Abstract:
Recently, the performance of Windows 11 has continued to be criticized by users, and a background service called "Windows Health and Optimized Experiences" has also attracted attention. It has been previously claimed that the service monitors processor, temperature and battery information and sends data to Microsoft every 15 minutes. In this regard, reverse engineer Xusheng Li analyzed its core service whesvc and concluded that the service does have quite extensive system permissions, but the existing scripts are mainly used for performance diagnosis, and no signs of automatic uploading of user data or screen monitoring were found.
Microsoft engineer Scott Hanselman previously explained that the service is positioned to collect targeted performance diagnostic data when Windows detects running lag or slow response. Relevant tracking information will be saved locally first, and users can choose whether to submit it through the "Feedback Center". Xusheng Li's reverse analysis basically confirms this statement, but also shows that its underlying implementation is far more complex than ordinary performance diagnostic services.
Analysis shows that the size of whesvc service body is not large, and the key functions are mainly located in windiag.dll. The dynamic link library embeds the Lua 5.4.7 scripting language. Microsoft also provides whesvc_assets.dll with the system, which contains 84 compiled Lua scripts, each responsible for different diagnostic scenarios.
Xusheng Li found that the script engine opened 79 native functions to scripts, with a wide range of callable capabilities. These include reading and modifying the Windows registry, performing file operations, creating and controlling processes, querying WMI (Windows Management Instrumentation), collecting ETW (Windows Event Tracing) data, checking security tokens, obtaining power and temperature information, downloading symbol files, generating .cab compressed packages, and initiating HTTP requests.
In addition, this mechanism includes a common foreign function interface (FFI), which allows scripts to interact with native DLLs and different Windows handles. From a capabilities perspective alone, the permissions of this underlying engine are indeed far beyond what is required for ordinary performance diagnosis, which can easily cause users to worry about privacy and system control.
However, being powerful does not equate to being used for inappropriate purposes. Reverse engineering results show that most of the scripts provided by Microsoft with the system only use these capabilities for routine diagnostic tasks. For example, registry-related functions are mainly used to save its own counters after service restarts; a driver information module can modify Windows Driver Verifier settings, but this function needs to be triggered by specific environment variables and serves the memory monitoring process. Researchers believe that this may be one of the most invasive operations of whesvc in practical use.
Some scripts also call Microsoft's own tools. For example, one script will start powercfg.exe to generate a Sleep Study sleep report, and another path will call wpr.exe to merge the performance tracking records generated by Windows Performance Recorder.
In terms of practical diagnostic capabilities, whesvc can collect trace information when an application becomes unresponsive, monitor input lag and display anomalies, identify applications that start slowly, and detect system services that stay in a waiting state for a long time. Its power module can be used to troubleshoot abnormal power consumption, analyze factors that prevent the computer from going to sleep, and respond to persistent power consumption issues.
Take the memory_handle_leak module as an example, which is specially used to troubleshoot memory leaks. It tracks memory and handle counts over multiple time intervals and combines sequential growth with linear regression slopes to try to distinguish potential memory leaks from normal resource growth.
The controversial statement of “uploading data every 15 minutes” was also clarified in this analysis. The system_summary module does generate a JSON system summary of 900 seconds, or 15 minutes, but this data is saved locally by default. Despite the service's network communication capabilities, researchers did not find any script scenarios that would make random HTTP requests; among all 84 scripts, the only identified URL pointed to Microsoft's public symbol server, a feature that is reportedly disabled in regular retail Windows installations.
Therefore, Xusheng Li said that he had specifically looked for possible suspicious behavior, but found no evidence that the service would secretly record the screen, nor did he find that diagnostic tracking data would be automatically uploaded to Microsoft without user action. The statement that "Windows 11 uses this service to secretly monitor users" that has been spread on the Internet lacks corresponding technical basis.
Overall, what Microsoft has built for Windows 11 is a universal system diagnostic engine that runs with SYSTEM permissions and can handle tasks such as the registry, files, processes, and native code execution. Its underlying capabilities are obviously more powerful than those required for performance troubleshooting itself, but the scripts currently provided with the system are still limited to the scope of performance diagnosis. In other words, whesvc’s permission design may deserve continued attention, but existing analysis does not support its direct characterization as “spyware.”
Comments