Is Windows 11's Performance Service actually spyware?

Windows 11 has a service called “Windows Health and Optimized Experiences” that runs in the background. A new in-depth analysis of this service shows that there’s a lot more going on behind the scenes than you might expect.

So Xusheng Li decided to take a closer look at whesvc by reverse engineering it, the service behind Windows Health and Optimized Experiences. Microsoft claims it's a service that monitors CPU, thermal, and battery information before sending data to the company every 15 minutes.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

As Microsoft engineer Scott Hanselman explained, the service is intended to record targeted performance diagnostics when Windows detects slow behavior. The traces recorded are stored locally and can be submitted via the Feedback Hub. Li's research largely confirmed this, but it also revealed that Microsoft isn't stopping there.

The whesvc service itself is actually quite small. The interesting functionality is located in windiag.dll, which uses the Lua 5.4.7 scripting language. Microsoft also uses whesvc_assets.dll, which contains 84 compiled Lua scripts that handle different diagnostic scenarios.

This is where things get interesting. Li found that the scripting engine exposes 79 native functions, giving Microsoft scripts access to a surprisingly wide range of Windows features.

For example, the service can read and modify the Windows Registry, run arbitrary file operations, create and interact with processes, query Windows Management Instrumentation (WMI), collect Event Tracing for Windows (ETW) traces, check security tokens, retrieve power and thermal information, download symbols, create .cab files, and even make HTTP requests.

There is also a generic foreign function interface (FFI), which allows scripts to interact with native DLLs and various Windows functions. This makes the underlying engine significantly more powerful than would be necessary for a performance diagnostic service.

However, this doesn't mean that Microsoft is secretly using the service to manipulate random files or Registry entries. Li found that scripts use these capabilities for fairly simple diagnostic tasks.

The engineer says he looked for anything suspicious, but found nothing. The service does not secretly record the screen, and its diagnostic traces are not automatically uploaded to Microsoft servers, he says.

Microsoft has essentially built a general-purpose system diagnostics engine that runs like SYSTEM, with unlimited capabilities from registry and file manipulation to process creation and native code execution. The data sent remains within the bounds of performance diagnostics, but the underlying engine is far more capable than the job requires.
You can read Xusheng Li's technical analysis from here.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.