The cookie magic behind Windows Live Suite installer

Announcing the Windows Live Suite on the same day as the new iPod touch crafted by God himself might not have been the brightest idea, but Windows Live still managed to get some attention by the usual suspects. The hype has been around this unified installer which not surprisingly does exactly what the label says and nothing more. I decided to give it a whirl but was surprised by not what it did, but how.

Windows Live installer

For those that haven’t tried already, you point your browser to http://get.live.com/WL/ and you will come across this splash screen. At first, it might look like a silly ‘sign-up’ form which you must complete to gain access to the downloads, but in fact you’re asked to choose what you want to install in the suite. I thought to myself, “oh that’s neat. I’m choosing what I want to install on a web page.” Then I pondered, “how does this actually work?”

Windows Live installerAfter pressing “Install”, you’re asked to download the installer’s executable. At this point, I started wondering if this executable was somehow dynamically generated or prepackaged to install only the things I selected, nevertheless I hyper-clicked all the next buttons until it eventually started installing. Not surprisingly, it only downloaded and installed the applications I chose. Whatever it did, it worked.

Unsatisfied with “it just works”, I decided to investigate further. I first analyzed the HTML to see what effect it had on the download link when I selected the different options, but no luck there, it pointed to the same “WLinstaller.exe”. To prove a point, I then downloaded the executable without going through the form to compare it with the other executable I already, it was the same. So if the executable didn’t change, then it can only be the website.

One more look at the HTML and specifically the Javascript reveals the secret, cookies. By clicking “Install”, the Javascript generated a unique cookie for me under the name of “wlxp” that contained sets of globally unique identifiers (GUID) which I now know are the references to the particular applications I selected.

document.cookie="wlxp=p="+finalList.join(",").toLowerCase()+"&t="+t+";expires="+d;

Just to make sure, I even ran Process Monitor on the process to check out its file system requests.

Windows Live installer

Even though I had already known about the cookies, it still shocked me a little to see it actually query my file system first to find any cookies for “live.com”, then start accessing those cookies to find the relevant information. Same applies for Firefox, which I was using at the time. In fact, it’s even more complicated for Firefox because it first has to find my profiles, then shift through megabytes of cookies in the single repository to find the “live.com” one.

Whilst this might seem like a lot of work just to check what I want to install, I think it’s a neat idea with a lot of indirect potential. A few that popped into my mind quickly included:

  • Third party applications or bundles – assuming the installer simply downloads from the Microsoft server anything matching the supplied GUIDs, you could easily deliver additional applications or service beyond those by Microsoft without bundling them into the installer
  • Universal installer – this installer will require less if any maintenance since it can be suited to download any application, any version, any bundle by simply changing GUIDs in the browser
  • Special promotions – imagine if you have accessed a promotional website which offered Live Messenger freebies, by simply adding a code to the cookie, only you will be given access to download these exclusive freebies

Windows Live installerSomeone suggested to me this is not new and in fact Adobe may have done this in the past with the Acrobat download bundles, however I think they changed the download URL to a whole new package with or without the bundle depended on your decision, instead of the truly unified installer in this case.

And also if you’re wondering what happens if you don’t have the cookies or have cookies disabled, then you’ll simply be offered a different installation experience where you select which products you’d like to install (left).

P.S. If you’re running X64 and questioning the purpose of life, then check out Rafael’s hack to get Windows Live Suite working on X64.

20 insightful thoughts

  1. Does the WLinstaller.exe contains all the programs in it or it actually downloads the selected programs to install? If it already contains all the programs in it wouldn’t the package be unnecessary big for people who choose 2 or 3 out of the available 5 or 6 programs available?

  2. Pingback: shahine.com/omar/
  3. @RichB:

    Google pack does not use cookies.. and they don’t use a different installer for every combination.. Instead it appears that their web app, before actually pushing the download out, changes two bytes within the header of the exe that defines what software is going to be installed..

  4. Cookie magic reset my homepage to MSN and my default search to Live because I didn’t notice the right hand side “defaults”.

  5. How would Google change 2 bytes of the exe through the web page? It would invalidate the digital code certificate of the exe, which would be a security hole.

  6. Pingback: Rory Primrose
  7. hola, mi comentario es que necesito instalar cookies para poder acceder a mi cuenta de coorreo electronico pero no se donde encontrarlo, pueden darme la direccion electronica por favor.

  8. owkii…. i gt a problem with messenger wt du i do…
    nd if yu answer please say it in dumb language cuz i am pritty blonde at tyms…
    wen i try to install the sofware i clik whateva i wanna install nd it pritty much tells me to get stuffed…
    it downloads i allow cookie nd thn it comes up with an error page saying could not install the messenger suite or sumthing like that… it wont let me have the live one.. i hav asked people that actually know what they ar doing to have a look at it for me nd its just done the same to them.. HELP…?! pwwweeez… so confused… :S
    write bk… jeniie…xxx

  9. you had a bad day lyrics
    [URL=http://cygugocifedy.xhost.ro/you-had-a-bad-day-lyrics/]you had a bad day lyrics[/URL]
    how to use a compass
    [URL=http://cygugocifedy.xhost.ro/how-to-use-a-compass/]how to use a compass[/URL]
    www phimtructuyen com
    [URL=http://cygugocifedy.xhost.ro/www-phimtructuyen-com/]www phimtructuyen com[/URL]
    oliver the musical
    [URL=http://cygugocifedy.xhost.ro/oliver-the-musical/]oliver the musical[/URL]
    911 video
    [URL=http://cygugocifedy.xhost.ro/911-video/]911 video[/URL]
    niggar family
    [URL=http://cygugocifedy.xhost.ro/niggar-family/]niggar family[/URL]
    london street map
    [URL=http://cygugocifedy.xhost.ro/london-street-map/]london street map[/URL]
    nicole austin aka coco website
    [URL=http://cygugocifedy.xhost.ro/nicole-austin-aka-coco-website/]nicole austin aka coco website[/URL]
    vash mugen character download
    [URL=http://cygugocifedy.xhost.ro/vash-mugen-character-download/]vash mugen character download[/URL]
    blue knob auto
    [URL=http://cygugocifedy.xhost.ro/blue-knob-auto/]blue knob auto[/URL]

Leave a Reply