EWF and Remote Boot

Y

Yasutaka Nakamura

Hi all,

I am developping XPe with SP1 device. My device uses two
different size falsh disk as boot disk (256MB or 512MB)
which are configured RAM based EWF(other H/W spec and XPe
image are complete same).
At our device, I do bellow operarion and experienced
different phenomenon between 256MB and 512MB disk
constantly.

1. Execute ewfmgr.exe with parameter "-commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service. After Booting,
Boot image only detect Flash Disk and do nothing to that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application can not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is disabled and my
application can get EWF type(RAM) and Flash Disk image
was commited certainly.

If I don't remote boot operation at 512MB device, above
phenomenon do not occur and EWF is correct(Disable, RAM
and commited).

If remote boot image detect disk which is stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,
 
Y

Yasutaka Nakamura

Hi Slobodan,

My information is not enough and I will give you more
information about this.I build two XPe image for my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on) to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry settings
to detect Flash Disk. This image boot and detect Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "-commitanddisable" on Flash
Disk XPe Image and restart, but the device does not boot
from Flash Disk, boot from network with XPe image for
Remote Boot.
2) After network booting is comlete, restart device again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not correct
(EWF is Enable) in spite of EWF "-commoianddisable".
When I restart device once more gain from Flash Disk, EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka
-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do remote
boot them you are following wrong doc pages.
 
S

Slobodan Brcin \(eMVP\)

Hi Yasutaka,
Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea based on this info, but you can do few tests.

In one case I have seen problems with RAM EWF commit and commitanddisable. (They did not write any data during graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component, right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually has been done, by booting to XPe from flash again before remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan
 
Y

Yasutaka Nakamura

Hi Slobodan,

Please refer to the following reply.
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.
2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.
3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.
4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1
5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".
6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.
7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot. So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote boot, EWF
commitanddisable works actualy.

-----Original Message-----
Hi Yasutaka,


Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.
In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
 
K

KM

Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown the device, plug-in the
flash card in to another machine and read sectors out of the EWF config
partition. Save the sectors in a file (32K size file, let say EWFContent.1).
Then plug the card back in to the target device, remote boot it, shutdown
again and capture the EWF config partition content again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!) component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF on the Flash while
network booting, what do you see? (supposedly, you should see "Disabled").

And one more point to check... What is your images based on -
Minlogon/Winlogon? How do you do the device restart/shutdown? What the
command you use? Try using "fba -reboot", or, if xpepm included,
"xpepm -reboot".

KM
Hi Slobodan,

Please refer to the following reply.
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.
2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.
3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.
4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1
5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".
6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.
7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot. So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote boot, EWF
commitanddisable works actualy.

-----Original Message-----
Hi Yasutaka,


Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.
In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"


.
 
S

Slobodan Brcin \(eMVP\)

Yasutaka,

1. Since you are using RAM EWF and commitanddisable you can configure it trough registry only. (This will eliminate possibility for
problem that Konstantin would like that you test).

2. On your current state try:
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.
- Reboot in remote image.
- Reboot back in XPe and check EWF state. (If EWF partition is trashed this is something for MS).

3. You should use commands Konstantin mentioned for reboot, but they are not relevant. EWF is here to protect you against power
loses so this would not explain this problem.

Regards,
Slobodan


KM said:
Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown the device, plug-in the
flash card in to another machine and read sectors out of the EWF config
partition. Save the sectors in a file (32K size file, let say EWFContent.1).
Then plug the card back in to the target device, remote boot it, shutdown
again and capture the EWF config partition content again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!) component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF on the Flash while
network booting, what do you see? (supposedly, you should see "Disabled").

And one more point to check... What is your images based on -
Minlogon/Winlogon? How do you do the device restart/shutdown? What the
command you use? Try using "fba -reboot", or, if xpepm included,
"xpepm -reboot".

KM
Hi Slobodan,

Please refer to the following reply.
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.
2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.
3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.
4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1
5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".
6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.
7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot. So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote boot, EWF
commitanddisable works actualy.

-----Original Message-----
Hi Yasutaka,

Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.
In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"
Hi Slobodan,

My information is not enough and I will give you more
information about this.I build two XPe image for my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on) to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry settings
to detect Flash Disk. This image boot and detect Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "-commitanddisable" on Flash
Disk XPe Image and restart, but the device does not boot
from Flash Disk, boot from network with XPe image for
Remote Boot.
2) After network booting is comlete, restart device again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not correct
(EWF is Enable) in spite of EWF "-commoianddisable".
When I restart device once more gain from Flash Disk, EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka

-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do remote
boot them you are following wrong doc pages.
You don't need EWF, but you will need ramdisk driver
component.
And few other things to set in registry.

What is relation of Flash Disk to remote boot?

Use following search:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-
8&q=ramdisk+slobodan&btnG=Search&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*

Regards,
Slobodan


"Yasutaka Nakamura"
Hi all,

I am developping XPe with SP1 device. My device uses
two
different size falsh disk as boot disk (256MB or 512MB)
which are configured RAM based EWF(other H/W spec and
XPe
image are complete same).
At our device, I do bellow operarion and experienced
different phenomenon between 256MB and 512MB disk
constantly.

1. Execute ewfmgr.exe with parameter "-
commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service. After
Booting,
Boot image only detect Flash Disk and do nothing to
that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application can not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is disabled and my
application can get EWF type(RAM) and Flash Disk image
was commited certainly.

If I don't remote boot operation at 512MB device, above
phenomenon do not occur and EWF is correct(Disable, RAM
and commited).

If remote boot image detect disk which is stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,

---
Yasutaka


.



.
 
Y

Yasutaka Nakamura

Hi KM and Slobodan,

I am sorry to be late for you reply.
I tested according to your adivece. (I am sorry too long
and poor English text...)

1.EWF Config Partition
I checked FBALOG.TXT file to get EWF config partition
start address. So I found difference between 256MB Flash
and 512MB Flash.

1)256MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..0F300000, len=0x0..08000
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..08000

2)512MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..01e744000, len=0x0..0fc00
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..0fc00

If my understanding for EWF config partition is right
(always 32KB), is EWF partision size correct?

2. EWF partion compare.
1) I read EWF config partition before execute "commitand
disable".( I call this "EWFContent.0".)

2) I read EWF config partition after "commitanddsiable"
and shutdown.(I call this "EWFContent.1".)

Thre was some differents ammong above two content. I
compared two contents using "fb /b" and result is bellow.
fc /b EWFContent0.bin EWFContent1.bin
000004CC: 00 02
000004D0: 00 01

3) Next I plug flash disk to target device and remote
boot it and shutdown. After that I read EWF config
partition(I call "EWFContent.2"), but there was no
defference bettween EWFContent1 and EWFContent2.

4) After 3) procedure, I boot target device from flash
disk. I found XPe image found new hardware and require
reboot to use new device(I could not find what device was
found). At this time EWF did not works correct.

5) I reboot devaice again, EWF status is "enable"(!) and
ewfmgr.exe return error at using with parameter
"-disable" and "-nocmd" ("commit" and "commitanddisable"
is returned no error).

6) I restart target device several times, but above
condition did not changed.

3. EWF in remote boot
My remote boot image does not include EWF components, so
I did not test.

4. Minlogon/Winlogon and way of restart.
1) My image baed on -
Flash Disk XPe image : Winlogon based
Remote Boot image: Minlogon based

2) I restart target device from my application by using
Windows API "ExitWindowsEx".

5. advice from Slobodan
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.

EWF is disabled (OK!)
- Reboot in remote image.
- Reboot back in XPe and check EWF state.

Flash disk image notify that found bew hardware and
require restart. At this time ewfmgr.exe return
code "error 1".
Restart again, EWF is enabled(!). This is same phenomenon
above result I tryed.


I guess that some sector might be changed at remote boot
and XPe on Flash Disk detect Flash Disk as new hardware.
At this time EWF did not works correctly. After that EWF
incorrect-operates after that.

How dou you think?

Regards,

---
Yasutaka

-----Original Message-----
Yasutaka,

1. Since you are using RAM EWF and commitanddisable you
can configure it trough registry only. (This will
eliminate possibility for
problem that Konstantin would like that you test).

2. On your current state try:
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.
- Reboot in remote image.
- Reboot back in XPe and check EWF state. (If EWF
partition is trashed this is something for MS).
3. You should use commands Konstantin mentioned for
reboot, but they are not relevant. EWF is here to protect
you against power
loses so this would not explain this problem.

Regards,
Slobodan


Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown the device, plug-in the
flash card in to another machine and read sectors out of the EWF config
partition. Save the sectors in a file (32K size file, let say EWFContent.1).
Then plug the card back in to the target device, remote boot it, shutdown
again and capture the EWF config partition content again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!) component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF on the Flash while
network booting, what do you see? (supposedly, you should see "Disabled").

And one more point to check... What is your images based on -
Minlogon/Winlogon? How do you do the device restart/shutdown? What the
command you use? Try using "fba -reboot", or, if xpepm included,
"xpepm -reboot".

KM
Hi Slobodan,

Please refer to the following reply.

1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.

2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.

3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.

4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1

5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".

6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.

7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot. So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.

8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote boot, EWF
commitanddisable works actualy.


-----Original Message-----
Hi Yasutaka,

Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.

In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state
correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough
additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network
booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"
Hi Slobodan,

My information is not enough and I will give you more
information about this.I build two XPe image for my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on) to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry
settings
to detect Flash Disk. This image boot and detect Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "-commitanddisable" on
Flash
Disk XPe Image and restart, but the device does not
boot
from Flash Disk, boot from network with XPe image for
Remote Boot.
2) After network booting is comlete, restart device
again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not
correct
(EWF is Enable) in spite of EWF "- commoianddisable".
When I restart device once more gain from Flash Disk,
EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka

-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do remote
boot them you are following wrong doc pages.
You don't need EWF, but you will need ramdisk driver
component.
And few other things to set in registry.

What is relation of Flash Disk to remote boot?

Use following search:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-
8&q=ramdisk+slobodan&btnG=Search&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*

Regards,
Slobodan


"Yasutaka Nakamura"
Hi all,

I am developping XPe with SP1 device. My device uses
two
different size falsh disk as boot disk (256MB or
512MB)
which are configured RAM based EWF(other H/W spec
and
XPe
image are complete same).
At our device, I do bellow operarion and experienced
different phenomenon between 256MB and 512MB disk
constantly.

1. Execute ewfmgr.exe with parameter "-
commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service. After
Booting,
Boot image only detect Flash Disk and do nothing to
that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application can not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is disabled and
my
application can get EWF type(RAM) and Flash Disk
image
was commited certainly.

If I don't remote boot operation at 512MB device,
above
phenomenon do not occur and EWF is correct (Disable,
RAM
and commited).

If remote boot image detect disk which is stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,

---
Yasutaka


.



.


.
 
K

KM

Yasutaka,

Even though the XPe docs state "If all volumes are protected by RAM overlay,
the EWF volume is minimal in size, less than 32 KB.", the size of the EWF
partition may vary and may be more than 32K (I don't know exact limits,
though).
To prove that (beside your own investigation), you can just analyze the
FBAlog.txt on page
http://msdn.microsoft.com/library/en-us/xpehelp/html/xerefprotectedvolumeconfiguration.asp. I
don't know the actual algorith how EWF size is calculated but it seems it
has to do with the disk size it gets created on.

It is hard to think this time of the day (night, actually) but I think you
are right that EWF fails in your case after the Flash Disk is detected as
new hardware (after remote boot).
You can try analyzing [HKLM\SYSTEM\MountedDevices] reg key at all the steps
you do (on your running Flash disk image, just before the EWF
commitanddisable, at the remote boot image time, after the remote boot). It
may also help reviewing the key offline to find out at which stage it gets
changed.

Also check
[HKLM\ControlSet001\Services\EWF\Parameters\Protected\Volume0],"VolumeID"
value on your Flash disk image before and after the remote boot. It is
probably going to be the same value in contrast to to the MountedDevices
VolumeID's changed.

KM
Hi KM and Slobodan,

I am sorry to be late for you reply.
I tested according to your adivece. (I am sorry too long
and poor English text...)

1.EWF Config Partition
I checked FBALOG.TXT file to get EWF config partition
start address. So I found difference between 256MB Flash
and 512MB Flash.

1)256MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..0F300000, len=0x0..08000
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..08000

2)512MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..01e744000, len=0x0..0fc00
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..0fc00

If my understanding for EWF config partition is right
(always 32KB), is EWF partision size correct?

2. EWF partion compare.
1) I read EWF config partition before execute "commitand
disable".( I call this "EWFContent.0".)

2) I read EWF config partition after "commitanddsiable"
and shutdown.(I call this "EWFContent.1".)

Thre was some differents ammong above two content. I
compared two contents using "fb /b" and result is bellow.
fc /b EWFContent0.bin EWFContent1.bin
000004CC: 00 02
000004D0: 00 01

3) Next I plug flash disk to target device and remote
boot it and shutdown. After that I read EWF config
partition(I call "EWFContent.2"), but there was no
defference bettween EWFContent1 and EWFContent2.

4) After 3) procedure, I boot target device from flash
disk. I found XPe image found new hardware and require
reboot to use new device(I could not find what device was
found). At this time EWF did not works correct.

5) I reboot devaice again, EWF status is "enable"(!) and
ewfmgr.exe return error at using with parameter
"-disable" and "-nocmd" ("commit" and "commitanddisable"
is returned no error).

6) I restart target device several times, but above
condition did not changed.

3. EWF in remote boot
My remote boot image does not include EWF components, so
I did not test.

4. Minlogon/Winlogon and way of restart.
1) My image baed on -
Flash Disk XPe image : Winlogon based
Remote Boot image: Minlogon based

2) I restart target device from my application by using
Windows API "ExitWindowsEx".

5. advice from Slobodan
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.

EWF is disabled (OK!)
- Reboot in remote image.
- Reboot back in XPe and check EWF state.

Flash disk image notify that found bew hardware and
require restart. At this time ewfmgr.exe return
code "error 1".
Restart again, EWF is enabled(!). This is same phenomenon
above result I tryed.


I guess that some sector might be changed at remote boot
and XPe on Flash Disk detect Flash Disk as new hardware.
At this time EWF did not works correctly. After that EWF
incorrect-operates after that.

How dou you think?

Regards,

---
Yasutaka

-----Original Message-----
Yasutaka,

1. Since you are using RAM EWF and commitanddisable you
can configure it trough registry only. (This will
eliminate possibility for
problem that Konstantin would like that you test).

2. On your current state try:
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.
- Reboot in remote image.
- Reboot back in XPe and check EWF state. (If EWF
partition is trashed this is something for MS).
3. You should use commands Konstantin mentioned for
reboot, but they are not relevant. EWF is here to protect
you against power
loses so this would not explain this problem.

Regards,
Slobodan


Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown the device, plug-in the
flash card in to another machine and read sectors out of the EWF config
partition. Save the sectors in a file (32K size file, let say EWFContent.1).
Then plug the card back in to the target device, remote boot it, shutdown
again and capture the EWF config partition content again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!) component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF on the Flash while
network booting, what do you see? (supposedly, you should see "Disabled").

And one more point to check... What is your images based on -
Minlogon/Winlogon? How do you do the device restart/shutdown? What the
command you use? Try using "fba -reboot", or, if xpepm included,
"xpepm -reboot".

KM

Hi Slobodan,

Please refer to the following reply.

1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.

2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.

3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.

4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1

5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".

6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.

7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot. So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.

8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote boot, EWF
commitanddisable works actualy.


-----Original Message-----
Hi Yasutaka,

Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.

In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state
correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough
additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network
booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"
Hi Slobodan,

My information is not enough and I will give you more
information about this.I build two XPe image for my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on) to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry
settings
to detect Flash Disk. This image boot and detect Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "-commitanddisable" on
Flash
Disk XPe Image and restart, but the device does not
boot
from Flash Disk, boot from network with XPe image for
Remote Boot.
2) After network booting is comlete, restart device
again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not
correct
(EWF is Enable) in spite of EWF "- commoianddisable".
When I restart device once more gain from Flash Disk,
EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka

-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do remote
boot them you are following wrong doc pages.
You don't need EWF, but you will need ramdisk driver
component.
And few other things to set in registry.

What is relation of Flash Disk to remote boot?

Use following search:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-
8&q=ramdisk+slobodan&btnG=Search&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*

Regards,
Slobodan


"Yasutaka Nakamura"
Hi all,

I am developping XPe with SP1 device. My device uses
two
different size falsh disk as boot disk (256MB or
512MB)
which are configured RAM based EWF(other H/W spec
and
XPe
image are complete same).
At our device, I do bellow operarion and experienced
different phenomenon between 256MB and 512MB disk
constantly.

1. Execute ewfmgr.exe with parameter "-
commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service. After
Booting,
Boot image only detect Flash Disk and do nothing to
that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application can not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is disabled and
my
application can get EWF type(RAM) and Flash Disk
image
was commited certainly.

If I don't remote boot operation at 512MB device,
above
phenomenon do not occur and EWF is correct (Disable,
RAM
and commited).

If remote boot image detect disk which is stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,

---
Yasutaka


.



.


.
 
S

Slobodan Brcin \(eMVP\)

Hi Yasutaka,
4) After 3) procedure, I boot target device from flash
disk. I found XPe image found new hardware and require
reboot to use new device(I could not find what device was
found). At this time EWF did not works correct.

It does not make any sense why you see new disk after just booting from network and them booting from flash disk.

Why your working XPe thinks that something in hardware changed is unknown, but you can try after changing boot order in BIOS to
shutdown device.
And then to boot to XPe.

Or similar test:
You can try remote booting while your flash is out of your device.

This is just too strange.

Regards,
Slobodan


Yasutaka Nakamura said:
Hi KM and Slobodan,

I am sorry to be late for you reply.
I tested according to your adivece. (I am sorry too long
and poor English text...)

1.EWF Config Partition
I checked FBALOG.TXT file to get EWF config partition
start address. So I found difference between 256MB Flash
and 512MB Flash.

1)256MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..0F300000, len=0x0..08000
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..08000

2)512MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..01e744000, len=0x0..0fc00
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..0fc00

If my understanding for EWF config partition is right
(always 32KB), is EWF partision size correct?

2. EWF partion compare.
1) I read EWF config partition before execute "commitand
disable".( I call this "EWFContent.0".)

2) I read EWF config partition after "commitanddsiable"
and shutdown.(I call this "EWFContent.1".)

Thre was some differents ammong above two content. I
compared two contents using "fb /b" and result is bellow.
fc /b EWFContent0.bin EWFContent1.bin
000004CC: 00 02
000004D0: 00 01

3) Next I plug flash disk to target device and remote
boot it and shutdown. After that I read EWF config
partition(I call "EWFContent.2"), but there was no
defference bettween EWFContent1 and EWFContent2.

4) After 3) procedure, I boot target device from flash
disk. I found XPe image found new hardware and require
reboot to use new device(I could not find what device was
found). At this time EWF did not works correct.

5) I reboot devaice again, EWF status is "enable"(!) and
ewfmgr.exe return error at using with parameter
"-disable" and "-nocmd" ("commit" and "commitanddisable"
is returned no error).

6) I restart target device several times, but above
condition did not changed.

3. EWF in remote boot
My remote boot image does not include EWF components, so
I did not test.

4. Minlogon/Winlogon and way of restart.
1) My image baed on -
Flash Disk XPe image : Winlogon based
Remote Boot image: Minlogon based

2) I restart target device from my application by using
Windows API "ExitWindowsEx".

5. advice from Slobodan
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.

EWF is disabled (OK!)
- Reboot in remote image.
- Reboot back in XPe and check EWF state.

Flash disk image notify that found bew hardware and
require restart. At this time ewfmgr.exe return
code "error 1".
Restart again, EWF is enabled(!). This is same phenomenon
above result I tryed.


I guess that some sector might be changed at remote boot
and XPe on Flash Disk detect Flash Disk as new hardware.
At this time EWF did not works correctly. After that EWF
incorrect-operates after that.

How dou you think?

Regards,

---
Yasutaka

-----Original Message-----
Yasutaka,

1. Since you are using RAM EWF and commitanddisable you
can configure it trough registry only. (This will
eliminate possibility for
problem that Konstantin would like that you test).

2. On your current state try:
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.
- Reboot in remote image.
- Reboot back in XPe and check EWF state. (If EWF
partition is trashed this is something for MS).
3. You should use commands Konstantin mentioned for
reboot, but they are not relevant. EWF is here to protect
you against power
loses so this would not explain this problem.

Regards,
Slobodan


Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown the device, plug-in the
flash card in to another machine and read sectors out of the EWF config
partition. Save the sectors in a file (32K size file, let say EWFContent.1).
Then plug the card back in to the target device, remote boot it, shutdown
again and capture the EWF config partition content again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!) component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF on the Flash while
network booting, what do you see? (supposedly, you should see "Disabled").

And one more point to check... What is your images based on -
Minlogon/Winlogon? How do you do the device restart/shutdown? What the
command you use? Try using "fba -reboot", or, if xpepm included,
"xpepm -reboot".

KM

Hi Slobodan,

Please refer to the following reply.

1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.

2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.

3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.

4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1

5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".

6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.

7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot. So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.

8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote boot, EWF
commitanddisable works actualy.


-----Original Message-----
Hi Yasutaka,

Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.

In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF state
correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough
additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network
booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"
Hi Slobodan,

My information is not enough and I will give you more
information about this.I build two XPe image for my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on) to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry
settings
to detect Flash Disk. This image boot and detect Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "-commitanddisable" on
Flash
Disk XPe Image and restart, but the device does not
boot
from Flash Disk, boot from network with XPe image for
Remote Boot.
2) After network booting is comlete, restart device
again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not
correct
(EWF is Enable) in spite of EWF "- commoianddisable".
When I restart device once more gain from Flash Disk,
EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka

-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do remote
boot them you are following wrong doc pages.
You don't need EWF, but you will need ramdisk driver
component.
And few other things to set in registry.

What is relation of Flash Disk to remote boot?

Use following search:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-
8&q=ramdisk+slobodan&btnG=Search&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*

Regards,
Slobodan


"Yasutaka Nakamura"
Hi all,

I am developping XPe with SP1 device. My device uses
two
different size falsh disk as boot disk (256MB or
512MB)
which are configured RAM based EWF(other H/W spec
and
XPe
image are complete same).
At our device, I do bellow operarion and experienced
different phenomenon between 256MB and 512MB disk
constantly.

1. Execute ewfmgr.exe with parameter "-
commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service. After
Booting,
Boot image only detect Flash Disk and do nothing to
that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application can not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is disabled and
my
application can get EWF type(RAM) and Flash Disk
image
was commited certainly.

If I don't remote boot operation at 512MB device,
above
phenomenon do not occur and EWF is correct (Disable,
RAM
and commited).

If remote boot image detect disk which is stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,

---
Yasutaka


.



.


.
 
Y

Yasutaka Nakamura

Hi KM-san and Slobodan-san,

I traced Flash Disk XPe's registry which KM-san mentioned
at each points.
As KM-san said, there are difference in registry at
before and after of remote boot(See bellow).

### before remote boot ###
[HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]
"\\??\\Volume{2c7bd920-ca7e-11d8-b7c7-806d6172696f}"
=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
"\\DosDevices\\C:"=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00

### after remote boot ###
[HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]
"\\??\\Volume{2c7bd920-ca7e-11d8-b7c7-806d6172696f}"
=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
"\\DosDevices\\C:"=hex:bb,63,10,85,00,7e,00,00,00,00,00,00
"\\??\\Volume{1a9cbcd0-ca80-11d8-a46b-806d6172696f}"
=hex:bb,63,10,85,00,7e,00,00,00,00,00,00

XPe of Flash Disk recognizes the Flash disk as defferent
flash disk.
So, I analyzing boot sector of flash disk at before and
after of remote boot. There are 4 byte difference in it
(offset 0x1B8, 0x1B9, 0x1BA and 0x1BB).
These area specifies Disk signature.

So, I tryed bellow process, I confirmed that RAM EWF
works correctly.

1) Back up the boot secter(512MB).
2) Do ewfmgr -commitanddisable and resart.
3) Do remote boot.
4) After remote boot and shutdown, pull flash disk from
target device and write back back up boot secter data.
5) Plug flash disk to target device and boot from the
flash disk.


But there is a thing to which it can not be convinced yet.
This strange phenomenon occur at 512MB Flash disk only
not at 256MB Flash Disk in spite of same manufacture's
priducts. Why?

Regards,

---
Yasutaka
-----Original Message-----
Yasutaka,

Even though the XPe docs state "If all volumes are protected by RAM overlay,
the EWF volume is minimal in size, less than 32 KB.", the size of the EWF
partition may vary and may be more than 32K (I don't know exact limits,
though).
To prove that (beside your own investigation), you can just analyze the
FBAlog.txt on page
http://msdn.microsoft.com/library/en-
us/xpehelp/html/xerefprotectedvolumeconfiguration.asp. I
don't know the actual algorith how EWF size is calculated but it seems it
has to do with the disk size it gets created on.

It is hard to think this time of the day (night, actually) but I think you
are right that EWF fails in your case after the Flash Disk is detected as
new hardware (after remote boot).
You can try analyzing [HKLM\SYSTEM\MountedDevices] reg key at all the steps
you do (on your running Flash disk image, just before the EWF
commitanddisable, at the remote boot image time, after the remote boot). It
may also help reviewing the key offline to find out at which stage it gets
changed.

Also check
[HKLM\ControlSet001 \Services\EWF\Parameters\Protected\Volume0],"VolumeID"
value on your Flash disk image before and after the remote boot. It is
probably going to be the same value in contrast to to the MountedDevices
VolumeID's changed.

KM
Hi KM and Slobodan,

I am sorry to be late for you reply.
I tested according to your adivece. (I am sorry too long
and poor English text...)

1.EWF Config Partition
I checked FBALOG.TXT file to get EWF config partition
start address. So I found difference between 256MB Flash
and 512MB Flash.

1)256MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..0F300000, len=0x0..08000
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..08000

2)512MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..01e744000, len=0x0..0fc00
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..0fc00

If my understanding for EWF config partition is right
(always 32KB), is EWF partision size correct?

2. EWF partion compare.
1) I read EWF config partition before execute "commitand
disable".( I call this "EWFContent.0".)

2) I read EWF config partition after "commitanddsiable"
and shutdown.(I call this "EWFContent.1".)

Thre was some differents ammong above two content. I
compared two contents using "fb /b" and result is bellow.
fc /b EWFContent0.bin EWFContent1.bin
000004CC: 00 02
000004D0: 00 01

3) Next I plug flash disk to target device and remote
boot it and shutdown. After that I read EWF config
partition(I call "EWFContent.2"), but there was no
defference bettween EWFContent1 and EWFContent2.

4) After 3) procedure, I boot target device from flash
disk. I found XPe image found new hardware and require
reboot to use new device(I could not find what device was
found). At this time EWF did not works correct.

5) I reboot devaice again, EWF status is "enable"(!) and
ewfmgr.exe return error at using with parameter
"-disable" and "-nocmd" ("commit" and "commitanddisable"
is returned no error).

6) I restart target device several times, but above
condition did not changed.

3. EWF in remote boot
My remote boot image does not include EWF components, so
I did not test.

4. Minlogon/Winlogon and way of restart.
1) My image baed on -
Flash Disk XPe image : Winlogon based
Remote Boot image: Minlogon based

2) I restart target device from my application by using
Windows API "ExitWindowsEx".

5. advice from Slobodan
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.

EWF is disabled (OK!)
- Reboot in remote image.
- Reboot back in XPe and check EWF state.

Flash disk image notify that found bew hardware and
require restart. At this time ewfmgr.exe return
code "error 1".
Restart again, EWF is enabled(!). This is same phenomenon
above result I tryed.


I guess that some sector might be changed at remote boot
and XPe on Flash Disk detect Flash Disk as new hardware.
At this time EWF did not works correctly. After that EWF
incorrect-operates after that.

How dou you think?

Regards,

---
Yasutaka

-----Original Message-----
Yasutaka,

1. Since you are using RAM EWF and commitanddisable
you
can configure it trough registry only. (This will
eliminate possibility for
problem that Konstantin would like that you test).

2. On your current state try:
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.
- Reboot in remote image.
- Reboot back in XPe and check EWF state. (If EWF
partition is trashed this is something for MS).
3. You should use commands Konstantin mentioned for
reboot, but they are not relevant. EWF is here to protect
you against power
loses so this would not explain this problem.

Regards,
Slobodan


Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown
the
device, plug-in the
flash card in to another machine and read sectors
out
of the EWF config
partition. Save the sectors in a file (32K size
file,
let say EWFContent.1).
Then plug the card back in to the target device, remote boot it, shutdown
again and capture the EWF config partition content again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!) component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF
on
the Flash while
network booting, what do you see? (supposedly, you should see "Disabled").

And one more point to check... What is your images based on -
Minlogon/Winlogon? How do you do the device restart/shutdown? What the
command you use? Try using "fba -reboot", or, if
xpepm
included,
"xpepm -reboot".

KM

Hi Slobodan,

Please refer to the following reply.

1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager Console
Application) in RAM boot image.

2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.

3. If RAM EWF is it configured trough registry or trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.

4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1

5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".

6. What are you doing to your flash image from network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe image
only detect Flasg Disk and restart.

7. Why do you commitanddisable EWF before remote boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote
boot.
So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.

8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I checked,
If I boot device from flash againbefore remote
boot,
EWF
commitanddisable works actualy.


-----Original Message-----
Hi Yasutaka,

Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea based
on this info, but you can do few tests.

In one case I have seen problems with RAM EWF commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot
EWF
state
correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or trough
additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from network
booted XPe?
7. Why do you commitanddisable EWF before remote boot?
8. Have you tried to see if commitanddisable actually
has been done, by booting to XPe from flash again before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"
Hi Slobodan,

My information is not enough and I will give
you
more
information about this.I build two XPe image
for
my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on) to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry
settings
to detect Flash Disk. This image boot and
detect
Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "-
commitanddisable"
on
Flash
Disk XPe Image and restart, but the device does not
boot
from Flash Disk, boot from network with XPe
image
for
Remote Boot.
2) After network booting is comlete, restart device
again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not
correct
(EWF is Enable) in spite of EWF "- commoianddisable".
When I restart device once more gain from Flash Disk,
EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka

-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do remote
boot them you are following wrong doc pages.
You don't need EWF, but you will need ramdisk driver
component.
And few other things to set in registry.

What is relation of Flash Disk to remote boot?

Use following search:
http://groups.google.com/groups? hl=en&lr=&ie=UTF-
8&q=ramdisk+slobodan&btnG=Search&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*

Regards,
Slobodan


"Yasutaka Nakamura"
Hi all,

I am developping XPe with SP1 device. My device uses
two
different size falsh disk as boot disk
(256MB
or
512MB)
which are configured RAM based EWF(other H/W spec
and
XPe
image are complete same).
At our device, I do bellow operarion and experienced
different phenomenon between 256MB and 512MB disk
constantly.

1. Execute ewfmgr.exe with parameter "-
commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service. After
Booting,
Boot image only detect Flash Disk and do nothing to
that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application
can
not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is disabled and
my
application can get EWF type(RAM) and Flash Disk
image
was commited certainly.

If I don't remote boot operation at 512MB device,
above
phenomenon do not occur and EWF is correct (Disable,
RAM
and commited).

If remote boot image detect disk which is stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,

---
Yasutaka


.



.





.


.
 
S

Slobodan Brcin \(eMVP\)

Few more question and I'm out of ideas.

Where did you run FBA?
And I could now find in previous posts, what type of Flash Disk are you using?

If you run FBA of HDD and then copy image of HDD to Flash, make sure to disconnect HDD from your target machine when using flash
disk.

Your remote boot image probably execute something during the boot that changes DiskID, or you have two Disks in your target device
with same ID. (It that case I have no idea what will Windows DO)

Regards,
Slobodan


Yasutaka Nakamura said:
Hi KM-san and Slobodan-san,

I traced Flash Disk XPe's registry which KM-san mentioned
at each points.
As KM-san said, there are difference in registry at
before and after of remote boot(See bellow).

### before remote boot ###
[HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]
"\\??\\Volume{2c7bd920-ca7e-11d8-b7c7-806d6172696f}"
=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
"\\DosDevices\\C:"=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00

### after remote boot ###
[HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]
"\\??\\Volume{2c7bd920-ca7e-11d8-b7c7-806d6172696f}"
=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
"\\DosDevices\\C:"=hex:bb,63,10,85,00,7e,00,00,00,00,00,00
"\\??\\Volume{1a9cbcd0-ca80-11d8-a46b-806d6172696f}"
=hex:bb,63,10,85,00,7e,00,00,00,00,00,00

XPe of Flash Disk recognizes the Flash disk as defferent
flash disk.
So, I analyzing boot sector of flash disk at before and
after of remote boot. There are 4 byte difference in it
(offset 0x1B8, 0x1B9, 0x1BA and 0x1BB).
These area specifies Disk signature.

So, I tryed bellow process, I confirmed that RAM EWF
works correctly.

1) Back up the boot secter(512MB).
2) Do ewfmgr -commitanddisable and resart.
3) Do remote boot.
4) After remote boot and shutdown, pull flash disk from
target device and write back back up boot secter data.
5) Plug flash disk to target device and boot from the
flash disk.


But there is a thing to which it can not be convinced yet.
This strange phenomenon occur at 512MB Flash disk only
not at 256MB Flash Disk in spite of same manufacture's
priducts. Why?

Regards,

---
Yasutaka
-----Original Message-----
Yasutaka,

Even though the XPe docs state "If all volumes are protected by RAM overlay,
the EWF volume is minimal in size, less than 32 KB.", the size of the EWF
partition may vary and may be more than 32K (I don't know exact limits,
though).
To prove that (beside your own investigation), you can just analyze the
FBAlog.txt on page
http://msdn.microsoft.com/library/en-
us/xpehelp/html/xerefprotectedvolumeconfiguration.asp. I
don't know the actual algorith how EWF size is calculated but it seems it
has to do with the disk size it gets created on.

It is hard to think this time of the day (night, actually) but I think you
are right that EWF fails in your case after the Flash Disk is detected as
new hardware (after remote boot).
You can try analyzing [HKLM\SYSTEM\MountedDevices] reg key at all the steps
you do (on your running Flash disk image, just before the EWF
commitanddisable, at the remote boot image time, after the remote boot). It
may also help reviewing the key offline to find out at which stage it gets
changed.

Also check
[HKLM\ControlSet001 \Services\EWF\Parameters\Protected\Volume0],"VolumeID"
value on your Flash disk image before and after the remote boot. It is
probably going to be the same value in contrast to to the MountedDevices
VolumeID's changed.

KM
Hi KM and Slobodan,

I am sorry to be late for you reply.
I tested according to your adivece. (I am sorry too long
and poor English text...)

1.EWF Config Partition
I checked FBALOG.TXT file to get EWF config partition
start address. So I found difference between 256MB Flash
and 512MB Flash.

1)256MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..0F300000, len=0x0..08000
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..08000

2)512MB Flash's FBALOG.TXT
XX:XX:XX PM Allocating EWF in PRIMARY partition
start=0x0..01e744000, len=0x0..0fc00
XX:XX:XX PM Created EWF partition on Disk=0,
partition=2,size=0x0..0fc00

If my understanding for EWF config partition is right
(always 32KB), is EWF partision size correct?

2. EWF partion compare.
1) I read EWF config partition before execute "commitand
disable".( I call this "EWFContent.0".)

2) I read EWF config partition after "commitanddsiable"
and shutdown.(I call this "EWFContent.1".)

Thre was some differents ammong above two content. I
compared two contents using "fb /b" and result is bellow.
fc /b EWFContent0.bin EWFContent1.bin
000004CC: 00 02
000004D0: 00 01

3) Next I plug flash disk to target device and remote
boot it and shutdown. After that I read EWF config
partition(I call "EWFContent.2"), but there was no
defference bettween EWFContent1 and EWFContent2.

4) After 3) procedure, I boot target device from flash
disk. I found XPe image found new hardware and require
reboot to use new device(I could not find what device was
found). At this time EWF did not works correct.

5) I reboot devaice again, EWF status is "enable"(!) and
ewfmgr.exe return error at using with parameter
"-disable" and "-nocmd" ("commit" and "commitanddisable"
is returned no error).

6) I restart target device several times, but above
condition did not changed.

3. EWF in remote boot
My remote boot image does not include EWF components, so
I did not test.

4. Minlogon/Winlogon and way of restart.
1) My image baed on -
Flash Disk XPe image : Winlogon based
Remote Boot image: Minlogon based

2) I restart target device from my application by using
Windows API "ExitWindowsEx".

5. advice from Slobodan
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.

EWF is disabled (OK!)

- Reboot in remote image.
- Reboot back in XPe and check EWF state.

Flash disk image notify that found bew hardware and
require restart. At this time ewfmgr.exe return
code "error 1".
Restart again, EWF is enabled(!). This is same phenomenon
above result I tryed.


I guess that some sector might be changed at remote boot
and XPe on Flash Disk detect Flash Disk as new hardware.
At this time EWF did not works correctly. After that EWF
incorrect-operates after that.

How dou you think?

Regards,

---
Yasutaka


-----Original Message-----
Yasutaka,

1. Since you are using RAM EWF and commitanddisable you
can configure it trough registry only. (This will
eliminate possibility for
problem that Konstantin would like that you test).

2. On your current state try:
- Commitanddisable.
- Reboot again in flash XPe.
- Check if RAM EWF is disabled.
- Reboot in remote image.
- Reboot back in XPe and check EWF state. (If EWF
partition is trashed this is something for MS).

3. You should use commands Konstantin mentioned for
reboot, but they are not relevant. EWF is here to protect
you against power
loses so this would not explain this problem.

Regards,
Slobodan


Yasutaka,

I know this may sound silly but ...
Have you tried exploring EWF config volume content
offline? (you mentioned
"configured RAM EWF through additional partition").

When you do "commitanddisable" on Flash, shutdown the
device, plug-in the
flash card in to another machine and read sectors out
of the EWF config
partition. Save the sectors in a file (32K size file,
let say EWFContent.1).
Then plug the card back in to the target device,
remote boot it, shutdown
again and capture the EWF config partition content
again (EWFContent.2).
Do a binary comparison of the EWFContent.1 and
EWFContent.2 files. If there
were no infuence of the Remote Boot image on the EWF
Config partition, you
won't see any difference.

Also, if you include EWF (disabled all time!)
component (EwfMgr, Ewf API) in
to the Remote Boot image and read the state of EWF on
the Flash while
network booting, what do you see? (supposedly, you
should see "Disabled").

And one more point to check... What is your images
based on -
Minlogon/Winlogon? How do you do the device
restart/shutdown? What the
command you use? Try using "fba -reboot", or, if xpepm
included,
"xpepm -reboot".

KM

Hi Slobodan,

Please refer to the following reply.

1. In your RAM boot image you do not have EWF
component,
right? (If you have remove it.)
[Yasutaka Nakamura]
I don't have EWF components(Enhaced Write Filter, EWF
NTLDR, Enahnced Write Filter API and EWF Manager
Console
Application) in RAM boot image.

2. Are you using RAM or Disk overlay?
[Yasutaka Nakamura]
I am using RAM overlay in Flash Disk XPe image.

3. If RAM EWF is it configured trough registry or
trough
additional partition.
[Yasutaka Nakamura]
I configured RAM EWF through additional partition. I
configured 512MB flash disk to about 510MB for system
partition and about 2MB empty patition for RAM EWF.

4. What version of XPe are you using?
[Yasutaka Nakamura]
I am using WIndows XP Embedded with SP1

5. What EWF QFE version are you using?
[Yasutaka Nakamura]
I am using "Enhanced Write Filter - Hotfix Q823025".

6. What are you doing to your flash image from
network
booted XPe?
[Yasutaka Nakamura]
Currently I do not do anything, network boot XPe
image
only detect Flasg Disk and restart.

7. Why do you commitanddisable EWF before remote
boot?
[Yasutaka Nakamura]
I plan to pull the flash disk image by remote boot.
So I
need EWF commitanddisable function to apply flash XPe
image settings before remote boot.

8. Have you tried to see if commitanddisable
actually
has been done, by booting to XPe from flash again
before
remote boot. (This should be done if you are using
dskoverlay).
[Yasutaka Nakamura]
I test above your advice already, As long as I
checked,
If I boot device from flash againbefore remote boot,
EWF
commitanddisable works actualy.


-----Original Message-----
Hi Yasutaka,

Do you have any opnion about this phenomenon?

Except that this is a phenomenon, I have no idea
based
on this info, but you can do few tests.

In one case I have seen problems with RAM EWF
commit and
commitanddisable. (They did not write any data during
graceful shutdown
with any of functions).
But this would not explain that on second boot EWF
state
correct itself.

Now few questions:
1. In your RAM boot image you do not have EWF
component,
right? (If you have remove it.)
2. Are you using RAM or Disk overlay?
3. If RAM EWF is it configured trough registry or
trough
additional partition.
4. What version of XPe are you using?
5. What EWF QFE version are you using?
6. What are you doing to your flash image from
network
booted XPe?
7. Why do you commitanddisable EWF before remote
boot?
8. Have you tried to see if commitanddisable
actually
has been done, by booting to XPe from flash again
before
remote boot. (This
should be done if you are using dskoverlay).

Best regards,
Slobodan

"Yasutaka Nakamura"
message
Hi Slobodan,

My information is not enough and I will give you
more
information about this.I build two XPe image for
my
device.

1) XPe image for Flash Disk.
I add EWF components (EWF, EWF NTLDR and so on)
to this
image. This image works good on Flash disk.

2) XPe image for Remote Boot.
I add ramdisk driver component and few registry
settings
to detect Flash Disk. This image boot and detect
Flash
disk correctly.

Using above two XPe image,
1) I execute ewfmgr.exe with "- commitanddisable"
on
Flash
Disk XPe Image and restart, but the device does
not
boot
from Flash Disk, boot from network with XPe image
for
Remote Boot.
2) After network booting is comlete, restart
device
again
and device boot from Flash Disk.

In this case EWF status of Flash disk XPe is not
correct
(EWF is Enable) in spite of EWF "-
commoianddisable".
When I restart device once more gain from Flash
Disk,
EWF
status become correct.

Do you have any opnion about this phenomenon?

regards,

---
Yasutaka

-----Original Message-----
Hi Yasutaka,

Could you give me more info. If you want to do
remote
boot them you are following wrong doc pages.
You don't need EWF, but you will need ramdisk
driver
component.
And few other things to set in registry.

What is relation of Flash Disk to remote boot?

Use following search:
http://groups.google.com/groups? hl=en&lr=&ie=UTF-
8&q=ramdisk+slobodan&btnG=Search&meta=group%
3Dmicrosoft.public.windowsxp.embedded.*

Regards,
Slobodan


"Yasutaka Nakamura"
message
Hi all,

I am developping XPe with SP1 device. My
device uses
two
different size falsh disk as boot disk (256MB
or
512MB)
which are configured RAM based EWF(other H/W
spec
and
XPe
image are complete same).
At our device, I do bellow operarion and
experienced
different phenomenon between 256MB and 512MB
disk
constantly.

1. Execute ewfmgr.exe with parameter "-
commitanddisable"
and restart device.
2. Remote boot by XPe Remote Boot Service.
After
Booting,
Boot image only detect Flash Disk and do
nothing to
that.
After this device restart automatically.
3. This time, device boot by Flash Disk.

--- Result after above operation---
case 1: Device with 256MB Falsh Disk
There was no probrem, Flash Disk image was
commited
certainly.

case 2: Device with 512MB Flash Disk
This case seems strange!
- EWF is stiil enabled and My application can
not
recognize EWF type(RAM or DISK).
- If restart device once more, EWF is
disabled and
my
application can get EWF type(RAM) and Flash
Disk
image
was commited certainly.

If I don't remote boot operation at 512MB
device,
above
phenomenon do not occur and EWF is correct
(Disable,
RAM
and commited).

If remote boot image detect disk which is
stored EWF
command, are there any influence to the disk?

Do you have any opinions or suggestions?

Regards,

---
Yasutaka


.



.





.


.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top