How to programmatically unload / remove an executable from (superfetch?) cache ?

09917186 96 Reputation points
2021-03-09T12:23:18.77+00:00

We are manufacturer of a printer device and its printer driver. In the list of driver's dependent files (see Windows Registry "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3\<printer name>\Dependent Files" as illustration on term "dependent file") is, amongst others, an executable, let's call it PostProc.exe. During print process, PostProc.exe is started by driver's User Interface part (let's call it MyDriversUI.dll). It allows users to post-process print data.

When updating / upgrading from older version of printer driver to newer one, new version of PostProc.exe is correctly copied to driver directory (like C:\Windows\System32\spool\drivers\x64\3), in this process overwriting the old version. But unfortunately, at least until next spooler restart, Windows does not run this new version, but old one instead, because old version is still loaded in cache. In WinDbg, I see Windows' debug output line

"Application "\??\C:\Windows\system32\spool\DRIVERS\x64\3\PostProc.exe" found in cache"

A simple - but clumsy - solution would be to just rename new version of PostProc.exe to Post_Proc.exe. This would force Windows to run new Post_Proc.exe instead of old PostProc.exe. But of course we do not want to rename it every time we release a new version, especially we don't want to adapt MyDriver.inf, MyDriversUI.dll, and user manual every time, since our product is already out on the market.

I have read some articles on superfetch cache and memory management functions, but none of them seems to suggest a solution. I have also studied the numerous parameters of CreateProcessAsUser, with which I start PostProc.exe, but none of them appeared promissing to me. We do have an installation programm, which could implement a programmatical solution, but some Windows Server administrators do not want third party software to install anything on their system. They prefer manual driver update by opening Printer Property Pages, tab "Advanced", button "New driver" instead. With this said, our problem splits into 3 parts:

a) programmatical solution, which could be implemented in our installation programm

b) manual solution, which human administrator could carry out. Needless to say that "restart your spooler at least twice" is not an instruction, which would make administrators happy, because during spooler restart, nobody in the whole network can print, no matter whether to our device or to any other device. It also does not help to rename or delete old C:\Windows\system32\spool\DRIVERS\x64\3\PostProc.exe - as long as old PostProc.exe is loaded in cache, Windows uses it.

c) programmatical solution, which could be implemented in MyDriversUI.dll - this would cover both a) and b), making them superfluous.

And finally, just for curiosity: Does Microsoft consider the fact that Windows runs an executable, which Windows' Driver Update Wizard has already overwritten on harddisk, as a bug or as works-as-designed ?

Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,524 questions
0 comments No comments
{count} votes

Accepted answer
  1. 09917186 96 Reputation points
    2021-03-22T13:33:29.557+00:00

    Please consider as solved. It turned out to be a misconclusion drawn from extremely improbable coincidences and circumstances, and a misinterpretation of test results among several testers.

    0 comments No comments

0 additional answers

Sort by: Most helpful