oscdimg

[Slobodan Brcin \(eMVP\)]

Hi Dietmar,

Do you keep records of all the steps that you did so far in case that some
new form of AI is born from all of this

Seriously IIRC your main goal was to make easier procedure for XPe boot from
CD that will always work, right?
By each passing hour I see you drifting away from that goal :-(

Regards,
Slobodan

I'm just wondering what Konstantin think about all this endeavor, he has
been very quiet about giving opinions on this topic.

 

[Dietmar]

Hi Slobodan,
I cant say anything about EWFNTLDR only that one, that EWF is not working
when You use normal NTLDR.
I saw the Windows Professional Screen (booted from WinPe virtuell CD, and
than came blue screen with System_License_Violation (Microsoft seems not
do want that somebody is doing this...hihi)
and Stop 0x0000009A,0xC0000034,0x00000000,0x00000000

Any idea?

Dietmar

 

[Dietmar]

Hi Slobodan,
I think that Konstantin thinks it may work.
And that is perhaps a problem for Microsoft.
But I dont want to sell anything, its just for FUN. Now I understand, why
all this terrible renaming is made. Only to forbid CD Boot with XPPRO, I
am quiet shure.
Dietmar

 

[Slobodan Brcin \(eMVP\)]

Dietmar,

I asked if you know what EWFNTLDR does because it has no relevance what so
ever to Reg Configured RAM EWF.
You must use Reg Conf RAM EWF so ewfntldr has nothing to offer regarding the
EWF driver and functionality.

Your BSOD problems is not EWF related.

Regards,
Slobodan

 

[KM]

Slobodan,

I'm just wondering what Konstantin think about all this endeavor, he has been very quiet about giving opinions on this topic.

You are right. I've decided not to interfere in this thread. The main reason is that I do not understand the goal of Dietmar's
attempts.
Just reading through the thread I can see a mixed variety of OSes - XPe, PE, XP Pro, VxWorks. I got lost what was the aim, though.

Anyway, Dietmar seems to be a hard-working man and I am sure he will get to what he's trying to get.
I may only ask him to follow more engineer-like style of writting. Specifically, always show the steps he did or he is planning to
do. Then, I am sure, other readers in this NG will benefit very much from this thread.

Regards,
Konstantin

PS. Dietmar, do you really like using the web post client from www.talkaboutsoftware.com? Did you try OE? It may appear to be more
convinent for your use since you are doing a lot of posting now.

 

[Dietmar]

Hi Slobodan,
I copied ewfmgr.exe to system32 folder and ewf.sys to system32\drivers
(both from XPE SP2)from outside to WinPE partion.
Then I make a try with WinPE on first harddiskpartion to overcome
arcproblems. I imported with regedit the ewf.reg from SFiorito in running
WinPE on harddisk.
This ewf.reg is

Windows Registry Editor Version 5.00



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]

"Enable"="N"



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]

"EnableAutoLayout"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]

"NtfsDisableLastAccessUpdate"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management\PrefetchParameters]

"EnablePrefetcher"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

BootExecute=""



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF]

"NextInstance"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000]

"Service"="EWF"

"Legacy"=dword:00000001

"ConfigFlags"=dword:00000020

"Class"="LegacyDriver"

"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"

"DeviceDesc"="EWF"

"Capabilities"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control]

"ActiveService"="EWF"



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]

"ErrorControl"=dword:00000001

"Group"="System Bus Extender"

"Start"=dword:00000000

"Type"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

"UpperFilters"="Ewf"



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]

"Type"=dword:00000001

"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"


Then I noticed, that nothing in THAT registry is stored after reboot. Do
YOU know a trick, with whitch writes to registry are permanent stored in
WinPE? I exportet from running WinPE SAM, SECURITY, SOFTWARE, SYSTEM
under HKLM as hive to another harddrive. Then from XPPRO I put them back
to there original folder config, and rename
SYSTEM to SETUPREG.HIV and copied it to the system32 folder of WinPE. I
think, that this is all ok. When I start WinPE, it comes to full boot
but then appears a message: The system is not fully installed. Please run
setup again.

How should I do this in WinPE??? I think, with the ewf.reg from SFiorito
is something called in WinPE that isnt there. Do You have an idea what
this can be? There is a file called DEFAULT in config folder of WinPE
which may also be related to registry in WinPE but I dont know how.

Thanks,
Dietmar

PS:I am shure that it will work. The message is on real CD
cdrom(159)exactly the same, meaning all works correct but something is
missed or called in EWF.reg which is not there.

 

[Dietmar]

Hi all,
I solved this with:"

To work around this issue, you can use the Parallel Install Recovery
option to install a parallel installation of Windows XP or Windows 2000 in
a different partition and then use Registry Editor to change the data value
of the SystemSetupInProgress value from 1 to 0. 1. Start Registry Editor
(Regedt32.exe).
2. On the Windows menu, click the HKEY_LOCAL_MACHINE node.
3. On the Registry menu, click Load Hive.
4. Click the %SystemRoot%\System32\Config\System file, and then click
Open.
5. Type a name for the key, and then click OK.
6. Double-click the key name from the previous step.
7. Double-click the Setup key.
8. Double-click the SystemSetupInProgress value in the right pane.
9. Change the data value from 1 to 0, and then click OK.
10. Click the key name, and then click Unload Hive on the Registry menu.
11. Close Registry Editor, and then restart the computer. "

WAOW it boots with EFW enabled under WinPE from real CD!!!

But now WinPe wants a password, username Administrator, password???
But there is no error any more,

Dietmar

 

[Dietmar]

It worked,
the message which now appears is: There is no paging file..." hihi, I
think because EWF is enabled on that CD but also it is still in minint
mode thats makes all a little complicate.

But I say, EWF works on that WinPE CD.

Dietmar

 

[Slobodan Brcin \(eMVP\)]

Hi Dietmar,

1. Use regedit to edit offline registry and change registry values that
belong to WinPE, this is the only way.
2. ARC path is the least of the problems. You don't have to use it is SP2
since you should be able to use driver ID. You problem (was, is and will be)
cdrom.sys which is used instead of disk.sys and driver stack above them.

I'm impressed with your stubbornness to mess with things that you know
little or nothing about and not even want to pursue the enough knowledge to
understand how things work

To solve or give up on this problem you must:
1. Install remote Windows Debugger and learn how to use it, so that you can
see loaded drivers and learn about them.
2. Install DDK and analyze documentation and sources about cdrom.sys and
disk.sys drivers and what drivers lie above them and how.
3. From DDK doc learn about filter drivers, especially UpperFilter class
drivers. This will allow you to know what ewf.sys do how it does it and why
it does that.
4. Learn all that you can find on net about CDFS.sys driver.
5. Based on above choose where to install ewf.sys driver (above which driver
if possible that is)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]for UpperFilter driver is probably the wrong key for CD device.To save you some time based on my humble experience with drivers and XP.1. WinPE boot by using cdfs.sys driver and you want that functionality.2. cdfs.sys driver is simple File System driver that give you access tofiles stored on CD.3. cdfs.sys driver being the simple driver do not have write operationsimplemented.4. EWF.sys can't be installed above FS driver.5. Installing EWF anywhere else that above FS driver would not make anysense since no write requests would reach it. (Like I said cdfs.sys havefile read only support.)Please Dietmar tell me which of my assumptions in bullets are wrong? Sinceif they are all true there is no way for you to use EWF as you want to useit.You see this is type of discussion that you should have chosen from day one.You have many people here including Konstantin and me that can help you withunderstanding this. If you have some info or idea that we did not though ofwe would like to know it and help you with it.But blindly playing with registry and drivers approach can't work in thiscase. There is no MS conspiracy involved in why XPP do not boot from CD orother similar things, this is just how drivers that XPP/XPe/WinPE use aredesigned. Nothing more nothing less.So beliefs that something will or not work on XP that you so often mentionare wrong way to do. Hunches based on how things are implemented andstretching the implementation to limits are the right way to go, althoughthey also can be dead-ends because of many reasons that are beyond ourcontrol and that we could not foreseen up-front.So again what is your expectation in regards to driver load order and theirmutual interaction? This is very important and answering this will tell youwhy it will or won't work.Regards,Slobodan"Dietmar" <[email protected]> wrote in messagenews:[email protected]...> Hi Slobodan,> I copied ewfmgr.exe to system32 folder and ewf.sys to system32\drivers> (both from XPE SP2)from outside to WinPE partion.> Then I make a try with WinPE on first harddiskpartion to overcome> arcproblems. I imported with regedit the ewf.reg from SFiorito in running> WinPE on harddisk.> This ewf.reg is>> Windows Registry Editor Version 5.00>>>> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]>> "Enable"="N">>>>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]>> "EnableAutoLayout"=dword:00000000>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]>> "NtfsDisableLastAccessUpdate"=dword:00000001>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session> Manager\Memory Management\PrefetchParameters]>> "EnablePrefetcher"=dword:00000000>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]>> BootExecute="">>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF]>> "NextInstance"=dword:00000001>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000]>> "Service"="EWF">> "Legacy"=dword:00000001>> "ConfigFlags"=dword:00000020>> "Class"="LegacyDriver">> "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}">> "DeviceDesc"="EWF">> "Capabilities"=dword:00000000>>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control]>> "ActiveService"="EWF">>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]>> "ErrorControl"=dword:00000001>> "Group"="System Bus Extender">> "Start"=dword:00000000>> "Type"=dword:00000001>>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]>> "UpperFilters"="Ewf">>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]>> "Type"=dword:00000001>> "ArcName"="multi(0)disk(0)rdisk(0)partition(1)">>> Then I noticed, that nothing in THAT registry is stored after reboot. Do> YOU know a trick, with whitch writes to registry are permanent stored in> WinPE? I exportet from running WinPE SAM, SECURITY, SOFTWARE, SYSTEM> under HKLM as hive to another harddrive. Then from XPPRO I put them back> to there original folder config, and rename> SYSTEM to SETUPREG.HIV and copied it to the system32 folder of WinPE. I> think, that this is all ok. When I start WinPE, it comes to full boot> but then appears a message: The system is not fully installed. Please run> setup again.>> How should I do this in WinPE??? I think, with the ewf.reg from SFiorito> is something called in WinPE that isnt there. Do You have an idea what> this can be? There is a file called DEFAULT in config folder of WinPE> which may also be related to registry in WinPE but I dont know how.>> Thanks,> Dietmar>> PS:I am shure that it will work. The message is on real CD> cdrom(159)exactly the same, meaning all works correct but something is> missed or called in EWF.reg which is not there.>>>>>

 

[Slobodan Brcin \(eMVP\)]

WOW Diemtar,

I just gave you a 100% reason why it can work in this thread, heck I guess
that you prove me wrong and I would like to understand why it work.

1. What ARC path did you used?
2. Have you removed HDDs from your computer?
3. Is C: only volume that you see?
4. Please give us complete dump of screen ewfmgr C:

Thanks,
Slobodan

 

[Slobodan Brcin \(eMVP\)]

Dietmer,

Heck what hapened here, my outlook went crazy :-(
I reformatted text again hope this time it will be ok.

Hi Dietmar,

1. Use regedit to edit offline registry and change registry values that
belong to WinPE, this is the only way.
2. ARC path is the least of the problems. You don't have to use it is SP2
since you should be able to use driver ID. You problem (was, is and will be)
cdrom.sys which is used instead of disk.sys and driver stack above them.

I'm impressed with your stubbornness to mess with things that you know
little or nothing about and not even want to pursue the enough knowledge to
understand how things work

To solve or give up on this problem you must:
1. Install remote Windows Debugger and learn how to use it, so that you can
see loaded drivers and learn about them.
2. Install DDK and analyze documentation and sources about cdrom.sys and
disk.sys drivers and what drivers lie above them and how.
3. From DDK doc learn about filter drivers, especially UpperFilter class
drivers. This will allow you to know what ewf.sys do how it does it and why
it does that.
4. Learn all that you can find on net about CDFS.sys driver.
5. Based on above choose where to install ewf.sys driver (above which driver
if possible that is)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]for UpperFilter driver is probably the wrong key for CD device.To save you some time based on my humble experience with drivers and XP.1. WinPE boot by using cdfs.sys driver and you want that functionality.2. cdfs.sys driver is simple File System driver that give you access tofiles stored on CD.3. cdfs.sys driver being the simple driver do not have writeoperationsimplemented.4. EWF.sys can't be installed above FS driver.5. Installing EWF anywhere else that above FS driver would not make anysensesince no write requests would reach it. (Like I said cdfs.sys havefile readonly support.)Please Dietmar tell me which of my assumptions in bullets are wrong?Since if they are all true there is no way for you to use EWF as you want touseit.You see this is type of discussion that you should have chosen from day one.You have many people here including Konstantin and me that can help you withunderstanding this.If you have some info or idea that we did not though of we would like toknow it and help you with it.But blindly playing with registry and drivers approach can't work inthiscase.There is no MS conspiracy involved in why XPP do not boot from CD orothersimilar things, this is just how drivers that XPP/XPe/WinPE use aredesigned.Nothing more nothing less.So beliefs that something will or not work on XP that you so often mentionare wrong way to do.Hunches based on how things are implemented andstretching the implementationto limits are the right way to go, although they also can be dead-endsbecause of many reasons that are beyond ourcontrol and that we could notforeseen up-front.So again what is your expectation in regards to driver load order andtheirmutual interaction?This is very important and answering this will tell youwhy it will or won'twork.Regards,Slobodan

 

[Slobodan Brcin \(eMVP\)]

I give up.

Can someone tell me the secret char sequence that prevented.line break on
bottom text?

Regards,
Slobodan

Dietmer,

Heck what hapened here, my outlook went crazy :-(
I reformatted text again hope this time it will be ok.

Hi Dietmar,

1. Use regedit to edit offline registry and change registry values that
belong to WinPE, this is the only way.
2. ARC path is the least of the problems. You don't have to use it is SP2
since you should be able to use driver ID. You problem (was, is and will
be)
cdrom.sys which is used instead of disk.sys and driver stack above them.

I'm impressed with your stubbornness to mess with things that you know
little or nothing about and not even want to pursue the enough knowledge
to
understand how things work

To solve or give up on this problem you must:
1. Install remote Windows Debugger and learn how to use it, so that you
can
see loaded drivers and learn about them.
2. Install DDK and analyze documentation and sources about cdrom.sys and
disk.sys drivers and what drivers lie above them and how.
3. From DDK doc learn about filter drivers, especially UpperFilter class
drivers. This will allow you to know what ewf.sys do how it does it and
why
it does that.
4. Learn all that you can find on net about CDFS.sys driver.
5. Based on above choose where to install ewf.sys driver (above which
driver
if possible that is)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]for
UpperFilter driver is probably the wrong key for CD device.To save you
some time based on my humble experience with drivers and XP.1. WinPE boot
by using cdfs.sys driver and you want that functionality.2. cdfs.sys
driver is simple File System driver that give you access tofiles stored on
CD.3. cdfs.sys driver being the simple driver do not have
writeoperationsimplemented.4. EWF.sys can't be installed above FS
driver.5. Installing EWF anywhere else that above FS driver would not make
anysensesince no write requests would reach it. (Like I said cdfs.sys
havefile readonly support.)Please Dietmar tell me which of my assumptions
in bullets are wrong?Since if they are all true there is no way for you to
use EWF as you want touseit.You see this is type of discussion that you
should have chosen from day one.You have many people here including
Konstantin and me that can help you withunderstanding this.If you have
some info or idea that we did not though of we would like toknow it and
help you with it.But blindly playing with registry and drivers approach
can't work inthiscase.There is no MS conspiracy involved in why XPP do not
boot from CD orothersimilar things, this is just how drivers that
XPP/XPe/WinPE use aredesigned.Nothing more nothing less.So beliefs that
something will or not work on XP that you so often mentionare wrong way to
do.Hunches based on how things are implemented andstretching the
implementationto limits are the right way to go, although they also can be
dead-endsbecause of many reasons that are beyond ourcontrol and that we
could notforeseen up-front.So again what is your expectation in regards to
driver load order andtheirmutual interaction?This is very important and
answering this will tell youwhy it will or won'twork.Regards,Slobodan

 

[Dietmar]

Hi Slobodan,
I put the key ENABLED to Volume0 in EWF and set it to 0. But again there
appears after full boot and setting the personal entries the message (both
on virtual CD and harddisk) that "

Your system has no paging file, or the paging file is too small. " I
think its because EWF.

So work must go on but tomorrow is school again and I have then only
little time. I have windebug and I integrated in my large XPE DVD image
the component for firewire debug. So I can do all what I (and YOU) want to
do and now I am understanding a lot of whats do do next...hihi

Dietmar

 

[Slobodan Brcin \(eMVP\)]

Dietmar,

Why make you think that EWF even started?

Regards,
Slobodan

 

[Dietmar]

Hi Slobodan,
I enabled C:\pagefile.sys in registry but still isnt factory.exe able to
build a pagefile (as described in winbomb.ini). This gives the message No
pagefile... . Therefore I think that factory and EWF wont work together.
Perhaps You can disable factory, is this possible? The problem with
factory MUST be solved, simply to have a commandline where You can type
C:\ewfmgr c: and see...hihi

Dietmar

 

[Dietmar]

Hi Slobodan,
I controlled the 2 logfiles at WinPE on harddrive.
All seems to start with c:\factory -WinPe but
not the pagefile (driver?).
My last thought for today is: Let factory do all its work and disable
everywhere any pagefile (winbomb.ini , registry and so on). Perhaps this
work, I will try this tomorrow.

Dietmar

 

[Slobodan Brcin \(eMVP\)]

Dietmar,

So you don't have command line, right?
I don't know how you were able to conclude that EWF is working?

About pagefile I have no clue based on informations that you gave us so far.
What pagefile on WinPE image do you talk about?

Regards,
Slobodan

 

[Dietmar]

Hi Slobodan,
now I have a commandline on virtual CD and on harddisk with WinPE.

All the registryentrances changed like SFiorito told. You can probe this
with regedit under running WinPE.

But if You type C:\ ewfmgr c: then comes the message with error 1,
Failed getting protected volumen...
This means: EWF and WinPE can live together WITHOUT any problems, but EWF
does not start, perhaps because it need a function which is implemented in
XP(E) but not in WinPE.
I search for...hihi

Dietmar

 

[KM]

Dietmar,

Hi Slobodan,
now I have a commandline on virtual CD and on harddisk with WinPE.

All the registryentrances changed like SFiorito told. You can probe this
with regedit under running WinPE.

But if You type C:\ ewfmgr c: then comes the message with error 1,
Failed getting protected volumen...
This means: EWF and WinPE can live together WITHOUT any problems, but EWF

This is an interesting conclusion. I wonder what you think a problem is.

The EWF itself has very minimum dependencies. They are likely in WinPE but you can check it out with Dependency Walker.

Btw, what makes you think the ewf.sys got installed properly? (you saw some messages in SetupApi.log? you ran devcon?)

If you followed SFiorito's tutorial, you probably set EWF above disk.sys? (you didn't change it to have the filter on top of
cdfs.sys or cdrom.sys?)

 

[Slobodan Brcin \(eMVP\)]

Dietmar,

All the registryentrances changed like SFiorito told. You can probe this
with regedit under running WinPE.

And my opinion that it won't work if you don't change some values does not
count?

But if You type C:\ ewfmgr c: then comes the message with error 1,
Failed getting protected volumen...

Exactly this was expected by me, (or error 50 cant tell from head).
While booting from CD try protecting some present HDD partition, just to
verify that EWF can work on WinPE at all. (You will need User Mode PnP
functionality in your image)

This means: EWF and WinPE can live together WITHOUT any problems, but EWF
does not start, perhaps because it need a function which is implemented in
XP(E) but not in WinPE.

Just read your sentense please, what does it tell you?

Most people would say something like: "EWF is not working, please help, what
it wrong with it!"

How can you say that they live together WITHOUT ANY problems, when ewf is
not working?

Regards,
Slobodan