MicroWinpeBuilder to adapt its own Winpe : tutorial or 'under the hood'?

When you put all the files in the wim and get most services working it will be difficult to track termservice. Because all the files,services,reg read write values will be huge to track in procmon. Need to keep it simple and functional. Probably procmon will not be usefull at the end of process because you will end up a point that procmon will not show any missing files but there will be a few files missing. Also it will be usefull to keep procmon working at the start of remote desktop connection. It shows good info about connection state and missing files.

Hi vvurat,
Happy to read you.
Yes, more bigger is the number of running processes, more is difficult the investigation. Procmon brings filters. And many hours in the procmon's traces gives me some facility. For exemple, the end of loading the dll before the main of process starts is given by the load of "imm32.dll". And so on for different indices.
And yes, sometime i use procmon to trace the boot (i wrote some words of this in my pdf).
For termservice, it's more simple because i disable it before boot. The advantage of Flat is that you can modify the system hive "directly" because it's the only one that os doesn't kept open (in V1709 i'm sure) and reboot. Update is really easy. No Wim to mount/unmount !
And i'm sure all needed modification are in system hive because i swapp only this hive for it works ( system-from-winpe and system-from-w10-after-installation. And yes i use in the two tests the software hive that came after installation, so a few modifications are possible from software hive from install.wim in ISO). Perhpas too long and incomprehensible.
As i said before, the "full-flat" environment (i suppose it's like ramos in a Chinese site) give me the base of "all" features which are possible to added in winpe "normal" without difficulties. And because port 3389 is open in "full-flat", i think it's possible to get in winpe normal. It was the case with "schedule".
And it's because i want to understand how the wrapper "https :// github.com/stascorp/rdpwrap/" was "invented" that i look in termsrv with its "native" trace. It's a good plate-form to play for me.
Have you try to construct a "full-flat" ( or that else name because i don't understand the term ramos which recovered many notions when i search in web) ?
I put a text file with the very very few number of modifications in post1. And yes, it's too long to install w10.
Bonsoir

Hi,
It took me a very long time to find a method to identify the missing item in WinPE for ETW/ETL traces to work.
In my microwinpebuilder environment, "logman start" seemed to loop or wait indefinitely.
I do not describe the investigation phase but I learned a lot.

The key. ..\control\WMI taken on a normal W10 and copied into my WinPE solves my problem. I don't know what's useful inside. It'll be for later.

So I can use ETW traces and ETL files as long as I know which setting to activate. I will continue with traces of TermService and later to "explore"

hi,
After about two months of searching and testing, I can now play with "MSTSC.EXE" and "MSRA.EXE" in both directions.
I can use WinPE to drive a normal W10 and the other way around.
As well with  "Remote Desktop (MSTSC)" As with "remote Support (MSRA)".
In Winpe MSTSC works both ways and with both accounts, SYSTEM and ADM
In Winpe MSRA works with SYSTEM and ADM accounts in the case of mode  "Expert "
But in Winpe MSRA only works with the ADM account in the case of mode  "Novice "
The extra size is low.

My winpe64 now has the following features:
   The desktop  "explorer "
   IE (no download for the SYSTEM session)
   MSTSC with NLA in both directions
   MSRA in both directions (only with ADM session for  "Novice " in WinPE)
   Printers PDF, XPS and  "My " printer (so I can not do other tests)
   MMC, MSI, WIFI, LAN, WSMAN, PowerShell (remote PowerShell by reading the PDF),...
   MP3 Audio (still some searches for WAV and MP4)

My opinion on the quest for the lowest size for WinPE:
-ISO and/or Boot. wim: For what use?
   In my old job, installing Windows via PXE, so fully automated and WinPE built with MDT. So, no need to customize winpe.
   For troubleshooting in a professional environment? Can a new installation be more efficient and faster?
-WINPE Flat mode in a VHD:
I use a VHD very often in a USB stick: The size of WinPE is in this case not at all important.
Moreover the loading is much faster and the ramdisk becomes useless.
-WINPE Full-Flat mode in a VHD:
It offers the maximum of features without any investigative work. The installation time is important but then  "All " is available without any work. Nevertheless, it is necessary to pay attention to the detection of the material

I will never be able to convince WinPE users of the efficiency of the "full-flat" mode, close to Wintogo.
I can cite: persistence of the files deposited and very easy modification of the hives for the next reboot.
In particular, the SYSTEM hiev is not locked and you can load et modify under winpe, save it and reboot.
It is a pity that they do not test them themselves to check. This is not a judgment, just a remark.

As I do not want to invest in a scripting language like that of WinBuilder/PeBaker, I do not have an efficient constructor.
I understand that modifying PS scripts can scare the neophytes. Yet PS is powerful.
Currently, the construction time is 14 minutes on my PC. It's a long time. This comes in part from the choice I made to use  "DISM add-driver " without optimization. And also from to many use of "reg copy"
With the ' MDT method  ', a single directory containing all the drivers, I think the time saving would be very important.
And using only one "reg copy" is possible with a script modification.
 
Again, my goal is pedagogical: collect useful information in a PDF and show with PS scripts how to edit a basic WinPE (and a GUI in PS for fun)
(V16 in the first post)

 
good to see you got progress on mstsc.exe.
Teamviewer is a lazy option.

Do you have a plan to see  MTP?

As I do not want to invest in a scripting language like that of WinBuilder/PeBaker, I do not have an efficient constructor.

I agree with this.

I use HTML+JS create a GUI to make some settings things and put them in environment variable  or build config file,
and run batch file to make PE. In batch file can call any script you like, even the batch file can be set to a powershell file.
and as the builder self is made by only TEXT file, everyone can modify it in any time with little front web front skill(HTML,css,js).

even not a beta release, but the technical identification looks good.
maybe someday you can use it.
http://theoven.org/index.php?topic=2390

hi slore,
Happy to read you.
I saw your thread about html+Js. But with my poor english, i couldn't speak about. I don't understand details. In my old job, i use MSHTA+ VBS. But i never learn html language. I only have the basics of language.  I wrote with notepad.exe. It was ten years ago. After, i use PS and winform. Realy better for me.
I'll try to understand your tool.
Like any man, i use more easely tools i build.   
I also saw your winXshell. Bravo (in french)  .  Did you write it in C++ or C# ?

About MTP, do you speak about "Media Transfer Protoco" ?
I tried ( at the end of 2017) Windows_MediaFeaturePack_x64_1709.msu that at found on MS site. It's for Version N (without media player). I try to install it in winpe. But the engine detects a wrong version (not N). And because i don't find how to progress, i come to MSTSC.
I must try with "full-flat" because it offerts the maxmimum without too many work.
But it's a good challenge for next months.

I hope you can understand what i write with my poor english. And fortunately you do not hear me speak English

Salut noeBlanc (ton prénom c'est noel ou c'est juste un pseudo ?)
Congratulations for all your work, your research, your documentation 
it's really interesting and you impress me in your perseverance to go after and catch things, like rewriting SetWoW64 when it already exists.

I think your project would gain a lot, in the eyes of others, if you had some options added in the GUI.
Like installing or not Printers, Scanner (not my stuff) or other options.
Again, bravo for Mstsc with NLA support, Msra,... I always enjoy your works 

About the Media Transfer Protocol, I guess that the check during installation is probably related to ProductOptions(Policy - EditionName, brandinginfo or productinfo..!)

Hi ChrisR,
Oui mon prénom Noël et mon nom Blanc. Je suis né le 25 décembre et je suis content de cette originalité 
Si tu passes à Nantes un jour, viens voir le Père Noël

Thank you for your encouragement and your valuable advice. It's very nice to have your opinion.

I know that my pdf is very poorly structured, contains errors, and I don't report everything that is contained in the PS script. It's very complicated to describe the result of a search in winpe and how to implement it later in winpe.

I knew misty is interested in a faster construction mechanism in trying to avoid the ADK uploading. I also searched on this topic. He studied 2 aspects: the work of dism and also the acquisition of the only useful objects via the network
I somewhat traced the functioning of dism. The assurance of getting the right result for MS is paid by long-term treatment. This is where the acceptance of the risk reaches a limit. That's why I think that the quest for the few files that are useful for the proper functioning of dism will be limited to a limited number of contexts, and will can be hard to identify abnormalities. The second point, avoid downloading ADK, seems useful and safe.
But for now, I prefer to look for the small details that remain obscure to me, as wav files which does not work in a winpe but works in full-flat

Your winpe works very nice and stable but the rule never use any other sofware is very stupid idea. You have to use at least pecmd.exe and startisback. Your winpe is full of garbage files but i can not blame you because your aim is not to simlify the winpe, your aim is only to get work as much of you can. It is very useless to have such aim because if somebody wants that he should use windows to go if his needs to boot full windows. Also winbuilder is full of garbage. A good winpe have to be 330mb in size and should have at least %80 full windows functionality. It can be done but windows updates more frequenlty then the self motivated winpe warriors. Also hard working chineese could not achieved that but they are more close than everybody in other english speaking forums, they do not have legal limits and they can share everything they want. I have downloaded at least %80 of chineese builds. It needs very hardwork to download them because the great chineese firewall and baidu does not lets to reach them. At least in my country. Most of them are very good but not good enough. They are also in half way to make a good winpe. If someone wants printer support in his winpe he sould be stupid, if someone wants a remote desktop support in his winpe he should be stupid + But everyone needs targets in their lifes. Target could be reachable or unreachable but at least that are targets and helps a person to be motivated. There are always miracles and once upon a future there can be a genious appear from the darkness and create miracles. When a windows 7/8/8.1 winpe can make more then 10's do in less size it will always be useless to work on 10 but people like to be famous and to use latest. I wish luck to my competitors because i have less time to work on but close to %90 to my own targets. If anyone of here have been worked in a work place that end users have been using the oldest hardware and does not have enough money to use the latest software, enough ram to boot such big wims could be understood me. Please get rid of garbages because you can find a full installable windows 10 x64 in CD size from internet that your %30 functionality winpes are more bigger then them. I have not installed them but theese are not winpe, they are installable windows 10 images. It means they have at least 200 mb boot.wim garbage. Your winpes are more bigger then lite images.

Maybe someday we can all live up to your standards 

Hi, noelBlanc

I saw your thread about html+Js. But with my poor english, i couldn't speak about. I don't understand details. In my old job, i use MSHTA+ VBS.

What I said "html+Js" is MSHTA.It is same thing but JS has lots of plugins now in the open source world, for the filesystem operation what JS can be done =VBS can be done.
but config file like JSON format, JS is native support, and the UI operation with JQuery is really easy,so I use it now.

WinXShell is written by C/C++ to make it less dependency. C# is good for developing, but needs .NET framework, that make it big size for WinPE.

>About MTP, do you speak about "Media Transfer Protoco" ?

YES. why I need it:
WinPE is just use for maintenance the file system and install Windows for my needs.
100MB+'s WIN10PE which without LAN,audio support, and winsxs be reduced winre.wim + some portable applications is good for that.

but some time I need to search on the Internet, and download some files/dirvers...
I can Temporarily use my PHONE for that, but I can't trans them to the PE with only USB cable.
(no WIFI support and driver integration, so also can't use FTP/HTTP server to trans them)

Hi, ChrisR

About the Media Transfer Protocol, I guess that the check during installation is probably related to ProductOptions(Policy - EditionName, brandinginfo or productinfo..!)

thanks for the infomation.

Hi, vvurat

The PE is not for end user, but for understanding how to make things to work in WinPE,
more like a study/research project.

>You have to use at least pecmd.exe and startisback.
I don't think so.
add the things can make some actions to be simple, but no essence change for PE.
startisback just some fast entry to run files(shortcut)
and most people know how to add them, it's easy to do is it.

* make wow64 work
* ShowDesktop(Win+D) in native way(explorer's functional)
* printer on SYSTEM
* ...
* ...

this things make essence change and need some one to do/research them.

I think is good that PE builders learn the knowledge  here and integrate them for end users.(ShowDesktop function is integrated in PECMD with noelBlanc's work!)
noelBlanc should focus on those things, not waste time to make it "beautiful" now.

>the rule never use any other sofware is very stupid idea.
that is because powershell is too powerful can implement everything he need.
but I agree with you, noelBlanc can use some software temporarily which one he already know how it work,
save some time to fast forward to next survey.

>When a windows 7/8/8.1 winpe can make more then 10's do in less size it will always be useless to work on 10 but people like to be famous and to use latest.
the new hardware make our force to use the new one.
7/8/8.1 pe is in less size you can use them with WIN10PE in one ISO, not expect one PE for every enviroment.

Hi all.

@slore and @bob. OMB, thank you for your answers.
@vvurat, thank you for your candor. I know that we are not looking at WinPE in the same way.

Once again, my goal is to understand and share around WINPE.
There are two parts:
   a PDF file that contains all the information I think useful to build  "sound " WinPE. But it's true that I often forget to change it. The script is sometimes more complete.
   a script that makes it possible to check what I advance. 
So, I hope the reader will be able to add by itself a feature in  "its" WinPE in the absence of package provided by MS.

Now that I'm retired, I like to look for how to add features to WINPE, even if it's no use.
It reminds me a little of the problems I had to face.
 
Everyone can read my scripts and take ownership of the information contained. Even without knowing PowerShell. It is true that the names of the functions are often in French.
My scripts are poorly written. But it is quite easy to isolate, for each functionality, the list of keys, services, drivers, files, ACLs...

And then each one can integrate this information with his favorite method in his project (Winbuilder/baker, CMD, regedit, Reg. exe or other).
It is true that this last job cannot be done by an end-user not knowing how to build or adapt a boot. wim.

If someone wants to integrate in his project one or two functionalities not yet proposed by Win10SE and which is described in my PDF, as far as he writes the plugin, I volunteer to help him.
When I was contacted to study MSTSC + NLA, I did it with pleasure. This was a bit long before the person could make his own WinPE with his method and CMD. But we have won together and each has progressed.

If I use Powershell (and thus dotnet), it is to hide nothing.
Who did not ask the following question: But what is setwow64. exe for? What does it do and how?
Misty noted on another site that this program has become useless again.
I seem to remember that Vvurat told me the same thing several months ago. But i don't connect in my main.
I no longer use  "monsetwow64. PS1 " since version 1709.
It is good to know what this program does and to demonstrate it. Information exists on Chinese sites but is difficult to understand with an online translator.
But how to make these various information accessible around setWow64, for example? Well that's the purpose of my PDF.

Remove Dotnet and PS would be one more project in the WinPE sphere. It takes a long time to list all the necessary files and keys. And it would no longer be possible to talk about sharing information, say how such a feature should be installed.

My goal is not to provide an ISO or a WinPE ready for use but to help whoever wants to add a functionality.

When I was working, I implemented the automation of OS change on over 60.000 machines spread over 14.000 sites. And this from NT4 up to W7.
Very few sites allowed PXE to be used. So I used WINPE in various forms, PXE, FLAT, CD/DVD, VHD, USB disk and in different contexts, physical machines as virtual (among other things for a DOS application that was supposed to work in a 64-bit 2K8 server!)

So I understand that the size of WINPE is important in some cases (PXE for example). I understand that the speed of loading is important too. I understand that physical media are important.
And I don't understand that using a WinPE in FLAT mode is not considered an alternative to a simple boot. wim.
The creation is simple. The evolution of content is faster and easier. There is not the waste of time of loading the OS in the RAMDISK.
And the size of WinPE is no longer a constraint!
It is no longer rare to find USB sticks more than 16GB, or better, USB drives. With a WinPE Flat in a VHD (16GB), I start on a 512 MB VM in HyperV.
Who tried WinPE in flat mode in a physical disk and compared the delays?

Why Winpe10? Simply because it is the OS that is installed on my physical machine. I took advantage of the free migration offered by MS during the launch of WINDOWS10.
And especially because it avoids the difficult to identify compatibility issues when using DISM.

Finally, it is possible not to use MS programs to modify WINPE, to make its USB "bootable ", to modify the BCD, etc.
But the ADK and MS offer all the programs I need to occupy my free time, from WinDbg to ProcMon.

Hi,
I finish to identify all files and keys for a full WMP. I'll update script/pdf when i get time.
I'll explain in the pdf what i see and because WMP doen't work in my previous script.

@slore : i read in a MS's document ( but i can't find it at this time ) that MTP comes with WMP. I think it's only for the package...or commercial reasons.
I connect my phone ASSUS ( mode MTP ) to my new winpe : In system\enum\usb i can see the entry VID_0B05&PID_7772 with description = Android
It appears in devmgmt.msc in "other devices" and "the drivers for this device are not installed"
I think it's a good step.
I compare with my windows10 normal : it gives me wpdmtp.inf
I think many things are missing, class ... long job to compare 
I try to get files and manually install...

Baby is ok ? i'm grand father...

hi,
On the road of MTP via USB ...

In setup.dev.log :

!!!  dvi:   Device not started: Device has problem: 0x25 (CM_PROB_FAILED_DRIVER_ENTRY), problem status: 0xc0000034.

old site : https://blogs.msdn.microsoft.com/iliast/2007/11/28/analyzing-the-installation-of-umdf-and-kmdf-1-5-drivers/

But a few of information.
Same error for the SD card Reader in the machine.
With eventvwr :

I have seen quite a few request this, nice progress, i would definately add this to my build when you get it sorted and if I have time will try to help...

You may need something from here: https://www.microsoft.com/en-us/download/details.aspx?id=19153

hi bob.omb,
Happy to read you.
I download it. It's true it's for XP and Vista. And i thing MTP in Windows 10 uses a new version of protocol. But many many ".doc" and source code. Perhaps i find something on the Entry Api of the driver. Or about architecture for USB.

And of course you can help because I really don't know how to go on. We need new ideas!

My current job:
I install a win10 in a VHD. I modify the hives system and software, BCD. Not much change. It becomes a  "WinPE ". Then boot. And I'm connecting my smartphone. I look in the log...
But now I need a method to investigate in driver_entry. But which driver, which file ".sys"? Is it possible to modify the driver to get traces? ...

Good to see the "MTP USB Device" on the picture. 
you are so fast!

For long time the feature is missing in WIN10PE, so take your time.

I am looking forward to the PDF how to make it work step by step after you finish it.

Baby is ok ? i'm grand father...

hyperactive, heathly...
I lack of some night sleeping time, but it's worth for that.
watching him grow up.

Hi slore.
Good new about baby. In France, it is recommended to speak several languages to babies 
About MTP :
I'll begin this night reading "mtp porting Kit" pointing by bob.omb.
But now, I'm stuck. I lack information on the architecture of MTP software layers. I will try to disassemble the code of one of the two drivers with Ida.
It is the first time I'm facing an installation that is successful and with a device that does not respond. 20 years ago I wrote 2 drivers for NT4 without too understand what I was doing. I found the "DOS IRQ". " The IRP was a new concept. But I recognize that I'm not sure use windbg to trace these MTP drivers.

I understand that the installation made in my context WinPE  "full-flat " is disturbed. Yet no changes in Software or in System does impact MTP. All other drivers such as RDP, Printers, USB, Disk, etc., work without anomalies. If it is the security mechanism of the OS that is involved, then it will be impossible.
See you soon

edit...
I just did a test with my old ZTE F160 which is not Android and does not use MTP.
I connected it by the USB plug. It exposes a CD with an autorun. exe that installs specific drivers to the constructor.
It works the first time.
A photo for fun... but I know, we're far from MTP.

Hi,
Update for WMP with version 17. Only files missing.
Why it is difficult to give key and files list ? because no one can have the same base of construct Winpe.

About MTP and WPD (the base) :
Harder than I thought 
My first comparison "WinPE in Full-Flat mode " Versus "Win10 normal ": The changes I made do not imply WPD or MTP
In the site "reboot ", a person failed to add a UDMF driver to Winpe4
My first idea:
 The "SECURITY" mechanism could be the cause of the anomaly.
I'm still doing a little research.

But for now, I can't identify the useful components or their role.
The site that for now has brought me the most information:
https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/
A presentation in a PPT downloaded from the site of MS:
http://download.microsoft.com/download/f/0/5/f05a42ce-575b-4c60-82d6-208d3754b2d6/FDeveloping-UMDF-Drvs.ppt
(in PDF here: https://paperzz.com/download/1809258)
FAQ: Https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/user-mode-driver-framework-frequently-asked-questions
Source and WinDbg:
https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/
I must say that source is too bigger for me. And i suppose it's not helpfull for the issue
So, i'll work like a Turtle ...