作者：百年不渡分类：未来幻想点击：8524次下载：8279次大小：70M 日期：2026-08-26

终极一家

工程师分析 Win11 争议后台服务：用于性能诊断，含 84 个诊断脚本_我的网站

纸牌屋第二季

A | 8 月 26 日消息，逆向工程师 Xusheng Li 于 8 月 15 日发布博文，深度分析了 Windows Health and Optimized Experiences 服务。

Two portable air defense missiles precisely strike the stealth fighter target drone in the night sky at the same time. Photo: Screenshot from the CCTV News military channelA video released by state media on Saturday showed how Chinese People's Liberation Army (PLA) Army soldiers, through coordinated teamwork, can use portable air defense missiles to shoot down stealth fighters, detailing the training and the principles behind it.
An expert said this example demonstrates the PLA's capability to counter high-value targets with low-cost equipment through systematic coordination, noting this tactic would be a good addition to the broader system of the PLA's anti-stealth capabilities.
During the live-fire verification exercise featured in the CCTV News military channel video, teams conducted coordinated firing using man-portable air-defense systems (MANPADS) and HQ-16 air defense missiles. The HQ-16 engaged the majority of incoming targets, leaving the stealth fighter to the portable missiles.
The video explained that in real combat, large air defense missiles are mostly radar-guided, but radar has difficulty detecting stealth fighters, which is precisely why stealth aircraft can operate with near impunity. Portable missiles, however, use infrared guidance that tracks heat sources, which can actually increase the probability of detecting such targets.
The use of infrared guidance to strike stealth aircraft also drew attention in early 2026. In March, Iran reportedly shot down an F-35 fighter, with analysis suggesting that Tehran likely used infrared detection technology to hit the aircraft, challenging the myth of the F-35's stealth invincibility.
However, using portable missiles to shoot down stealth fighters is no easy task, said the CCTV video. Due to their much shorter range compared with large air defense missiles, the operators must quickly move to positions where the stealth fighter is likely to appear and launch the missiles when the aircraft is closest to them.
Moreover, this type of engagement requires extremely high synchronization between the two operators. Since portable missiles are infrared-guided and highly sensitive to heat sources, if the launches are not synchronized, the later missile might lock onto the earlier one as a target, the video explained.
The video noted that the two operators had been conducting synchronization training and are now fully ready. Upon command, two missiles streaked across the night sky and simultaneously struck the target drone with precision.
The portable missile unit's flawless performance marked the completion of its first experimental tactical exercise, making it possible to use portable missiles against stealth fighters on future battlefields, commented the video.
This coordinated drill demonstrates that through proper coordination within the air defense system, low-cost equipment can indeed unlock new combat value and pose a certain counterbalance to high-value stealth targets, Song Zhongping, a Chinese military affairs expert, told the Global Times on Sunday.
To detect stealth targets, the HQ-16 field air defense system requires multiple detection units to conduct continuous, uninterrupted scanning of the same direction. This multi-static array deployment can exploit loopholes in stealth, such as the fact that stealth is not omnidirectional. Therefore, making use of multi-directional detection can increase the probability of finding a target. Portable missiles, meanwhile, serve as an important supplement to the radar-guided system. The combination of the two can indeed engage stealth targets, Song explained.
Song also noted that this shows the mature nature of the PLA's data link and information fusion systems. However, as the video shows, this is no easy feat, it requires a high degree of coordination and skilled operational techniques.
The expert also emphasized that using portable missiles against stealth fighters is just one part of the PLA's anti-stealth system. There are other non-MANPADS infrared-guided missiles and other guidance mechanisms that also contribute to anti-stealth capabilities.
Anti-stealth capability development is a multi-channel, multi-dimensional systems engineering effort. At the detection level, in addition to multi-band radar deployment, other technical approaches include passive radar, lidar and future quantum radar, all of which can effectively detect and lock onto stealth targets. Meanwhile, airborne early warning aircraft represent another critical component of the PLA's anti-stealth capability, providing surveillance and command guidance over a wider airspace, Song said.
This multi-dimensional integrated anti-stealth capability is a key direction for future air defense system development, Song added.
。曾于 8 月 3 日报道，微软为 Win11 系统新增上述后台服务，网友反馈该服务会在电脑每次开机时自启动，持续监控 CPU 使用率、温度和电池情况，并每隔 15 分钟将数据发给微软。微软副总裁斯科特 · 汉塞尔曼回应表示该功能上线于 2025 年，用途主要是采集性能诊断数据。逆向工程师 Xusheng Li 逆向该服务的 whesvc，其结果基本印证了微软的说明，但也发现其底层架构比普通性能诊断工具复杂得多。

B | whesvc 服务的核心功能位于 windiag.dll（229 KB），该动态链接库内嵌 Lua 5.4.7 脚本语言。微软还提供 whesvc_assets.dll，其中包含 84 个已编译 Lua 脚本，用于处理不同诊断场景。脚本引擎公开了 79 个原生函数，可访问 Windows 的多类系统能力。该服务可以读取和修改 Windows 注册表，执行文件操作，创建并交互进程，查询 WMI（Windows 管理规范），收集 ETW（Windows 事件跟踪）记录，检查安全令牌，获取电源和温度信息，下载符号文件，创建 .cab 文件，并发起 HTTP 请求。服务还提供通用 FFI（外部函数接口），允许脚本调用原生动态链接库，并操作多种 Windows 句柄。不过，Li 没有发现微软利用这些能力随机修改文件或注册表，现有脚本主要执行常规诊断任务。这些脚本可以在应用停止响应后采集跟踪记录，监控输入延迟和显示异常，识别启动缓慢的应用，并检测长期处于挂起状态的服务。

C | 电源相关模块能够调查电池异常耗电，判断阻止电脑进入睡眠状态的原因，并响应持续的高功耗行为。memory_handle_leak 模块会在多个时间间隔内跟踪内存和句柄数量，再结合连续增长情况与线性回归斜率，区分潜在内存泄漏和正常增长。system_summary 模块会生成 900 秒、即 15 分钟的 JSON 摘要，但文件保存在本地。