Wasn't sure where to ask this on stack exchange, so vote to close if you think it is in the wrong place.I am analyzing a Windows security patch. Having never examined a windows security patch, and being unaware of their structure I am trying to figure it out for myself.In the patch I have (this week's I.E patch) I have these files:_manifest.cix.xml <- obviously a manifest for the patch. Binary files numbered 0 - 130 Dozens of files with similar names to this: amd64_1d07faac344e137a0d122aad24eb4e6e_31bf3856ad364e35_11.2.9600.17280_none_eaadf6b3ac7d9c33.manifest <- I am assuming that these are architecture specific changes. package_1_for_kb2977629~31bf3856ad364e35~amd64~~11.2.1.0.cat <- A catalog of some sort. Not sure how it's used by the update. package_1_for_kb2977629~31bf3856ad364e35~amd64~~11.2.1.0.mum <- more information about the update. My question is: Is there comprehensive documentation for how all of these parts work together, if not, how do all of these parts work together? I imagine, what has to happen is that some mechanism has to tell the update where in the binary to patch, and then one of those files numbered 0-130 is the code to overwrite. I'm sure there is a standard format so that I can interpret these files. For instance: <?xml version=1.0 encoding=utf-8?><assembly xmlns=urn:schemas-microsoft-com:asm.v3 manifestVersion=1.0>  <assemblyIdentity name=1d07faac344e137a0d122aad24eb4e6e version=11.2.9600.17280 processorArchitecture=amd64 language=neutral buildType=release publicKeyToken=31bf3856ad364e35 versionScope=nonSxS />  <deployment />  <dependency discoverable=false>    <dependentAssembly dependencyType=install>      <assemblyIdentity name=Microsoft-Windows-IE-MemoryAnalyzer version=11.2.9600.17280 processorArchitecture=amd64 language=neutral buildType=release publicKeyToken=31bf3856ad364e35 versionScope=nonSxS />    </dependentAssembly>  </dependency></assembly>Would seem to suggest that we are about to patch assembly 1d07faac344e137a0d122aad24eb4e6e which might be named Microsoft-Windows-IE-MemoryAnalyzer. That's just a guess! I don't see any reference in here to the code to patch. I imagine one way of doing that is to just read through these manifests in order, and apply the patches in the order the manifests are read. First manifest gets binary file 0 and so on. That seems janky, and I bet I'm wrong about that. Based on the size of the files themselves, I would imagine that they aren't rewriting the whole module, although they might be compressed. Without any reference I haven't a clue as to their structure. I imagine there would be snippets of code, and offsets for where to rewrite the DLLs/Exes in question. Of course I ran strings on the binaries, but didn't find anything. What I would most like to figure out through this is which particular functions are being patched in IE. 
How do the internals of a Windows update security patch work?
windows;patching;binary