[HowTo:] Track URLs of APPXes and CABs downloaded by Windows Update

Discussion in 'Scripting' started by moderate, Sep 29, 2016.

  1. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,377
    2,479
    120
    #1 moderate, Sep 29, 2016
    Last edited by a moderator: Apr 20, 2017
    1. Download NirSoft ESEDatabaseView v1-42 from:
    http://www.nirsoft.net/utils/ese_database_view.html

    2. Extract it to C:\Program Files (x86)\NirSoft\ESEDatabaseView

    3. Run ESEDatabaseView and turn on the option to show URLs as string (not as HEX Binary). It is under menu \Options\Show Binary URL as string:
    http://www.technique.cz/storage/ShowURL.jpg

    Then close ESEDatabaseView.

    4. In C:\Program Files (x86)\NirSoft\ESEDatabaseView create DumpDB.bat:
    Code:
    @echo off
    cls
    ver
    net stop wuauserv
    "C:\Program Files (x86)\NirSoft\ESEDatabaseView\ESEDatabaseView.exe" /table "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" "tbFiles" /scomma C:\tbFiles1.txt
    net start wuauserv
    pause
    net stop wuauserv
    "C:\Program Files (x86)\NirSoft\ESEDatabaseView\ESEDatabaseView.exe" /table "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" "tbFiles" /scomma C:\tbFiles2.txt
    net start wuauserv
    
    5. Run Elevated DumpDB.bat and wait for pause in BAT.

    6. Run Windows Store/Immersive_Control_Panel_(PC_Settings) and download desired update.

    7. Close Store/Settings Metro app.

    8. Select paused window with DumpDB.bat and hit [SPACE]

    9. Compare tbFiles1.txt and tbFiles2.txt (located in C:\) in Total Commander and then use highlighted URL found in tbFiles2.txt.

    :)
     
  2. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    8,575
    15,646
    270
    #2 Mr.X, Sep 29, 2016
    Last edited: Sep 29, 2016
    Thanks a lot for sharing but consider to change your image hosting. See, now MDL allows https links and http://www.technique.cz/storage/ShowURL.jpg lacks of it. Hence your images will not appear on your posts.
     
  3. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    16,194
    84,740
    340
    It appears fine here (Opera 12.18)

    --
    @moderate

    why the Program Files (x86) path? not everybody run x64 system :D

    WUMT can get the updates .cab static links easily :)

    APPXes however, i prefer the live sniffing method (WinPcap+HTTPNetworkSniffer), since the links are temporary
     
  4. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,377
    2,479
    120
    #5 moderate, Sep 29, 2016
    Last edited: Sep 30, 2016
    (OP)
    Here the image appears correctly too (Opera Presto v12-18).

    It is just an example, maybe there will be the people, who will make a script, which will just offer right URL from comparing. (And throw away new 5-6 Windows Defender lines, which always change.)

    IMHO:
    For WU CABs the most easy way is WUMT (indeed).
    But for APPXes with temporary links the most easy way is this. :)))) (It takes only 15 seconds more, than running only Windows Store itself.)
     
  5. Daz

    Daz MDL Developer / Admin
    Staff Member

    Jul 31, 2009
    9,534
    67,253
    300
    For a lot of people the image won't be displayed as it's classed as insecure content.

    Any of the following image hosts will work.

    For now I've changed your embedded image into a link instead.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. Mr.X

    Mr.X MDL Guru

    Jul 14, 2013
    8,575
    15,646
    270
    off-topic again

    about pics not displayed on screen, well it seems to be a security set on certain Chromium based browsers.
    :mad:o_O
     
  7. moderate

    moderate MDL Guru

    Aug 31, 2009
    3,377
    2,479
    120
    OK, thanks, understood. :)