![\"\"](\"http:\/\/www.osdninja.com\/wp-content\/uploads\/2015\/10\/img_5617bc1a2b8ac.png\")
<\/p>\nWhat would you do if someone called you and said every time a computer finished imaging, it was missing a bunch of software?\u00a0 Well, look at the logs of course, but after that is where things get interesting….<\/p>\n
I had one computer in particular that was brought to me that was consistently throwing file errors, and the first thought was there had to be some download corruption.<\/p>\n
<\/p>\n
![\"\"](\"http:\/\/www.osdninja.com\/wp-content\/uploads\/2015\/10\/img_5617bc4b8031d.png\")
<\/p>\n
But time and time again, everytime the image was loaded, errors would show up, not always on the same software, but at least a few various ones. \u00a0The hard drive was replaced first, but no improvement, then the RAM, and finally the motherboard. \u00a0No dice, issue still persisted. \u00a0The only thing left was to focus on the CPU.<\/p>\n
After swapping the CPU from a known working computer, walla! No more errors! \u00a0And more importantly, the “bad” CPU reproduced the same random issues in the known computer. \u00a0Now, to get that CPU replaced…<\/p>\n
Problem was, the PC OEM’s built in hardware diagnostics said everything was fine. \u00a0Even the Intel CPU diagnostics, came up clean. \u00a0In the process of installing all sorts of test utilities, I noticed a new pattern… There was no pattern.<\/p>\n
Sometimes while simply double clicking a download to run an install, I’d get an extraction error, and then a minute later, it would run fine. \u00a0Intel’s own diagnostics tool is one example, here’s the error:<\/p>\n
![\"\"](\"http:\/\/www.osdninja.com\/wp-content\/uploads\/2015\/10\/img_5617bf50701d3.png\")
<\/p>\n
So how is this randomness possible? \u00a0When you run program, the Windows kernel will schedule the thread on an available logical processor, and considering this was a quad core computer, that means at random, it would be executing on one of the 4 cores. \u00a0To test the theory, I started setting the affinity to control which core it was running on. \u00a0Since processor affinity is inherited by child processes, I first open a command prompt and set \u00a0the affinity there, and started running my tests.<\/p>\n
In classic suspenseful style, each core that I ran it on worked correctly, until the very last one was tested, and boom, error popped up. \u00a0I now had a %100 repeatable test, every time I had the affinity set to CPU 3, it would error out %100 of the time, any of the other CPU’s selected, and there was no error %100 of the time.<\/p>\n So why is a CPU issue manifesting as a file extract error? \u00a0Let’s look a little deeper at the files themselves. \u00a0Running Sysinternals Process Monitor, we see that the Setup.exe is extracting files to our Appdata temp folder, no surprises here:<\/p>\n But let’s grab a these files out of the temp folder before closing the error, and then do the same with the extracted files when there is no error. \u00a0Then using your favorite hex editor\/comparison tool, look at the differences.<\/p>\n![\"\"](\"http:\/\/www.osdninja.com\/wp-content\/uploads\/2015\/10\/img_5617c096c5603.png\")
<\/a><\/p>\n<\/a><\/p>\n