El Torito Problem

[JonB]

I have been working on setting up my PC to boot from a CD for a
couple weeks. I have followed the MS procedure very closely. I have
searched the many messages here and solved several problems that way.
Now I have a problem that I just can not figure out. Any help is
appreciated!

1) Partition HDD with 3 parts -- c650MB) d1024MB) e2048MB).
Installed WinXP Pro on E:. Booted into XP Pro and copy my image to C:.
2) FBA runs fine with an El Torito CD in the CD drive. Reboots twice
just like it should.
2) Post-FBA I check EWF.
c:\ewfmgr
Shows C: as the protected volume.
c:\ewfmgr c:
Shows Type is RAM and State is DISABLED.
3) FBALOG.TXT
Shows that El Toriot is loaded, and Disk(1) is El Torito.
4) I do c:\ewfmgr c: -enable
Works fine.
5) I run c:\etprep -all
Reboots fine into WinPE.
6) FBALOG.TXT
Shows that EWF volume was deleted. Shows that C: was switched
with G:. This is correct.
7) Run HD2ISO and create an image. I use Sonic to burn the image.
8) Now I Boot from the CD.
It looks like it is working fine. Boots all the way to the blue
background Windows XP Embedded screen. Then I get the error -

lsass.exe - System Error
An I/O operation initiated by the Registry failed unrecoverably. The
Registry could not read in, or write out, or flush, one of the files
that contain the image of the Registry.

Now in order to make sure EWF was enabled, I checked the post-FBA
registry using WinPE regedit. Everything was correct. I then switched
the drive letters back manually and rebooted into my post-FBA image on
the HDD. When I ran c:\ewfmgr it said a volume could not be found.
When I ran c:\ewfmgr c: it said type: RAM (REG) and State: ENABLED. I
assume this means that EWF is working and is enabled as it should be.
I have also gone out of my way to make sure all needed drivers are
loaded. Everything looks great in the post-FBA image. I just can't
get it to boot all the way in from the CD.
If any additional information is required, please let me know.
Any help is appreciated.

Thanks!
Jon

 

[Dietmar]

Hi Jon,
I got the same message when the 120 day timebomb
explodet. Why dont You use the methode described by Slobodan, its a very
hard job to do, but at last it works also on a 4,7GB DVD!

Dietmar

XPe image preparation in TD:


1. Component "El-Torito CD". (Leave default number 1330924613 which
represent ASCII string 'ELTO' or translated in hex 4F544C45)
2. EWF with RAM overlay configured trough registry only.
For this purpose you can use either my component "EWF RAM Registry - Based
on ....." in which case you will have to disable
autoresolve dependencies because "El-Torito CD" component want to import
component "Enhanced Write Filter" which beat the purpose of
my component.
Or better way for this case would be to use documentation that I have
provided in zip file and do the changes by your self on
"Enhanced Write Filter" from TD. This way you can have autoresolve
enabled.
http://www.xpefiles.com/a_file­.cfm?custid=Components&fileid=­ramewf.zi...

3. Some program for manipulating registry like reg.exe or regedit.exe.
Components that contain them:
"Registry Editor"
"Misc. Command Line Tools"
4. Component "FAT"
5. Component "CDFS"
6. One of "CD-Rom Drive" components.
7. XPe FBA must be done on C:.
- You have choice to use first partition on boot HDD.
- Or you can follow:
http://msdn.microsoft.com/embe­dded/community/community/tips/­xp/rtpart...



Regardless of OS partition that you use in step 7 EWF must be configured
to protect ARC path: multi(0)disk(0)rdisk(0)partiti­on(1)
since this will be protected partition when booted from CD.


Pre FBA disk preparations:


1. HDD with one partition formatted as FAT. (Preferably <700MB)
2. El-torito disk (created as described in this document from partition
created in previous step) present during the FBA.
3. XPe image configured as mentioned above and copied to this partition.


Post FBA steps:
1. Use regedit or reg.exe to delete HKLM\SYSTEM\MountedDevices with all
entries from registry.
2. Enable EWF either trough registry key
HKLM\SYSTEM\CurrentControlSet\­Services\EWF\Parameters\Protec­ted\Volume0\Enabled
1
Or by using EWFMGR C: -enable
3. Shutdown computer gracefully by using.
c:\windows\fba\fba -shutdown
4. Record this partition on CD along with additional files.


Troubleshooting:
If you get BSOD 7B when booting from CD it might be related to problem
with ntdetect.com in this case you will have to obtain fixed
version by contacting MS.


NERO usage for El-torito CD creation.
1. Select Make Bootable Disk option.
2. Select Bootable logical drive option, and select volume with XPe that
you want to record on El-torito part of CD.
3. Go to next step. (Press New.)
4. Add files that you want to have on your CD.
5. Select recorder->Choose Recorder
6. Select Device "Image Recorder" and press OK.
7. Choose Burn option and then name file that will receive CD image.
8. Use HEX editor and find MBR sector placed by Nero. Go to 1B8 location
(relative offset from MBR) and type 'ELTO' DiskID on that
position of hex representation depending on hex editor. You can make a
simple app that will change this number if you need to
frequently burn new images.
9. From NERO. Choose option Burn image to Disk.
10. Choose image file.
11. Change back to real recording device driver so you can burn image on
CD instead to image again.
12. Burn image.


Reason for this long procedure is because Nero creates MBR block that use
DiskID 0 and El-torito or other win drivers can't use
DiskId 0.


Test CD that can be used for initial testing purposes and during XPe FBA.

You will need HDD partition that you have created for future XPe FBA. On
this partition place files "ntldr." and following boot.ini


[boot loader]
timeout=50
default=multi(0)disk(0)rdisk(0­)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partiti­on(1)\WINDOWS="Microsoft Windows XPe Test
1" /fastdetect
multi(0)disk(0)rdisk(0)partiti­on(1)\WINDOWS="Microsoft Windows XPe Test
2" /fastdetect


This will allow you to test if BIOS can boot your El-torito image. If you
can't reach multi OS choice then you have done something
wrong.
PS: Don't forget to make this CD also by using above mentioned procedure
in Nero.


If you have questions or comments please attach them directly to root of
this thread for easier problem tracking.


Good luck,
Slobodan

 

[Slobodan Brcin \(eMVP\)]

Jon,

Few simple trick that might help you.
1. Configure EWF to work in registry configured mode on HDD and that it is enabled.
2. Delete all entries from HKLM\System\MountedDevices
3. commit efw and reboot.

Note that there is no need for etprep.

Now your windows should be able to bood from HDD and entries in MountedDevices will be automaticalyh created. But since EWF is
working you can safely turnoff computer after making sure that all is ok and Registry RAM EWF enabled.
Now just copy image to CD and it should also work.

Regards,
Slobodan

 

[JonB]

Slobodan,
Those are some very cool tricks. I was able to boot to my post-FBA
image on the HDD. Registry RAM EWF was configured properly and
enabled. I deleted the MountedDevices registry entries, commited, and
rebooted. It booted again to the HDD just fine, RAM EWF still good,
and the MountedDevices were detected properly. At this point I booted
back to XP Pro, ran HD2ISO and made my CD. Same error, except now I
also get a "Delayed Write Error."

Dietmar,
I have not had time to try Slobodans procedure from scratch as of yet,
but I will soon. I wonder if this problem is something strange with
the 120day timebomb? I am still using the trial version. Does the
timeout start from the time my Trial Key is issued, or fromt the time
that I run FBA on my image? Perhaps it would be as simple as getting
the Full Version and rebuilding the image?

Many thanks for the reply!
Jon

 

[Slobodan Brcin \(eMVP\)]

Hi Jon,

Any luck so far?

What I can say you problem is not related to timebombs and eval version of XPe.
Anyhow make sure that with ewfmgr c: you see that registry configured EWF is actualy used.

Same error, except now I also get a "Delayed Write Error."

This mean that for some reason EWF is not protecting partition on CD.
What is the ARC path used for congiuring EWF on both HDD and CD?


Regards,
Slobodan

 

[JonB]

Hi Jon,

Any luck so far?

None. I have tried configuring EWF RAM REG through TD, and
deleteing MountedDevices. I continue to get Isass.exe Error and/or the
Delayed Write Error.

Anyhow make sure that with ewfmgr c: you see that registry configured EWF is actualy used.

I have verified that EWF RAM REG is enabled and working properly.
Below is the EWFMGR C: output and the EWF Registry configuration.

Protected Volume Configuration
Type RAM (REG)
State ENABLED
Boot Command NO_CMD
Param1 0
Param2 0
Volume ID CB 47 CB 47 00 7E 00 00 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume1" [C:]
Max Levels 1
Clump Size 512
Current Level 1

Memory used for data 127488 bytes
Memory used for mapping 4096 bytes

[HKEY_LOCAL_MACHINE\adf\ControlSet001\Services\EWF\Parameters\Protected\Volume0]
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
"CompareBeforeAlloc"=dword:00000000
"Type"=dword:00000001
"Enabled"=dword:00000001

This mean that for some reason EWF is not protecting partition on CD.
What is the ARC path used for congiuring EWF on both HDD and CD?

The HDD is formatted into 3 partitons:
c: 650MB FAT
d: 1GB FAT
c: 2GB FAT (Win XP Pro for running HD2ISO and buring CD)

The HDD ARC path is multi(0)disk(0)rdisk(0)partition(1) which is what
EWF is configured for.

FBA is ran on C: partitioned to 650MB, and an El Torito CD also
partitioned to 650 is in the drive. Below is the FBALOG entries about
El Torito, and also the ETPREP output.

4:48:44 AM - [FBAAddDevInstanceId]
ELTORITO\ELTORITODISKDEVICE\1&2AA0FFE4&0&0000

4:50:53 AM - Found 2 Hard Disks.
4:50:53 AM - Searching for El Torito disk.
4:50:53 AM - Disk0 signature = 0x47CB47CB.
4:50:54 AM - Disk1 signature = 0x4F544C45.
4:50:54 AM - Disk1 is an ElTorito disk.

4:58:35 AM - QueryEnumerateKey: DiskSignature = 0x4F544C45,
BootDriveLetter = \DosDevices\C:.
4:58:35 AM - RegQueryInfoKey: MaxValueLen = 48, MaxDataLen = 238,
nValues = 12.
4:58:35 AM -
RegEnumValue(\??\Volume{8e710f41-00ac-11da-932a-806d6172696f}),index =
0.
4:58:35 AM -
RegEnumValue(\??\Volume{8e710f42-00ac-11da-932a-806d6172696f}),index =
1.
4:58:35 AM -
RegEnumValue(\??\Volume{8e710f43-00ac-11da-932a-806d6172696f}),index =
2.
4:58:35 AM - RegEnumValue(\DosDevices\C,index = 3.
4:58:35 AM - Found boot drive letter.
4:58:35 AM - RegEnumValue(\DosDevices\D,index = 4.
4:58:35 AM - RegEnumValue(\DosDevices\E,index = 5.
4:58:35 AM -
RegEnumValue(\??\Volume{8e710f45-00ac-11da-932a-dc42a701e608}),index =
6.
4:58:35 AM -
RegEnumValue(\??\Volume{8e710f46-00ac-11da-932a-dc42a701e608}),index =
7.
4:58:35 AM -
RegEnumValue(\??\Volume{8e710f47-00ac-11da-932a-dc42a701e608}),index =
8.
4:58:35 AM - RegEnumValue(\DosDevices\G,index = 9.
4:58:35 AM - Found disk signature.
4:58:35 AM - RegEnumValue(\DosDevices\A,index = 10.
4:58:35 AM - RegEnumValue(\DosDevices\F,index = 11.
4:58:35 AM - Swapped \DosDevices\C: ID with \DosDevices\G: ID.

As far as I can tell by running the post-FBA image on the HDD and
looking at the logs -- EWF RAM REG is configured and working correctly,
the ARC path is correct, El Torito was detected and loaded, and the C:
and El Torito volumes were swapped correctly. I have also tried
deleteing MountedDevices from the registry completely, with the same
effect.

I saw a document that said the Physical location of the HD and CD
makes a difference. Does it matter if the CD is on IDE1 or IDE2, or
Master/Slave? I've experimented with this as well with no luck.
Currently the HDD is IDE1 Master and the CD is IDE2 Master. When I try
to boot from the CD I pull out the HD(its in a removable caddy) and
disable that IDE slot in the bios. Ive also tried leaving it in as
well.

Does anything look wrong, or is there somethings else I should be
looking for?

Thanks again for your help,
Jon

 

[JonB]

I now have a working XPe El Torito image running with no HDD installed.
I came accross a El Torito procedure from a MEDC(Mobile&Embedded
DevCon) lab and followed it exactly. It worked great. I'm not certain
what I did so differently, but a few things are -- I ran TAP.exe from
WinPE instead of XP Pro and I used System Cloning. Also, the initial
El Torito would freeze up while booting if I removed the HDD. To fix
this I had to edit MountedDevices and remove and entries for the HDD
prior to running HD2ISO. The advice here was a great help to solve
several issues along the way to a working El Torito CD. Thanks
everyone for your replies!

Jon

 

[JonB]

I now have a XPe image running fine from El Torito with no HDD
installed. It is working great. I came accross an El Torito procedure
from MEDC(Mobile&Embedded DevCon) and followed that procedure exactly.
It worked. I am not certain what I did differently, but it worked
nonetheless. I had to modify MountedDevices to remove the HDD post
etprep, or the El Torito would freeze while booting. The advice here
was great, and it helped me solve many issues along the way to a
functional El Torito image. Thanks everyone for your replies! They
were a huge help.