Setup fails to replace some files but doesn't complain about systeminformer

[jxy-s]

reboot the computer, ksi.dll won't update until the next reboot.

Can you please unload the ksi.dll and SystemInformer.sys driver, when SystemInformer.exe is running with admin rights and exits?

So we can update to new version without rebooting.

SystemInformer.sys unloads already when updating. Not every update requires a reboot, only when ksi.dll changes, ksi.dll cannot unload.

[jxy-s]

SystemInformer.sys unloads already when updating.

I use portable installation and just copy files from archive.
How can I unload the driver?

Stop the KSystemInformer service.

[jxy-s]

Searching (in another SistemInformer instance from a zip) for processes holding file handles returns nothing.

Just to confirm, did you have the driver enabled when searching? Some handles do not have full visibility unless you're searching with the driver.

[AndisGrossteins]

Just to confirm, did you have the driver enabled when searching? Some handles do not have full visibility unless you're searching with the driver.

I'm on a Windows preview build, so no driver for me.

[jxy-s]

It looks like the file might be FILE LOCKED WITH ONLY READERS and there's no WriteFile operation after a few CreateFileMapping and CreatFile attempts.

STATUS_FILE_LOCKED_WITH_ONLY_READERS is a typical return value for IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION (CreateFileMapping). The part that is failing is STATUS_USER_MAPPED_FILE (USER MAPPED FILE) "The requested operation cannot be performed on a file with a user mapped section open." This is returned when something has a mapped section open to the file, not when there is a sharing violation. So the file handle is likely closed, but there is still a section mapping out there somewhere preventing that create from going through (with the desired access and/or disposition).

[AndisGrossteins]

Thank you for your explanation. I did some quick skimming of MS docs and now have a better understanding of the FS event results.

Those files may have been locked (mapped) by Windbg because it'll attach to a crashing SystemInformer.exe process (which is another issue that may have been caused by previously failed SystemInformer updates) or it's the MsMpEng.exe and that's why I can't find any open handles without the driver.

However, file locking is not the main issue here; the SystemInformer setup should fail with an error message if it can't successfully update files.

[kotenok2000]

I get this.

Updater for some reason doesn't wait for Systeminformer to exit completely.
Window closes, but process doesn't exit for some more time.
I have 96% of ram used.

[jxy-s]

@kotenok2000 reboot the computer, ksi.dll won't update until the next reboot. This only happens when ksi.dll needs to be updated. Which it did a few versions ago.

[tnodir]

reboot the computer, ksi.dll won't update until the next reboot.

Can you please unload the ksi.dll and SystemInformer.sys driver, when SystemInformer.exe is running with admin rights and exits?

So we can update to new version without rebooting.

[tnodir]

SystemInformer.sys unloads already when updating.

I use portable installation and just copy files from archive.
How can I unload the driver?