MicroWinpeBuilder to adapt its own Winpe : tutorial or 'under the hood'?

Hi HeyJoe

Small tip/hand: Here are some ready lines for binmay (taken from other plugins slightly modified, not tested but I believe all will work fine .... )

Code: [Select]

If,Not,ExistFile,%ProjectTemp%\binmay_M\HostOS\binmay.exe,Run,%ScriptFile%,binmay_Ready
//-
If,Not,ExistFile,%Target_Sys%\DeviceSetupManager_Original.dll,FileCopy,%Target_Sys%\DeviceSetupManager.dll,%Target_Sys%\DeviceSetupManager_Original.dll
If,ExistFile,%Target_Sys%\DeviceSetupManager_org.dll,Call,FileDelete,%Target_Sys%\DeviceSetupManager_org.dll
FileRename,%Target_Sys%\DeviceSetupManager.dll,%Target_Sys%\DeviceSetupManager_org.dll
ShellExecute,Hide,%ProjectTemp%\binmay_M\HostOS\binmay.exe,"-i #$q%Target_Sys%\DeviceSetupManager_org.dll#$q -o #$q%Target_Sys%\DeviceSetupManager.dll#$q -s #$q5C004D0069006E0069004E0054000000#$q -r #$q5C004E0069006E0069004E0054000000#$q"
Call,FileDelete,%Target_Sys%\DeviceSetupManager_org.dll
FileCopy,%Target_Sys%\DeviceSetupManager.dll,%Target_Sys%\DeviceSetupManager_Patched.dll
//-
Retrieve,Md5,%Target_Sys%\DeviceSetupManager_Original.dll,%Md5_Before_DeviceSetupManager_dll%
Retrieve,Md5,%Target_Sys%\DeviceSetupManager_Patched.dll,%Md5_After_DeviceSetupManager_dll%
If,NOT,%Md5_Before_DeviceSetupManager_dll%,Equal,%Md5_After_DeviceSetupManager_dll%,Call,Echo,"Error: MD5 Mismatch - DeviceSetupManager.dll Patch do NOT work",Warn,,MessageError,10

[binmay_Ready]
If,ExistFile,%ProjectDir%\Utils\Utils_Tools_001.Script,Run,%ProjectDir%\Utils\Utils_Tools_001.Script,Extract_binmay,%ProjectDir%\Utils\Utils_Tools_001.Script
Else,Begin
If,Not,ExistFile,%BaseDir%\Projects\Yomi\UtilsY\Utils_Tools_001.Script,Call,Download,%BaseDir%\Projects\Yomi\UtilsY\Utils_Tools_001.Script,http://yomi.cwcodes.net/Yomi/UtilsY/Utils_Tools_001.Script
If,ExistFile,%BaseDir%\Projects\Yomi\UtilsY\Utils_Tools_001.Script,Run,%BaseDir%\Projects\Yomi\UtilsY\Utils_Tools_001.Script,Extract_binmay,%BaseDir%\Projects\Yomi\UtilsY\Utils_Tools_001.Script
End
If,Not,ExistFile,%ProjectTemp%\binmay_M\HostOS\binmay.exe,Call,Echo,"Halt: Can not get binmay.exe Ready.",Warn,,MessageError,,Halt

when the unique byte found, change binmay.exe patch line
ShellExecute,Hide,%ProjectTemp%\binmay_M\HostOS\binmay.exe ......
(current line is from RDC plugin  )

Hi,
Too complex for me because my poor english...

Two or three years ago, maybe more, I had been looking at how to install printers and scanners.
Recently, I retested with my scan because I was asked about it.
In my PDF document, I said that part of the installation required a "manual" intervention.
I meant that action was needed after the pilots were installed to scan.
This prompted me to look for why there was this "manual" step.
And today I finally found the key to this mystery.
In my PS script, it missed a value to activate the installation of the elements of the "stillimage" class. ( sti_ci.dll was not activate ).
On the attached image, I use the wiaacmgr.exe windows software and I did a "preview" with the scan.
But I don't have the assurance that it will work for other scanners. I only have one.
If I had a more modern scan, I'd like to look at how to use WSD scan that I don't know at all.
https://docs.microsoft.com/en-us/windows-hardware/drivers/image/installing-a-wia-scanner-driver-with-wsd

By the way, I made a point about the modification of FbWF.sys (ramdisk).
There have been changes at MS regarding the parameters of the signature tool. But it amused me (like a child!).
There is no point in using the standard winpe driver. I know!
But it makes me happy to know that I can still do this kind of pirouette.
Don't forget to modify the  BCDfile with "TESTSIGNING ON" 

To go back to the scan, it is difficult for me to propose a script/pluggin for winbuilder because I am unable.
And I don't want to invest time in that learning.

I'm going to resume my testing with HyperV and SandBox. It's a lot more fun for me.
For now, I managed to add these 2 FOD (features on demand) with "DISM /add-package".
I was also able to add these 2 FODs to the Winpe FullFlat environment. But no HyperV yet.
And that's where I am.

I also add a new version of my scripts in the first page ( a backup for me )

@ Slore,

Your reply #259

Oh,  the code is for x64.  For x86 needs a byte to make it be unique. I think it is the second one.

Thanks for the right tip (C0 D4 01 00 FF 35). It leads print spooler more quickly to be "ready for operation" (tested via notepad).

But sorry, it does not lead to more quickly visible elements in panal "Devices and Printers" which stay "install in progress" at about 10 minutes. I guess there must be something else.

I tested v.1809 x86 with Vbox.


Edited :

pic "InProgress.png" --> some secs after explorer start
pic "PrgressFinished.png" --> ~ 6-10 mins later (depending on power of machine).

Regards.

@ Lancelot,

Your reply #260

Many thanks for tip.

Small tip/hand: Here are some ready lines for binmay (taken from other plugins slightly modified, not tested but I believe all will work fine .... )

It works.

Have a nice day.

Hi HeyJoe
Don't forget my poor english... i can misunderstand what are your need.

it does not lead to more quickly visible elements in panal "Devices and Printers" which stay "install in progress" at about 10 minutes

In Posts: 237, i explain how i find how to suppress this delay (but i can't find the origine).
I modify DeviceSetupManager.dll (DSMSVC).
Because x86 is not my friend ( parameters in the stack is not at the same place, usage of BP is different...), i can't play with it. Perhaps Slore modifys it in his tool Wimbuilder2 for x86.
Hope this help you

Some thing else without link. I try to play with FBWF.SYS and i modify this driver. Now i can get a size 2GB for the RAMDISK in the case of boot on ISO(DVD, VM). I make this ISO boot try ONLY because i try to help a person which can't use VHD. For me (only for me), it's not a good environment and i "never" test it.  Because winpe detects thatt the binary code is modified, i need to use "testsigning" in BCD for MBR and also i must stop "Secure Boot" in EFI computer. contrary to what I've read on a site, the " NoIntegrityChecks " parameter of BCD has no impact on the boot EFI when fbwf.sys is binary modified. I think the concept of "integrity of control" is different from the concept of "driver signature". If anyone can explain to me....in french...

About scaner... i forget to document the missing key (in my context):

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{6bdd1fc6-810f-11d0-bec7-08002be2092f}]
"Installer32"="sti_ci.dll,ClassInstall"

I hope Slore can add in his WimBuilder2 tool.

Hi noelBlanc,

Some thing else without link. I try to play with FBWF.SYS and i modify this driver. Now i can get a size 2GB for the RAMDISK

Some minor info :
1)
 If you do real test with increased FBWF you may see it can not use all free space as it writes.
Real Test eg : Try to copy 2GB of files (eg. pictures) to X:\Test\ 
2)
People prefer big FBWF size to install and test some software * that requires big free space at X: (at X:\Program Files\ )
software * : I can not remember an example now.

Have fun 

Some thing else without link. I try to play with FBWF.SYS and i modify this driver. Now i can get a size 2GB for the RAMDISK in the case of boot on ISO(DVD, VM).

For the origin Windows 10's fbwf.sys driver,

Code: [Select]

reg add HKLM\Tmp_System\ControlSet001\Services\FBWF /v WinPECacheThreshold /t REG_DWORD /d 4095 /f

You will get 4GB ramdisk of X drive without modifying the fbwf.sys.

If you use WES 8.1's fbwf.sys, you can use fwbf.cfg to use 8G/16GB/../128GB ramdisk.


WES8.1 is better than Windows 10's fbwf.sys.
* It supports symbol link, mklink command can link file/folder to X:\.
* No needs twice memory for copy big file to X:\.

But it is not good with Administrator's profile folder for 20H1 and later.


For the fbwf.cfg, you can see:
"Z:\WimBuilder2\Projects\WIN10XPE\00-Configures\System\"

In future, I will use your file list/registry items to make next patch.

Devices and Printers\
   _printer.bat
   _bluetooth.bat
   _scanner.bat

I don't have any scanner, so I can't test if it works.

  I can't get the pdb files from MS symbol server, so it will take long time for me to remove the 10 minutes delay for x86 system.

I'm quite busy this month, The improve/update of 0303_Dev will be release with [Update] button, The full package WimBuilder2 will be released in 2021.04.04.

@Lancelot and @Slore : thank you for all this details that I did not know about Fbwf.

My goal with FBWF: Use a driver's signature process once again, not using the fbwf ;-))
I only use winpe into a VHD, not ISO/DVD/RAMDISK : it's not a good environment for my "research".

In my big VHD, i can add all i want ( files and even programs). All files keep in place. Idem for programs but it's too complex for many people ( i explain in this site how to save and modify the 2 hives). So, really, i don't understand why people still use ISO/DVD. But i't true, i'm not a worker, i'm retired sine a long time.
If comes the day when I can't use IDA and Windbg, then I'll stay in bed and wait until the last day. Winpe is only the way for me to use my mind with IDA and Windbg.
Somewhere,in this site, i read the word "competition". Because i can't understand all the idea and intention behind the text, i'm surprise : I try to share, only to share. But i can't explain ... because my poor english !

@ Slore : i sent you a list about eventlog. I know you are busy,...only to know if you received it.

I'm happy, i run 45 minutes today. A real competition...against my old boddy !
Have a good day.

Hi Noel,

Don't forget my poor english... i can misunderstand what are your need.

Don't worry. Your posts are clearly and well understandable.
Even if only after reading it 2 or more times
I also often use the translater by big G. in the hope of clear translation of what I want to say.

... at about 10 minutes
...
In Posts: 237, i explain how i find how to suppress this delay (but i can't find the origine).
I modify DeviceSetupManager.dll (DSMSVC).

Observations:
While checking x64 hex dump I found pattern "20 03 00 00" modified to "01 00 00 00".
This change apparently ensures that the elements in the "Devices and Printers" panel of your running ISO are immediately visible as they should look.

Assuming this is on purpose and has to do with timings of service DSMSVC, I inspected the x86 version.
I found the same pattern twice and choosed second one to modify. (First resulted in no booting of iso file).

Results while testing in Vbox:
The elements in the "Devices and Printers" panel were actually immediately visible as they should look.

But now there are many problems:
First of all, the Vbox drivers no longer work properly at all. Ex.: mouse catcher, graphics, VirtualBox Windows Guest driver etc.
WMIC calls result in errors.
...
...

Halving the timing "20 03 00 00" to "90 01 00 00" also resulted in the same game and now the panel elements needed more time for themselves again.
Further timing changes did not help either.

I think My changes in timing are risky.
So no luck at the moment.

Regards.

Hi noelBlanc,

*
Do not worry about a post related to "competition". We are around for a long while to know each other well. 
 It is only a comment from a new user about what things look like for someone who is not around.
  Well everything can look like a competition. 
    eg. You believe documenting findings is better. -> you have a competition with other ideas. 

With open source, we all share findings. 

*

i don't understand why people still use ISO/DVD

I guess most do not use ISO/DVD. At least at the Part of the world where there is a lot internet access.
(I do not use a real ISO/DVD since >5 years. Maybe >10 years ....

But ".iso files" are very useful and popular since It is a very old file format like .zip files so all OS can use it. 
+
First of all creating ".iso file" is quite easy, just a single line with .cmd.
Creating ".vhd file" ... not fun with .cmd. 
+
for PE : boot from ".iso file" has advantage that nothing change in .iso on next boot.
Generally boot ".iso file" that is at a usb stick.  Not a real ISO/DVD.
(
with vhd it is not possible ...
Shortly:
 ".iso file" is solid, ".vhd file" is not solid.
   ".iso file" is stable ".vhd file" is flexible.
     ".iso file" you are sure you always get same result. ".vhd file" you can not be sure if something change have effect.
)

when you send a bootable PE .iso to a friend, you are sure your friend did not accidentally change content of .iso .
ps:
I still use Gena.iso (PE1) I made at 2016 and Win7PESE.iso I made at 2012 knowing they are static and enough for me.

+
Virtual World (VirtualBox/VMWare) :
1) ".iso file" make it easy to install any OS
2) ".iso file" make it easy to transfer files to Virtual_OS without "Guest Addition". (eg. DOS, Windows at early install stage without Guest Addition)
+
One can use ".iso file" as a container for personal files to tidy up disk since it is quite fast and easy to mount a .iso file on any Desktop OS.
eg.
My_Pictures_2000_2019.iso
My_Documents_PE.iso

But we can not mount iso at Android Phones and Iphone (IOS) for regular users.
 At this point for Desktop OS users (eg. Windows) this is a good idea, for Android and Iphone (IOS) users still .zip works better in practice.

+
If you make a research and print that research (doc, xls) . It is a good idea to put a cd inside that research book.
(At this point I like mini CD  )


*

I'm happy, i run 45 minutes today. A real competition...against my old boddy !

Bike and Run. Very very Nice. 
Since 5 years, I like to go swimming at swimming pool.. 

Have fun

@ Lancelot

The following does not belong directly to the current technical topic.
But anyway.

I believe one day Bob.Omb will come back.

I hope that too.

Step 2) add Linux to PE with a plugin. (I feel some quick DirCopy and RegCopy will be enough for headstart)
...
Just look at the codes of plugin that was designed for Step1) (probably got old now) and rest have fun If you are interested.

Sorry, I'm not verry mucho interested for now. However, never say no.
But because they are Bob.Omb's babies, I think He'll do it himself.
We can already look forward to it.

Hi noelBlanc,

*
Do not worry about a post related to "competition". We are around for a long while to know each other well.
 It is only a comment from a new user about what things look like for someone who is not around.
...
With open source, we all share findings.

That speaks to Me from My heart.

I still use Gena.iso (PE1) I made at 2016 and Win7PESE.iso I made at 2012 knowing they are static and enough for me.

And that's how I've sometimes been doing it since The Good Old BartPE Days.

@ all - Have a nice day.

But now there are many problems:
First of all, the Vbox drivers no longer work properly at all. Ex.: mouse catcher, graphics, VirtualBox Windows Guest driver etc.
WMIC calls result in errors.
...
...

Halving the timing "20 03 00 00" to "90 01 00 00" also resulted in the same game and now the panel elements needed more time for themselves again.
Further timing changes did not help either.

I think My changes in timing are risky.
So no luck at the moment.

Regards.

Yes, "Z:\WimBuilder2\Projects\WIN10XPE\01-Components\Devices and Printers\last.bat" made them show immediately for x64.

Code: [Select]

if "%WB_PE_ARCH%"=="x64" (
    binmay.exe -u "%X_SYS%\DeviceSetupManager.dll" -s "81 FE 20 03 00 00" -r "81 FE 01 00 00 00"
)
fc /b "%X_SYS%\DeviceSetupManager.dll.org" "%X_SYS%\DeviceSetupManager.dll"
del /f /q "%X_SYS%\DeviceSetupManager.dll.org"

For VirtualBox Windows Guest driver, WimBuilder2 has a patch for that already.

[Customize]
    Test\
       VBoxGuestAdditions\

Code: [Select]

          Oracle VM VirtualBox Guest Additions For:

                @ Auto
                O  6.1.x
                O  6.0.x

          * Drag and drop files or folders between host and guest
          * The clipboard of the guest can optionally be shared with the host

   

@Lancelot : thank you for your good words and for your explanation.
I hope the water in your pool is not as cold as in France.

I agree with you in every way. However, I would like to clarify. When I worked in a large company, shortly before I retired, I used Winpe to install PCs. Often via PXE. Sometimes with ISOs deposited in USB media. But still to install Windows "Silently" with the W7 (or older) settings set by the company. But sometimes I used winpe for a troubleshooting. I very quickly use the flat mode on a USB holder. I must say that I am not conservative and I have never kept a winpe of an older version. Nor x86 when i get i PC 64bit.
My question: is there an action, a troubleshooting, that would not be possible since a winpe 64 latest version targeting an old OS x86 (XP for example)?
I am too old to face such a context.

About X86 and DeviceSetupManager.dll : i didn't download an x86 windows. Too Long with my slow connection Wan.
It's possible that the logic is the same in x86 and x64.
If i well remember the logic for x64, DeviceSetupManager.dll ask something to cfgmgr32.dll which sent the request to a driver ( i forget which one). DeviceSetupManager.dll waits for a return. If no return from the driver, DeviceSetupManager.dll returns "error" to the caller.
I can understand the link with this this wait and Vbox. It seems to me that the bytes to search is not 0x320 in x86. It's why i need the x86 file.
 I'll try to download an x86 and use IDA.

Hi Noel,

About X86 and DeviceSetupManager.dll : ...
...

I guess You are talking to Me, right?
If yes I can do... Own a good wan.

See You.

Hi HeyJoe, thanks for your help (in my last post, I deleted my request of what you offer me because I thought no one would do this for me)

This nigth, i download a x86 file. And this morning i use IDA.
deviceSetupManager.dll : version 10..0.1.19041.546 En-us size:230400  ‎Thursday ‎19 ‎november ‎2020, ‏‎03:32:05
The code is very similary for the "part around" the "0x320" area (see picture).
I notice the same function name, the same loop, the same constants...

$old     = ( 0x45 ,0xf8 ,0x3d  ,0x20  ,0x03  ,0x00  ,0x00  ,0xf2  ,0x82)
offset for this serie :3402 ( base 10, not hexa)

@HeyJoe : please, if you get free time, verify that you use this offset/signature when you last test.
If you use the "same" signature, i can't understand the link with VBOX.

I use HyperV extensively and I never notice such a problem with the hardware (yes, no usb in hyperv)

@ Noel + Slore,

Please see edited reply #270

Reason (please do not laugh): I accidently modified one of My iso's which was not intended for that.
Sorry for the inconvenience and the loss of time you have had by posting hints.

"... about 10 minutes ..." --> its working now as it should (as always expected: whatever comes from You works).

This is what My favorite hexeditor told Me:
Inspecting file: DeviceSetupManager.dll v.10.0.17763.1   --> it is x86 in v.1809
Byte order: little endian

Code: [Select]

...
000176C4   45 F8               inc ebp
000176C6   3D 20 03 00 00      cmp eax,$00000320
000176CB   0F 82 CF 44 FF FF   jc dword $FFFF44D5
...

Any decreased timing results in faster visibility of mentioned elements the way they should look.

Have a good time.
See You.


Edit: First tested in Vbox. USB-stick on real target machine will follow. (I hope soon )

@HeyJoe : no problem. if all things are correct for you and work the way you want, that's enough for me and I'm happy.
You said something about Bob Omb and linux. Because my poor english, i don't follow thread that speak about pluggin and the langage of winbuilder.
But i communicate in the past with Bob Omb. Please give me some news about him and some simple informations about linux in winpe.
Merci.

Hi Noel,

@HeyJoe : no problem. if all things are correct for you and work the way you want, that's enough for me and I'm happy.

Thanks mucho.

You said something about Bob Omb and linux...
...
... communicate in the past with Bob Omb. Please give me some news about him and some simple informations about linux in winpe.
Merci.

I will collect more info for You. Will post soon. Please remind Me if time exceeded in case I forget about.

Passe une bonne journée. - par big G. traduit: Have a nice day. / Have a good time - in deutsch: Schönen Tag noch.

See You.