MicroWinpeBuilder to adapt its own Winpe : tutorial or 'under the hood'?

Hello,

A script PS to modify  themecpl.dll !
 
Because i don't want to use externe program ( everyone has not ressourcehacker in his pc ), i write a little script PS to modify themecpl.dll.
The script modify-themecpl.PS1 assume the language of the ressource to modify is : 1033

The ressoure to modify : type = UIFILE and ID = 1001

To verify the language for this resource into themecpl.dll :

launch a PS console and change the working directory to the path where is located the script ( command "CD ...\..\...." )
And tape :

". modify-themecpl.PS1 <the path\name of the file to verify>

An sample :
". C:\Users\noel\Desktop\modify-themecpl.PS1 C:\Users\noel\Desktop\themecpl.dll"
An extract of display :
Type : UIFILE
        Name: 1001
                Language: 1033

If language is not good for you, modify the script ( change 1033 to ... in [UInt16]$ushortLang    = 1033 )

Now to modify the file themecpl.dll :

". C:\Users\noel\Desktop\modify-themecpl.PS1 C:\Users\noel\Desktop\themecpl.dll  C:\Users\noel\Desktop\mod-themecpl.dll  -flgmodif"

Copy the file and rename it in your winpe10 :
- if winpe is actif, copy it via usb/network in system32
- in the image boot.ini ( DISM mount/unmount ) : not too complex

I'll modify script MicroWinpeBuilder to modify automaticaly the file themecpl.dll

Hope it help.

Hello,
Big error :
I mainly use a VM with my  WinPe in "flat" mode.
However, this morning I tested WinPe with the administrator session by booting from a usb stick.

Surprise: in the session administrator, several programs (such as powershell and cmd for example) trigger the display of the box:
"The Publisher could not be verified...".

However, this message does not appear in the VM that is built from the same boot.wim file.

For now I do not understand this originates.

Another surprise: on the wallpaper, Alt + F4 Opens the box to stop and change of user.
It is just as effective as in a program mouse clicks whatever it is. But it engages only me.

Please, if you have an idea to fix this new error tell me quickly.

http://www.msfn.org/board/topic/170513-how-to-disable-security-popups-under-winpe/

It is strange that security popups disappeared with changing fbwf driver under my windows 8 pe. I do not know the connection between but you can give it a try and use another fbwf.sys.

hello. good holidays.

There are 69 downloads but very little return to date.
Do not hesitate to tell me what you think of microwinbuilder, if you managed to do a test, to build a winpe in this environment, if you can modify scripts...
And above all, I am looking for friends who want to do some research to help me understand why adm logon triggers warning messages.

The issue :
In a VM, i make a VHD booting. I decompress boot.wim in this VHD. Winpe is ok !
In a VM, i boot on the iso containing the same boot.wim as above : winpe starts, open the adm session, and the first PowerShell triggers a security message. If i clic OK, all things is ok. But all program in system32 triggers the security message " the editor can not be verify".

I do some things for investigation :
i take the hive softwqre and system from winpeSe : software ( modify for suppress dotnet 3.5... to make PowerShell to run with in this new environment ) and system ( add appinfo and start mpsSvc ).
These differences became with a comparaison with winmerge ( file .reg ). But always pb with boot usb. Other differences are minor, i think so.

In eventvwr.msc, i see that the file usrclass.dat can't be created. It is said "not enougth place or access denied" ( i don't remember the good words ).

I think the bug is more in the mecanic, in the sequence, not in the objects, because it's ok in winpe "Flat".

So if someone is interesting to investigate with me, he makes me happy.

See you soon !

hello,
I always try to resolve the anomaly detected with ISO in Winpe during logon ADM.

Over my research...

I searched a long time how can I make the "Open Command Window Here" option.

The http://www.tenforums.com/tutorials/3288-command-prompt-open-windows-10-a.html site
shows different methods to launch CMD. EXE.

The http://www.askvg.com/enable-open-command-window-here-option-in-context-menu-in-windows-vista/ site
shows how to get this option in the context menu without having to press the Shift key.

And surprise! using the "Open Command Window Here" option or the "File/right click" menu, Winpe starts well CMD. EXE without  triggering  the warning "the Publisher could not be verified..."

But with the touchs "Windows + R", CMD.EXE ( and other ) triggers the warning box. Why this and whis this only with an ISO and not "Flat" ?

for my memory :
delete
HKEY_CLASSES_ROOT\Directory\Background\shell\cmd/extended
and
HKEY_CLASSES_ROOT\Directory\shell\cmd/extended

This only solves nothing. But where to look?

hello,
The script Traitement.ps1 doesn't work with build 14393 because many names of file in script use the part of text "10586". I correct that when i can ... too much sun in Nantes.

I think i shall not modify the scripts with the goal to be compatible with the two builds. The last build is the good build for me. Don't forget, theses scripts is for "Learning" !

For my information : to construct winpe for build 14393, it is better to delete oe rename the destination directory because step 1 = launch copype.cmd does not replace boot.wim for the good build.

See you latter....

hi,
i meet many error with the build 14393. I made a V7 for this build. It's a first version. And only for this build 14393. No retro compatibility !

With the session "ADM", like winpese, i get a message "logonUi : exception breakpoint"

I see in eventvwr.msc that Windows.UI.logon.dll is the source ( see picture ).
I also see that Winpese "kill" the window message. As i say in my pdf, it is possible to use the console UI for Logonui.
For that, only rename Windows.UI.logon.dll in old.... It's simple but a text Windows will open and display "wellcome, the name adm, preparing Windows.. and after explorer display the wallpaper.

I modify registry and hope getting more description... no, only wer.dll.mui not present. So, only the report of WER.dll and nothing news.

with session "ADM", i also get "editor unknow" error. I constate if i do "tscon 1" to go in session "system" and do "tscon 2" in this session, when i return, new process is OK. So, i think it doesn't need one more file or key, but some synchronization. And i don't find it.

See you later.

hi,
With the version V8 ( only for build 14393 - 1616 ), i constate difference when i use winpe in the 3 ways:

- VM in hyperV and a VHD with boot.wim decompressed + bcd :  i can't use the graphique logon UI ( display frees ), only the console UI logon.
- the same Vhd in a DD USB + bcd : graphique logon UI  and the error (0x80000003 , click and it's OK )
- the ISO ( with same boot.wim ) : graphique logon UI  and the two errors ( 0x80000003 and "editor not verified" , click and it's OK )

Why this différences ?

For my memory, i notice theses keys :
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\
    PeBootType = "flat" if VHD in VM   or   "RamDisk:SourceIdentified" if ISO
    PeBootRamdiskSourceDrive = D:\ for ISO and it point on the usb stick
    SystemStartOptions : options defined in BCD

I try to investigate with procmon and i learn to charge the symbols in procmon.
https://blogs.msdn.microsoft.com/vijaysk/2009/04/02/getting-better-stack-traces-in-process-monitor-process-explorer/
https://marc.durdin.net/2013/09/the-case-of-the-stack-trace-that-wouldnt/
Don't forget :
- "always copy a recent version of dbghelp.dll and symsrv.dll into the folder with procmon.exe, before starting a trace."
- use a folder cache for symbols and modify : srv*x:\symcache*http://msdl.microsoft.com/download/symbols
So, x:\symcache will contain the files for the next time you analyse, backup on a big disk.

Why this différences ?

Just an idea:

boot mode (SafeMode and UEFI/SecureBoot) force OS to use different Graphic.
  (which may effect your graphique logon UI !?!? just an idea  )

who knows, maybe booting from .iso or usb or... also changes boot mode ;)

see Win10PESE topic
http://theoven.org/index.php?topic=1503.0

Just to note that there is not LogonUI worries when building with RS2 14936.
I gave up on my side on that error with Win10 1607. If someone really want the Switch to Admin, he can use Win10 1511 (10586).
Have you noted some benefits for the Logon as Administrator ?

I am very grateful for having taken the time to answer me. Thank you very much for your supports.
@Lancelot  : i choose VM in hyper V without uefi ( generation 1 ) and vhd ( not vhdx ). And on the PC, in setup, i disable UEFI.
@Chris : i undestand that build 1607 is not a good deal for Winpese Nor MicroWinpebuilder.

I constate that the session ADM is only needed in winpe for BITS but i never meet someone that need it in winpe ( nor elsewhere that someone  want to create a server for that ). In my last job, I used a lot and mostly PowerShell, bits, remote connection in PS. It's just a nostalgia that I like to check if it is available in winpe.

one note : console logon ui is not "Professional" but it is a little-known workaround.

And one question : is it possible to disable the "write-filter" of registry in winpe when it used in flat mode ?

And one question : is it possible to disable the "write-filter" of registry in winpe when it used in flat mode ?

Sadly not, it's caused by the WinPE entry in BCD store.

Hi,
I see in the forum that a guy ask about printer in Winpe. There are many and many printers, very different. And it seems to me that it's difficult to find the good files ( cat, inf, dll, etc ) before to install this printer. So, i think it's better to install a network printer. The good files are automaticaly donwloaded from the PC who share the printer.
In this version V8 of the scripts microWinpeBuilder, i can print from Notepad to my shared printer over wifi. If you use my actuals scripts, you must start spooler by your self before to launch the wizard or the command line to install.
I can't show you the paper printed of course.
The picture shows the result of the installation.

A few words about my printer "Samsung SCX-4500 Series". I discover that the print processor is a 32 bits program. So Wow64 is mandatory for this printer.

I must say that the printer is not visible in the control panel "devices and printers". But it is really visible in "Notepad/print". You can see your document and manage it if you use "right clic/printer option" from the menu "print" in Notepad.

Before using the network printer, i try with USB printer. But it's difficult to identify the good files and spooler was not good when i did the try. The USB monitor is automaticaly installed when the printer is detected. I install the drivers printer with devmgnt.msc after i plugged the printer.

I'll try to put more explanation in the pdf later.

I hope someone try it and return me it's "experience".

Not much time to test Noël but I'll try to find some, it is Interesting 

hi,

My first print via USB in winpe !

My printer have many 32 bits programs. I add many files in WOW64. And now i can print from my printer connected USB.
I install it in the adm session. And after the installation, it is disponible in teh system session ( tscon 1 to go ...). And i can also print in this system session.
a picture but it's true, you can't see the paper go out of the printer.
On the picture, you can see that the printer in not connected. I want to show the document in the spooler. But the document go to the printer if i connect it.
BUT it is not visible in the "control pannel\devices ans printers".
To see the printer and interact with it, a open a Notepad, clic "print" and after right clic on the printer and chose "open" or "properties".
At the begining, I got the error for a long time: "startdocprinter error" ( i'll put a picture when i get it). And to bypass this, i modify the key "SystemSetupInProgress".
I must do more about it for a good work automalicaly.

tips before modify :
- wifi : disable and enable card before using wificonnexion.ps1
- session adm :
    use tscon 1 and tscon 2 to prevent the message "editor not verified"
    error message at the begining of session adm is not important

hi,
i try to play with the scan of my printer.
I think the installation of driver is ok, as i can see in devmgmt.msc.
But with wfs.exe or with imagingdevices.exe, i get the error message "no scan is detected".
I put a picture to see the context .

Some think is wrong : if you have an idea .....

hi,
For the scan, i modify somme keys and i see the scan in imagingdevices.exe.
With wfs.exe, i get a new message "scan can't continue".
I see the architecture of WIA here
https://msdn.microsoft.com/en-us/windows/hardware/drivers/image/wia-architecture-overview
https://msdn.microsoft.com/en-us/windows/hardware/drivers/image/wia-core-components
And i get more info in the log \debug\wiadebug.log.
I active the log with the keys
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\Trace\wiaservc.dll]
"TraceFlags"=dword:00000007
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StillImage\Trace\sti.dll]
"TraceFlags"=dword:00000007
I can see in this log that WIA see one hardware but there is an error "access denied" in DCOM :
ERROR: CreateLocalDevice, Initialize of root item failed (0x80070005)
I put a picture to see the contexte and the log wia

Q : why keys are not completed during installation? because of methode of installation ? i first install wiasa003.inf with DISM during preparation boot.wim, and after, when winpe is started, PNP install the step wiasa003. And after, i launch "drvload scx4500.inf" for complete the installation

an idea ....

hi,

Ma première numérisation avec le scan de mon imprimante Samsung SCX4500 : OK
My fisrt scan with my printer is ok.

I make an other test in the calm. I think i have the good elements but not the good sequence.

But the question is still : during installation, why some keys are missing under ....\control\class\{6BB... ?

it's not very usefull but it's a good game. I saw in the forum that a guy ask about printer and i say to me : can i play with printer?

I know, each printer and scan is particular and it's not easy for anyone to put his printer. I use dism because it's a simple way for me.
I isole my drivers and put them in my scripts. Not really reproductible. But it's a good way to learn, not to "eat a raw steack".

I 'll make more modifications to automatise the work.
Bonsoir.

hi,
I'm trying to find the package "scx4500.inf_amd64_47a7ea2a0d75d8c7".
On my windows10Pro, I look in the file setupapi.dev.log and i found a surprise :
"     sto: {Setup Import Driver Package: c:\programdata\microsoft\windows\devicesoftwareupdates\1f79ef28-b3f9-4de5-8b6e-26332c0c3f65\scx4500.inf} 22:38:04.617
     inf:      Catalog File: SCX4500.cat
"
It's really my package but i don't know this "temporary" repository "devicesoftwareupdates".
And after in the log, i see that this directory is copied in the driverstore.
But i can't find this package in the ISO Windows10Entreprise.

Please, can someone explain to me where to find my package and describe the mecanisme "import driver package" ?
Thank you very much