MicroWinpeBuilder to adapt its own Winpe : tutorial or 'under the hood'?

bonsoir,
I can print (usb and network) and scan but it needs manuals steps.

For a summary of my investigation around my printer/scanner:
1 - when connecting the USB port on the PC, the installation of :
-the printer managed correctly. However, it needs the following treatment:
After you select the printer and before printing, there are changes the SystemSetupInProgress key
Eventually, do net start/net stop spooler.
-Scan works properly. Nevertheless, certain keys are not entered in the register
Therefore, treatment: adding keys, net start/net stop stisvc

2. for PDF and XPS printers, I failed installation.
Fact: due to the method of installation of ntprint.inf and ntprint4.inf with DISM, the hive Drivers does not point
entry ntprint.inf or ntprint4.inf. Indeed the mechanism "DISM" renames these entries with names starting with OEMxxxx.inf.
Consequence: in the session System, i load the hive Drivers and change these entries.
To find good entries to rename, you can consult the file...\mount\...\inf\setup.dev.offline.log
Pre installation: when the spooler starts with SystemSetupInProgress = 0, it pre-installs (IMPORT section in setup.dev.log)
inf files in the directory under x:\windows\system32\spool\tools\microsoft... ( copied in boot.wim ).
Then, you must install these printers with "control.exe/devices and printers" for example.
To select: use the last choice 'add a local printer...', then select the port "PortPrompt". Are displayed on left side "manufacturer" (microsoft)
and on the right, the 2 printers PDF and XPS.
Then we start the installation ... and error message appears:
"cannot install the printer.
Invalid descriptor".

The procmon trace does not tell me more. I don't know from where this descriptor comes. ( translator : ggrrrrr )

Next week, I will compare with installation on a windows 10 OS.

hi,

Printers PDF and XPS are OK. I'll write a text for that. And i'll update scripts.
It was long, very long. And nor really usefull, i admit.

My wrong idea : using GUI to install printers pdf and xps
The good way : it's the spooler who install theses two printers automaticaly. it needs only to put the good files in the good place.
And "start-service spooler" with the modification od systemSetupInProgress. And after 1 or 2 minutes, printers are there.
Not visibles in control panel but visibles in Notepad.

It's difficult to put a picture to display the creation of file by printer pdf/Xps. So believe or not .....

"gwmi win32_printer" displays capabilities but not "printing".

it's time to sleep for me.

So believe or not .....

I believe 

spooler is one of things not changed much for very long time (Win2000, NT4,  ....)

And nor really usefull, i admit.

that is the reason very rarely (once 5 year I guess) someone find and share the way found 

On good side, to me, it is always good to have more solutions at hand 

And after 1 or 2 minutes, printers are there.

Well on Gena it is same, spooler not changed much. 

I'll write a text for that.

I hope Chris can follow easily this on SE.

hi,
I updated v10 ( scripts ans pdf ) for printer PDF/XPS.

I put details in the script "traitement.ps1" because it evolved during the investigation. But it's in french.

I'm taking a break because I'm stuck on all tracks.

Everyone can respond to the various anomalies that I can't fix (invisible printers in the control panel for example...)

See you later.

hi,
the last week has been difficult. I wanted to test 'Windows To Go'. I bought a 32 GB USB3 key.
But PWCREATOR. EXE has consider that it would be inappropriate because he found only a little more than 29 GB.
So I used the "manual" method with "dism and bootbcd".
The construction was very long, as if the key were USB2.
I got started with this USB3 key on a port USB3. The installation is successful, but it's very long also.
But the worst is when using Windows To Go. Everything was slowed down. Unusable.
The performance monitor indicated that the drive corresponding to the key was used 100% continuously.
I therefore rebuilt WTG on an old key USB2. But no luck. DISM reported an error.
I wasn't in front of the PC. The key had become unusable: write-protected.
I was looking for the "wonderful" softwares available on flashboot.ru or usbdev.ru.
It took several days to find softwares compatibles with my key (alcor Au6983) controller.
A misguided click started installing a software on my PC under Windows 10.
And I said to myself: I just caught a virus.
The curiosity was too strong. I launched the software. Windows 10 reported that he refused to load a driver.
I am grateful to him for that. I got a little integration of this software in the OS.
And so I took out my old laptop which is always under XP SP3.
With XP, I was able to launch many of these softwares. None detected my key.
I tried to modify an .ini file with the hope to steer the recognition of my key.
When it was recognized, I even modified random parameters. Then I clicked on "start".
Of course the software reported errors. I did it again. In less than a minute, it was over.
And my key was operational again.
I launched the antivirus on my Pc on windows 10. Two days. Malware :"JS/Fashack.G" serious and active!
Found only in Firefox. Surprise for me.
One day I'll take care of the PC under XP.
So I tested this USB2 with WTG key. Same slow. Unusable.

I've moved on a bit with Windows Media Player: now I can read MP3 files. I will modify my scripts later.
I can also read files .wav with powershell ( 2 lines !) with "MCISendString API" of winmp.dll.
But WMP will not play the .wav files.

hello,

Only with 1607 build 14393 :
In the case of a boot from a VHD mode "flat" (from a VM hyperV or from USB disk), the session "Administrator" does not open.

Workaround:
Rename Windows.UI.Logon.dll to - Windows.UI.Logon.dll

In the current state of the scripts, it is possible to create a file x:\noAdm which prohibits the launch of "tsdiscon.exe". We can do all the necessary investigations before  to launch tsdiscon manually .
And if you find a solution, please tell me.

Only with 1607 build 14393 :
In the case of a boot from a VHD mode "flat" (from a VM hyperV or from USB disk), the session "Administrator" does not open.

Interesting info...

Workaround:
Rename Windows.UI.Logon.dll to - Windows.UI.Logon.dll

maybe you mean:
Rename Windows.UI.Logon.dll to - Windows.UI.Logon.dl_

@Lancelot : thank you, you are right.
A space was added by the translator at the begining of the name. I have a bad habit to rename by adding a "-" at the beginning of the name and not change the extension. I'll change this very bad habit in 2017.

happy new year 2017 !

Happy New Year 

hello,

I play with "ChangeResolution" to modify width and height of the screen in PS for Winpe.

Msdn says that the WM_DISPLAYCHANGE  is sent to all windows when the display resolution has changed.
And here https://msdn.microsoft.com/en-us/library/windows/desktop/dd183411(v=vs.85).aspx, Msdn says "When the display mode is changed dynamically, the WM_DISPLAYCHANGE message is sent to all running applications with the following message parameters." But with my PS script, the desktop don't adapte itself. I must kill the task explorer.exe and launch again for a good desktop.

If someone knows the solution, please, says to me.

Salut Noel

Win10PESE uses JFX'Fixscreen Taskbar hides bottom application window Reply #5 
If you want to code it yourself, look at win10pese x86 and desktop wallpaper

Bonsoir ChrisR,

Mais comment JFX a t-il bien pu trouver qu'il fallait envoyer un WM_DISPLAYCHANGE lors de la réception d'un WM_SETTINGCHANGE  ?
Ca marche !

How does JFX find that to adapt task bar on the desktop (explorer), it needs to send WM_DISPLAYCHANGE  after system sends WM_SETTINGCHANGE ?
And why winpe doesn't do that?
Many questions without response, i suppose.

I'll put scripts Ps for anyone can see by itself how to change the screen resolution from winpe, dynamically and manually.

No idea why explorer doesn't correctly respond to the change.
The tool just wait's for a WM_DISPLAYCHANGE message and does the following:

Code: [Select]

     ; Desktop
      SHChangeNotify_(#SHCNE_ASSOCCHANGED , 0, 0, 0)
      SendMessage_(#HWND_BROADCAST, #WM_SETTINGCHANGE, 0, 0)
     
      ; Taskbar
      hwnd = FindWindow_("Shell_TrayWnd", 0)
      If hwnd
        abd\cbSize = SizeOf(APPBARDATA)
        abd\hwnd = hwnd       
        SHAppBarMessage_(#ABM_GETSTATE, abd)         
      EndIf
     
      ;Wallpaper
      If Not SystemParametersInfo_(#SPI_GETDESKWALLPAPER, #MAX_PATH, @sWallpaper, 0)
        If RegOpenKeyEx_(#HKEY_CURRENT_USER, "Control Panel\Desktop", 0, #KEY_QUERY_VALUE, @hKey) = #ERROR_SUCCESS
          dwsize = #MAX_PATH
          RegQueryValueEx_(hKey, @"Wallpaper", 0, 0, @sWallpaper, @dwsize)         
          RegCloseKey_(hKey)
        EndIf
      EndIf
      SystemParametersInfo_(#SPI_SETDESKWALLPAPER, 0, @sWallpaper, #SPIF_UPDATEINIFILE)

Hello JFX,
Thank you very much to share your code .
I hope you understand my poor English, i am trying without translator.

May i ask you an other question? How do you find the need of the "sendmessage WM_SETTINGCHANGE" ?

I think i don't use the good tool or good method to investigate. I try spy++ in winpe without result. On internet, i founded only reference to "WM_ChangeDisplay".
Thanks again

Note : i'll test more but i think that WM_SETTINGCHANGE is the only one msg  needed in "my winpe" when changing screen resolution.

Hello Noel,

SHChangeNotify_(#SHCNE_ASSOCCHANGED , 0, 0, 0)
SendMessage_(#HWND_BROADCAST, #WM_SETTINGCHANGE, 0, 0)

It's just the usual code I use to force refresh desktop icons.
In my WinPE it's not 'always' enough.

Default vga or latest nvidia driver make a difference, but also start menu replacements cause different behavior.

Hello JFX,
Thank you very much. Merci beaucoup.
My ask was about the tools you use for find it
And i understand that it's only your experience of programmer  that puts you on the track of the solution.
I also understand that this only sendmessage is not enough for you, because you are in front of many différents contexts.
Once again, thank you for taking the time to answer me

In microWinpeBuilder context, I use this PS attached script with a GUI to change screen resolution with your tips. It's OK for me.

Hello,
I'm trying to understand why the button in the task bar at the bottom right does not show the desktop.
I have no ambition to find but I want a look and implement some tools like spy ++ and windbg.
1 - address of the WndProc of the button whose class is "TrayShowDesktopButtonWClass".
It is easily found with spy ++. But I can not find it with the API GetWindowLongPtr.
The following code snippet returns 0 and GetLastError returns 50 (decimal): The request is not supported.
While I get all other indexes (hinstall, type).
I don't understand why I get "GWL_HINSTANCE" but not "GWL_WNDPROC".
If someone can explain to me...

Code: [Select]

$code=@'
using System;
using System.Runtime.InteropServices; 
namespace Win32_API
{
public enum GWL
{
     GWL_WNDPROC =    (-4),
     GWL_HINSTANCE =  (-6),
     GWL_HWNDPARENT = (-8),
     GWL_STYLE =      (-16),
     GWL_EXSTYLE =    (-20),
     GWL_USERDATA =   (-21),
     GWL_ID =     (-12)
}
public class Win32_API_Class
{
[DllImport("user32.dll", EntryPoint="GetWindowLongPtr", SetLastError = true )]
public static extern IntPtr GetWindowLongPtr(IntPtr hWnd, int nIndex);

[DllImport("kernel32.dll")]
public static extern uint GetLastError();
//https://blogs.msdn.microsoft.com/adam_nathan/2003/04/25/getlasterror-and-managed-code/
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr FindWindowEx(IntPtr parentHandle, IntPtr childAfter, string className,  string windowTitle);
        static public IntPtr GetWindowLongPtr_(IntPtr hWnd, int nIndex)
        {
  IntPtr ret = GetWindowLongPtr( hWnd, nIndex);
  if (ret == IntPtr.Zero){
  Console.Write("GetLastError : {0}", GetLastError());
  }
  return ret;
}
}
}
'@
add-type -TypeDefinition $code
$h1 = [Win32_API.Win32_API_Class]::FindWindow("Shell_TrayWnd", "");
$h2 = [Win32_API.Win32_API_Class]::FindWindowEx($h1, 0, "TrayNotifyWnd", "");
$handle  = [Win32_API.Win32_API_Class]::FindWindowEx($h2, 0, "TrayShowDesktopButtonWClass", "");
"Handle de TrayShowDesktopButtonWClass : {0:x}" -f [int]$handle
$hinst=[Win32_API.Win32_API_Class]::GetWindowLongPtr( $handle, [int][Win32_API.GWL]::GWL_HINSTANCE)
"hinst : {0:x}" -f [int64]$hinst

[Win32_API.Win32_API_Class]::GetWindowLongPtr_( $handle, [int][Win32_API.GWL]::GWL_WNDPROC)
#WindowProc fournie par Spy++ : c68D1FB0 mais il n'y a pas de segment, juste l'offset

2 - Trace the WndProc of "TrayShowDesktopButtonWClass" with WinDbg code in a normal 10 windows
As Spy ++ provides the WndProc and PID, I can use WinDbg with the "segment" Hinstance. Otherwise, I do not know what use segment.
The WndProc addresses different "WM_message", as 0x81 (WM_NCCREATE), and 0x82 (WM_NCDESTROY).
Messages that activate the display seems to be: WM_LBUTTONDOWN = 0x201 and WM_LBUTTONUP = 0x202.
These messages are identified by spy ++
The passage of the parameters with X 64 is a little disturbing.
Explore! CWRLImpWndProc <CShowDesktopButton>: s_WndProcBase:--->>> param: handle = RCX, Msg = RDX, wParam = R8, and lParam = R9.

The WM_LBUTTONUP code is currently analysing. There's a piece of interesting code:
Explorer!CShowDesktopButton::_HandleLButtonUp+0x7f:
00007ff6`c69addd3 e8f85affff         call    Explorer!CShowDesktopButton::_ActivateLivePreview (00007ff6`c69a38d0)
00007ff6`c69addd8 e8df020000      call    Explorer!CShowDesktopButton::_ToggleDesktop (00007ff6`c69ae0bc)

This last function sends a WM_message = 0x579 at the window "Shell_TrayWnd".
And if launches a SendMesssage (need test with postMessage!), then the desktop is displayed in Windows10 normal .
But he does not appear in Winpe.
I conclude that must also trace "Shell_TrayWnd", which will be much longer!

Code: [Select]

$signature = @"
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
[DllImport("user32.dll")]
public static extern int SendMessage(int hWnd, int hMsg, int wParam, int lParam);
"@
#Add the SendMessage function as a static method of a class
$Win32_API = Add-Type -MemberDefinition $signature -Name "C_Win32_API" -Namespace Win32Functions -PassThru
$h1 = $Win32_API::FindWindow("Shell_TrayWnd", "");
"{0:x}" -f [int]$h1

$Win32_API::SendMessage($h1,0x579,3,0)

hello,
Chris find the solution for "session ADM".
And during this reseach, i find why ie64 doesn't work well. A file missing in microWinpeBuilder : ieframe.dll.mui
So, i'm glad to write this reply from IE64 in MicroWinpeBuilder in a VHD mode flat. 
I test to download a file = OK
I put a picture ...
I am preparing a new version of my PDF(verson 3) to explain for ie64. i'll post as soon as possible.

PS : with ie64 in winpe, i meet difficulties for sign in this site : i receive many times the page "verify cookies..."
        manage password seem not working
        download and historique dowload = OK

Chris find the solution for "session ADM".

Thanks, but you can write We 

About IE32, IE64, do you have it also in the System Session with the download feature or only with the administrator account ?
For the password, maybe you can take a look at Win8.1SE IE11 plugin if it can help.

I reply from session System. But download doesn't work.
I try to investigate ..... But security for system is an enfer/evil