wuauclt.exe command line switches

I need some help with finding the list of command line switches of Wuauclt.exe. It am not able to find the same. I am aware about very few commands like /detectnow. Is there any utility available that can help me to find the information on the switch as and when needed. I tried some web sources but they are bit complicated and I am not able to find out easy way of using them. I tried microsoft site also but it too has a limited information on the same. There must be a reference guide on the same that allows a easy way to work on it.

There is no documentation on web but there is certain set of commands that work. You can find them much easier on the web. I am also trying to find the list of some most useful command but still it is not working. I hope there will be some way to get the same work. There are only two things I know about wsusclt.exe. The first is the one that you had mentioned wuauclt.exe /detectnow and the second one is /resetauthorization. There must be some set of command line that can allow use to control the behavior in more better way.

wuauclt /r /reportnow

This is very useful command which sends all queued reporting events to the server immediately

I found this on another site:

Reposting for you guys.
***
From a dump of the .exe (W2k3 R2 version ) we can extract the following options:
/DetectNow
/ReportNow
/RunHandlerComServer
/RunStoreAsComServer
/ShowSettingsDialog
/ResetAuthorization
/ResetEulas
/ShowWU
/ShowWindowsUpdate
/SelfUpdateManaged
/SelfUpdateUnmanaged
/UpdateNow
/ShowWUAutoScan
/ShowFeaturedUpdates
/ShowOptions
/ShowFeaturedOptInDialog
/DemoUI

Most of these options don't give any noticable response, but that may be because of the state of the service.
The command 'wuauclt /ResetAuthorization /DetectNow' worked for me right away.

No need to need to be a troll. A simple explanation would have sufficed without being a jerk. I simply reposted some info I found on another site while researching the same topic as I just learned about the command the other day. If you make yourself feel better by making others feel inferior to you, then I hope you find something better to do with your life.

Or because there's no code behind the switches.

There *is* a reason the options are not documented!

Yes, this is one of only *three* functional command options.

The other two are:
wuauclt /detectnow

and

wuauclt /reportnow

Sure, because most people wouldn't find them useful.
You'll find you're wrong on the "there's no code behind the switches."

Code:

---

.text:004043C9 loc_4043C9:                            ; CODE XREF: wWinMain(x,x,x,x)+212j
.text:004043C9                mov    eax, [ebp+var_C]
.text:004043CC                mov    esi, [ebp+eax*4+lpString1]
.text:004043D0                push    offset String2  ; "/ShowWU"
.text:004043D5                push    esi            ; lpString1
.text:004043D6                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:004043DB                test    eax, eax
.text:004043DD                jz      loc_4045DB
.text:004043E3                push    offset aShowwindowsupd ; "/ShowWindowsUpdate"
.text:004043E8                push    esi            ; lpString1
.text:004043E9                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:004043EE                test    eax, eax
.text:004043F0                jz      loc_4045DB
.text:004043F6                push    offset aClosewindowsup ; "/CloseWindowsUpdate"
.text:004043FB                push    esi            ; lpString1
.text:004043FC                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404401                test    eax, eax
.text:00404403                jz      loc_40456E
.text:00404409                push    offset aSelfupdateunma ; "/SelfUpdateUnmanaged"
.text:0040440E                push    esi            ; lpString1
.text:0040440F                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404414                test    eax, eax
.text:00404416                jz      loc_404578
.text:0040441C                push    offset aSelfupdatemana ; "/SelfUpdateManaged"
.text:00404421                push    esi            ; lpString1
.text:00404422                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404427                test    eax, eax
.text:00404429                jz      loc_404592
.text:0040442F                push    offset aDetectnow ; "/DetectNow"
.text:00404434                push    esi            ; lpString1
.text:00404435                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:0040443A                test    eax, eax
.text:0040443C                jz      loc_404599
.text:00404442                push    offset aReportnow ; "/ReportNow"
.text:00404447                push    esi            ; lpString1
.text:00404448                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:0040444D                test    eax, eax
.text:0040444F                jz      loc_4045A0
.text:00404455                push    offset aUpdatenow ; "/UpdateNow"
.text:0040445A                push    esi            ; lpString1
.text:0040445B                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404460                test    eax, eax
.text:00404462                jz      loc_4045A7
.text:00404468                push    offset aRunhandlercoms ; "/RunHandlerComServer"
.text:0040446D                push    esi            ; lpString1
.text:0040446E                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404473                test    eax, eax
.text:00404475                jz      loc_4045AE
.text:0040447B                push    offset aRunstoreascoms ; "/RunStoreAsComServer"
.text:00404480                push    esi            ; lpString1
.text:00404481                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404486                test    eax, eax
.text:00404488                jz      loc_4045B5
.text:0040448E                push    offset aResetauthoriza ; "/ResetAuthorization"
.text:00404493                push    esi            ; lpString1
.text:00404494                call    ?AsciiStringCompareI@@YGJPBG0@Z ; AsciiStringCompareI(ushort const *,ushort const *)
.text:00404499                test    eax, eax
.text:0040449B                jnz    short loc_4044BC
.text:0040449D                cmp    ebx, 2
.text:004044A0                jnb    loc_4045CB
.text:004044A6                cmp    [ebp+var_18], eax

---

You see at each stop it's comparing a parameter against each of these and doing a jump if it matches.
Those jumps go to a dispatch table down further in the code:

Code:

---

.text:00404599 ; ---------------------------------------------------------------------------
.text:00404599
.text:00404599 loc_404599:                            ; CODE XREF: wWinMain(x,x,x,x)+FDj
.text:00404599                call    ?DetectNow@@YGJXZ ; DetectNow(void)
.text:0040459E                jmp    short loc_404557
.text:004045A0 ; ---------------------------------------------------------------------------
.text:004045A0
.text:004045A0 loc_4045A0:                            ; CODE XREF: wWinMain(x,x,x,x)+110j
.text:004045A0                call    ?ReportNow@@YGJXZ ; ReportNow(void)
.text:004045A5                jmp    short loc_404557
.text:004045A7 ; ---------------------------------------------------------------------------
.text:004045A7
.text:004045A7 loc_4045A7:                            ; CODE XREF: wWinMain(x,x,x,x)+123j
.text:004045A7                call    ?UpdateNow@@YGJXZ ; UpdateNow(void)
.text:004045AC                jmp    short loc_404557
.text:004045AE ; ---------------------------------------------------------------------------
.text:004045AE
.text:004045AE loc_4045AE:                            ; CODE XREF: wWinMain(x,x,x,x)+136j
.text:004045AE                call    ?RunUpdateHandler@@YGJXZ ; RunUpdateHandler(void)
.text:004045B3                jmp    short loc_404626
.text:004045B5 ; ---------------------------------------------------------------------------
.text:004045B5
.text:004045B5 loc_4045B5:                            ; CODE XREF: wWinMain(x,x,x,x)+149j
.text:004045B5                mov    eax, [ebp+var_C]
.text:004045B8                lea    ecx, [eax+1]
.text:004045BB                cmp    ecx, [ebp+var_20]
.text:004045BE                jnb    short loc_4045CB
.text:004045C0                push    [ebp+eax*4+hLibModule] ; hLibModule
.text:004045C4                call    ?RunDatastoreAsComServer@@YGJPBG@Z ; RunDatastoreAsComServer(ushort const *)
.text:004045C9                jmp    short loc_404626

---

Etc. To see what they do, you can follow their code. Let's start with one we "know" works (DetectNow):

Code:

---

.text:00403EC0 ; long __stdcall DetectNow(void)
.text:00403EC0 ?DetectNow@@YGJXZ proc near            ; CODE XREF: wWinMain(x,x,x,x):loc_404599p
.text:00403EC0
.text:00403EC0 ppv            = dword ptr -4
.text:00403EC0
.text:00403EC0                mov    edi, edi
.text:00403EC2                push    ebp
.text:00403EC3                mov    ebp, esp
.text:00403EC5                push    ecx
.text:00403EC6                push    esi
.text:00403EC7                push    edi
.text:00403EC8                xor    esi, esi
.text:00403ECA                push    esi            ; dwCoInit
.text:00403ECB                push    esi            ; pvReserved
.text:00403ECC                call    ds:__imp__CoInitializeEx@8 ; CoInitializeEx(x,x)
.text:00403ED2                push    3
.text:00403ED4                mov    edi, eax
.text:00403ED6                call    ?RegisterProxyStubCLSIDs@@YGXK@Z ; RegisterProxyStubCLSIDs(ulong)
.text:00403EDB                cmp    edi, esi
.text:00403EDD                jl      short loc_403F13
.text:00403EDF                lea    eax, [ebp+ppv]
.text:00403EE2                push    eax            ; ppv
.text:00403EE3                push    offset __GUID_7ae22377_b19d_497d_808e_307860c5660a ; riid
.text:00403EE8                mov    [ebp+ppv], esi
.text:00403EEB                call    ?CoCreateAU@@YGJABU_GUID@@PAPAX@Z ; CoCreateAU(_GUID const &,void * *)
.text:00403EF0                mov    edi, eax
.text:00403EF2                cmp    edi, esi
.text:00403EF4                jl      short loc_403F0D
.text:00403EF6                mov    eax, [ebp+ppv]
.text:00403EF9                mov    ecx, [eax]
.text:00403EFB                push    esi
.text:00403EFC                push    esi
.text:00403EFD                push    esi
.text:00403EFE                push    eax
.text:00403EFF                call    dword ptr [ecx+5Ch]
.text:00403F02                mov    edi, eax
.text:00403F04                mov    eax, [ebp+ppv]
.text:00403F07                mov    ecx, [eax]
.text:00403F09                push    eax
.text:00403F0A                call    dword ptr [ecx+8]
.text:00403F0D
.text:00403F0D loc_403F0D:                            ; CODE XREF: DetectNow(void)+34j
.text:00403F0D                call    ds:__imp__CoUninitialize@0 ; CoUninitialize()
.text:00403F13
.text:00403F13 loc_403F13:                            ; CODE XREF: DetectNow(void)+1Dj
.text:00403F13                mov    eax, edi
.text:00403F15                pop    edi
.text:00403F16                pop    esi
.text:00403F17                leave
.text:00403F18                retn
.text:00403F18 ?DetectNow@@YGJXZ endp

---

So it calls CoInitializeEx(NULL,NULL), which initializes the COM lib in multithreaded mode, then registers some files with the system. The CoCreateAU is a function almost every switch that "does something" calls, it creates a COM AutomaticUpdates object and returns the result of the CoCreateInstance call. This COM object has GUID string: "__GUID_7ae22377_b19d_497d_808e_307860c5660a". You could always create an instance of this object yourself and play around with what it can do, I may reverse the DLLs responsible for implementing its functionality at some point and see if I can document these switches. The 'ReportNow' uses a different GUID, so it seems there's a windows update and a windows update reporting COM differentiation.

You can see after it gets that HRESULT back, it compares it against 0 (esi is used as zero here, as by the ABI it must be preserved across interfacing function calls), if it's 0 it uninits the COM library and returns false. Otherwise it calls some thiscall function in the class instance returned as a pointer from the CoCreateAU call.

The switches do work similarly through COM. The base API in the wuaueng.dll though is particularly interesting.

jmerlin, I'd be interested to find out what tool(s) you used to interrogate the wuauclt command and switches.

IDA Pro, Ollydbg, and a lot of experience.

Quote:

---

Originally Posted by jMerliN

"I may reverse the DLLs responsible for implementing its functionality at some point and see if I can document these switches."

---

Yes, please. I lack the required skills to do so myself but would be very interested to read your findings.