测长期处于挂起状态的服务。电源相关模块能够调查电池异常耗电，判断阻止电脑进入睡眠状态的原因，并响应持续的高功耗行为。memory_handle_leak 模块会在多个时间间隔内跟踪内存和句柄数量，再结合连续增长情况与线性回归斜率，区分潜在内存泄漏和正常增长。system_summary 模块会生成 900 秒、即 15 分钟的 JSON 摘要，但文件保存在本地。尽管服务具备网络功能，Li 没有找到任何会实际发起任意 HTTP 请求的场景。相关阅读：。

D |

Current article:http://zfo2.piepengxikuozhuangzebaohouye.sbs/k2tq/4cxu.html

Published on:18:51:31