A recent deep dive by reverse engineer Xusheng Li has shed light on the controversial Windows Health and Optimized Experiences (WHOX) service that recently appeared in Windows 11. While Microsoft has stated the service is primarily for collecting performance diagnostic data, Li’s analysis reveals a complex underlying architecture with a powerful scripting engine.
Unpacking the WHOX Service
The WHOX service, which prompted user concerns about auto-startup and data transmission, was first reported by IT之家 on August 3rd. Users noted its tendency to launch at system startup, monitor CPU usage, temperature, and battery status, and send data to Microsoft every 15 minutes. Microsoft’s Vice President, Scott Hanselman, later clarified that the feature, slated for a 2025 rollout, is intended for performance diagnostics.
Xusheng Li’s in-depth analysis, published on August 15th, essentially corroborates Microsoft’s explanation. However, his findings indicate that the service’s internal workings are significantly more sophisticated than a typical diagnostic tool.
The Lua Engine at its Core
The core functionality of the whesvc service resides within a dynamic link library named windiag.dll (229 KB). This DLL is notable for embedding the Lua 5.4.7 scripting language. Microsoft also provides whesvc_assets.dll, which contains 84 pre-compiled Lua scripts designed to handle a variety of diagnostic scenarios. The scripting engine exposes 79 native functions, granting it access to a wide range of Windows system capabilities.
Extensive System Access
Li discovered that the service possesses the ability to read and modify the Windows registry, perform file operations, create and interact with processes, query WMI (Windows Management Instrumentation), collect ETW (Event Tracing for Windows) records, examine security tokens, retrieve power and temperature information, download symbol files, create .cab files, and initiate HTTP requests.
Furthermore, the service includes a generic FFI (Foreign Function Interface) that enables the Lua scripts to call native dynamic link libraries and manipulate various Windows handles. Despite this extensive access, Li did not find evidence of the service arbitrarily modifying files or registry entries. The existing scripts are primarily focused on executing standard diagnostic tasks.
Diagnostic Capabilities in Action
The embedded scripts are capable of various diagnostic functions, including:
- Collecting trace records after application unresponsiveness.
- Monitoring input latency and display anomalies.
- Identifying applications with slow startup times.
- Detecting services that remain in a suspended state for extended periods.
Power-related modules are designed to investigate battery drain issues, identify factors preventing the computer from entering sleep mode, and respond to prolonged high power consumption behaviors. The ‘memory_handle_leak’ module monitors memory and handle counts over intervals, using linear regression to distinguish potential memory leaks from normal growth patterns.
Local Data Summarization
The ‘system_summary’ module generates a JSON summary lasting 900 seconds (15 minutes), but Li noted that this file is stored locally. While the service has networking capabilities, Li’s analysis did not uncover any specific scenarios where it initiates arbitrary HTTP requests.
This detailed examination provides a clearer picture of the WHOX service’s technical underpinnings, confirming its role in performance diagnostics while highlighting its advanced scripting capabilities. As Microsoft continues to evolve Windows 11, transparency regarding such background services remains crucial for user trust.
Related Reading: Microsoft VP Responds to Win11 Background Service Controversy: Used for Performance Diagnostics, Not Secret Data Collection
