Problems with Booting XPe from CD-ROM

[Alexander]

Hello,
I've tried to boot a XP Embedded image from CD-ROM like described in
Chapter 11 of the XP Embedded Advanced book from Sean D. Liming. My
target is the Pentium based VMEBus Single Board Computer VR9 from SBS,
the HD is a 6 GB Microdrive from Hitachi, my drive is the DVD-R/-RW
drive SD-R6112 from Toshiba. Because there is no possiblity to connect
further IDE devices to that board, I've connected the driver via an
adapter to an USB port of the target board.
The image has been generated by first importing the Target Analyzer
informations about my target board and then adding the necessary EWF
and El Torito components and the Command Shell like described in the
book.
The first problem I have encountered is that after having booted the
image from disk with the Pre-FBA El Torito Disk in the drive ewfmgr
reported "Unable to find an Ewf volume" and ewfmgr c: reported "Failed
getting protected volume configuration with error 1" also the contents
of fbalog.txt showed that the EWF volume had been created. Diskpart
also found the 32 KB EWF volume after the two primary partitions I had
created on the disk (C: 160 MB, D: 900 MB). Furthermore the El Torito
disk had not been found.
I've solved this problem by replacing the Command Shell component by
the Task Manager Shell like in the EWF example in Chapter 10 of the
book from Sean Liming. Now my el torito disk had been found and ewfmgr
and ewfmgr c: yielded the expected outputs like described in the book.
In the explorer the following three partitions were visible:
C: 160 MB
D: 899 MB
F: 160 MB
E is the DVD drive. I assume that F is the El Torito drive generated
by the El Torito driver.

But now if I call etprep -all I get the following messages:
Deleted EWF partitions = 1
Start value for Redbook/IMAPI services has been reset to zero.
Failed to swap El Torito disk drive letter. Error = 0x1.

After that the system automatically reboots which ends with a BSOD
with the following outputs:
STOP: c000007b {Bad Image}
The application or DLL \??\C:\WINDOWS\system32\shsvcs.dll is not a
valid windows image. Please check this against your installation
diskette.

Every reboot brings this Blue Screen again.

So my two questions are: Why I need the Task Manager Shell to let the
El Torito Disk found and let ewfmgr find the EWF volume and why the
swapping of the disk drive letters get failed (I assume that the Blue
Screen is a consequence of this). I've read in a message on this topic
that USB drives will not function. Is this really true?

Who can help me? Any hint will be appreciated.

 

[Sean Liming \(eMVP\)]

1. Are you using FP2007? There have been some improvements.
2. With the two partitions on the disk, I assume the rest of the drive is
left unpartioned. Is this Correct?
3. Is EWF set to NOT run on start?
4. One extra step that has changed the instructions from SP1 to SP2 to
FP2007, is the need to run EWFMGR c: -enable before Etrpep -all.
5. Are you using the HD2ISO utility to create teh ISO images?

When the image reboots after etprep, the image on the drive will almost
always BOSD. there is nothing that can be done to the final image. Just
create the final ISO.

Why Taskmanager Shell is behaving differently that Command shell is a bit of
a mistery. I just went through the steps for a customer recently and Command
Shell worked just fine.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Matt Kellner [MS]]

Hi Alexander. I'll try to address your issues below.

First off, if you're using a USB CD-ROM drive for your bootable CD-ROM
device, you will need to ensure that you're using Feature Pack 2007, which
includes support for booting from USB devices. Make sure you include the
"USB 2.0 Boot" component in your runtime, which will bring in all of the
components needed to support this feature.

There should be no particular reason why EWF should fail as it appears to
have here while using the Command Shell. The specific error you encountered
here may have been due to a bad FBA run during a previous runtime setup -
usually you can just redeploy your runtime (or rebuild and redeploy if
necessary), or you can also delete the EWF partition using DISKPART from the
safebuild. The EWF partition is setup during FBA.

As for the failure to swap drive letters: This may have something to do with
the USB support (or lack thereof), since your CD-ROM drive is connected via
USB.

Also, two common causes of drive-letter-swap failure are that the Pre-FBA El
Torito CD wasn't in the drive during FBA *AND* when etprep was run, or that
the Pre-FBA CD was either a different size than the hard drive partition
being processed (500 MB on CD vs. 600 MB on the HDD) or has a different El
Torito signature value (settable in Target Designer - we recommend you leave
it on the default setting).

In the first case above, you need to make sure the Pre-FBA CD is in the
drive right from the start of FBA, and that it remains there until FBA is
finished. You can take the CD out to install software or perform other
operations once FBA is finished, but you'll need to make sure you put it
back in before running etprep -all. This is because etprep scans all of the
devices to find the El Torito volume so it knows which drive letters to
swap. I realize this is an inconvenient process, but it's unfortunately the
way this one works.

As for partition/CD sizes and signatures: Internally, Windows identifies a
volume by both its signature (this gets set during FBA and can be modified
in the El Torito component) and by its partition size. A different
partition size will yield a different overall identifier. During FBA, the
system does a scan of all volumes and records the IDs of the volumes in each
physical device. It will record an entry for the El Torito volume on the
Pre-FBA CD at this time and associate it with the physical CD-ROM device and
its arc path. When you go to swap the drive letters with etprep, this scan
is performed again, and etprep then compares the active partition with the
El Torito volume if it finds one. The IDs have to match between the two in
order for the letter swap to occur - otherwise, the process will fail and
nothing will be swapped. This is why the partition size and signature of
the primary partition have to match those of the Pre-FBA CD. Note that the
Pre-FBA CD does not actually have to be bootable or contain any
information - it just needs to be a clone of the primary partition's layout.

I successfully tested a USB-based El Torito Boot scenario during testing of
Feature Pack 2007, and found that the only additional step in the process
was to make sure the USB 2.0 Boot component and its dependencies were
included in the runtime. I hope all of this helps.

 

[Matt Kellner [MS]]

Sean: Regarding step 4 below: I haven't seen a need to manually issue an
enable command to EWFMGR when running etprep. Etprep takes care of adding
the registry keys needed to run in RAM (Reg) mode and deletes the EWF
volume, negating any changes to EWF's RAM-mode configuration, so that call
to EWFMGR would seem superfluous. Could you briefly explain what that extra
step is about? (Or is it that the extra step was needed in SP1 and is no
longer needed in SP2 and above?)

 

[Sean Liming \(eMVP\)]

Booting from CD-ROM has always been a hit or miss task. FP2007 seems to be
much more stable.
With SP1, I didn't find the need for the EWFNGR step as you pointed out, but
others found it was needed. Creating a bootable CD-ROM with SP2 was much
worse. ETPREP was notworking as expected. Slobodan and others had found all
sorts of tricks with registry keys that had to be done. If you look at the
history, running EWFMGR before ETPREP was part of the solution.

I have kept the EWFMGR step as a legacy. It works, and it it works it
doesn't need to be fixed. The rest of the steps still hold.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[KM]

Sean,

When you say "run EWFMGR c: -enable *before* Etrpep -all" do you mean the same session or with a reboot in between? I can't imagine
a reboot there, though. But I can't see a need for ewfmgr command during one session either.

For me it'd always been more stable to manually delete the MountedDevices key rather then running etprep commands when it comes to
EWF RAM Reg more.

--
=========
Regards,
KM

 

[Sean Liming \(eMVP\)]

Run EWFMGR before ETPREP -all in the same session. It must be done before
you reboot the OS; otherwise you cannot get here from there. Like I said
someone else (I think it was Slobodan) found this trick. I tried it in SP2,
and it worked. The reason you had to delete the keys was because ETPREP did
do it what was suppose to do.

In FP2007, the steps in the book still hold - my only addition is the
EWFMGR. If EWFMGR c: -enable step is not needed, great! One less step out of
the 2 dozen.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[KM]

Sean,

Run EWFMGR before ETPREP -all in the same session. It must be done before you reboot the OS; otherwise you cannot get here from
there.

Yup, this is what I was trying to uncover. Thanks for confirming.

Like I said someone else (I think it was Slobodan) found this trick. I tried it in SP2, and it worked. The reason you had to
delete the keys was because ETPREP did do it what was suppose to do.

Exactly. Etprep (RTM, SP1) wasn't doing that for me (and some others here) so we had to clean the MountedDevices key manually. But
my point was that this was the only trick required.

 

[Sean Liming \(eMVP\)]

Yeah, the problems were all over the place. I could get XPe to boot from CD
on some systems and not others. I even tried the clean registry, but even
that didn't work.

Now that CD-boot seems stable in FP 2007. It would be nice to make the El
Torito driver a non-PnP driver like it was in NT Embedded so we wouldn't
need the Pre-FBA CD. Booting from CD is slow, and with USB boot available, I
am not sure how long CD-Boot will be around.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Alexander]

Hello Sean,

many thanks for your prompt response. I'm very happy to communicate
directly with the author of the book which is the basis of all my XPe
efforts.

Here are the answers to your questions:

1. I use XP embedded SP1 but am preparing for using SP2 in the hope
that my problems are solved then. I don' t know what FP2007 is. From
another answer I got the info that's is the "Feature Pack 2007". I
never heard about that. Is that's still newer than SP2? And where can
I get it? And is this compatible also with SP1 or only with SP2?

2. Yes, the rest of the drive is unpartitioned.

3. Yes, EWF is set to NOT run on start (Start EWF Enable is not
checked)

4. This I have not made because it is not in your book, but I will try
it. Is this step also necessary for SP1?

5. Yes, I used the HD2ISO utilty to create the ISO image.

Regards,

Alexander

 

[Sean Liming \(eMVP\)]

Alexander,

If you read through the posts between KM and myself, there were some issues
with booting from CD-ROM in the earlier releases. Although my steps in the
book worked for me on the target systems that I was using; others were
having some problems. The EWFMGR c: -enable step was something that came out
of the many discusion in the NG. KM mentioned cleaning out some registry
keys. You might want to give that a try as well.

Feature Pack 2007 (FP2007) is the latest release of Windows XPe. It is an
add-on to SP2. I have been working on a project that requires XPe to boot
from CD-ROM and FP2007 seems to be working okay.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Alexander]

Hello Matt,

many thanks for your answer.
I will try SP2 with FP 2007 using the USB 2.0 Boot component to
overcome my problems and then report about it.

About deleting the EWF partition: If I try to delete an EWF partition
by diskpart I always get the error message:
The selected partition may be necessary to the operation of your
computer, and may not be deleted.

I am only able to delete an EWF partition by means of "etprep -delete"

Concerning the Pre-FBA El Torito CD: I always had the CD in the drive
as well during the FBA process as during "etprep -all". I also had not
changed the El Torito signature value. But I must confess that the
image on the CD not always was exactly the same image then that on the
disk. I thought that it was only necessary to have a CD with a ISO9660/
El Torito image on it in the drive during the FBA process to let the
PnP El Torito driver get started and that the exact image was not
relevant So I didn't burn a new CD every time I changed the image for
the next trial to not waste my blank CDs (I get no RW CDs in my
company). If it is absolute necessary for the CD to have always the
exact image as is on the disk for the procedure to succeed then I
think I must organize RW CDs to go further on!

Regards,

Alexander

 

[KM]

Alexander,

Concerning the Pre-FBA El Torito CD: I always had the CD in the drive
as well during the FBA process as during "etprep -all". I also had not
changed the El Torito signature value. But I must confess that the
image on the CD not always was exactly the same image then that on the
disk. I thought that it was only necessary to have a CD with a ISO9660/
El Torito image on it in the drive during the FBA process to let the
PnP El Torito driver get started and that the exact image was not
relevant So I didn't burn a new CD every time I changed the image for
the next trial to not waste my blank CDs (I get no RW CDs in my
company). If it is absolute necessary for the CD to have always the
exact image as is on the disk for the procedure to succeed then I
think I must organize RW CDs to go further on!

You can have any CD in the drive during FBA with El-Torito signature on it.
No reason to refresh the image (content) on that CD.

Regards,
KM

 

[Sean Liming \(eMVP\)]

You can re-use the same Pre-FBA CD. Just one thing to watch out for - the
partition size used to create Pre-FBA El-Torito must be the same size for
the new image. For example, a 600 MB partition was created and the
pre-FBA.ISO was taken from this. When you run FBA, the partition needs to be
the same size 600MB. You must be careful to create the partition the same
way. If the Pre-FBA CD has a 600MB partition and the partiton on the disk
for the new image is some other size, the result will be a CD with
Delayed-write failed errors. I just re-lived this issue again today.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
XP Embedded Book Author - XP Embedded Advanced, XP Embedded Supplemental
Toolkit

 

[Alexander]

Hello,

partial success!
After I had installed XP Embedded SP2 FP 2007 and put the new
component "USB Boot 2.0" in my image, ewfmgr and ewfmgr c: yield the
right informations, especially that the EWF partition has been found,
even without integrating the Task Manager Shell component but instead
taking the Command Shell like in Exercise 17 in Seans book (with the
old Pre-FBA CD in the drive, not corresponding to the exact image on
disk, but still with the right partition size and having been
identified as an El Torito disk!).
And etprep -all no longer displayed the message that the swapping had
been failed.
But the automatic reboot led to a Blue Screen with
STOP: c000021a {Fatal System Error}.

But because this was tolerable as far as I understood some postings
here I went on full of hope. So I booted my target with a Live CD,
generated an ISO9660/El Torito image from the post FBA image on disk
like described in Exercise 17, transferred to a computer with CD
burning software and burnt it to a blank CD. And then I booted from
that CD and ...

.... got a Blue Screen:
STOP: 0x0000007B (0xF7C45528, 0xC0000034, 0x00000000, 0x00000000)
Next trial led to the same BSOD.

What went wrong?

Regards,
Alexander

 

[KM]

Alexander,

partial success!
After I had installed XP Embedded SP2 FP 2007 and put the new
component "USB Boot 2.0" in my image, ewfmgr and ewfmgr c: yield the
right informations, especially that the EWF partition has been found,

Sound like you are using EWF RAM mode.
Why not switch to EWF RAM Reg at the first place? With FP2007 it is goin to be easy and will simplify the process of creating
bootable CD.

even without integrating the Task Manager Shell component but instead
taking the Command Shell like in Exercise 17 in Seans book (with the
old Pre-FBA CD in the drive, not corresponding to the exact image on
disk, but still with the right partition size and having been
identified as an El Torito disk!).
And etprep -all no longer displayed the message that the swapping had
been failed.

At this point can you check if anything changed in HKLM\System\MountedDevices key?
If nothing changed there, can you delete the key before you shutdown the runtime?

But the automatic reboot led to a Blue Screen with
STOP: c000021a {Fatal System Error}.

Scary BSOD. Only thing I suspect you might haven't doen is enabling EWF. Did you do ewfmgr -enable?
Also, can we see your FBALog.txt?

 

[Alexander]

Hello,

Sound like you are using EWF RAM mode.
Why not switch to EWF RAM Reg at the first place? With FP2007 it is goin to be easy and will simplify the process of creating
bootable CD.

First of all I used the EWF component in RAM mode because that is the
way which is described in the book of Sean D. Liming. But I will try
EWF RAM Reg in new trials. But I don't know how to use it. Do I also
need the Enhanced Write Filter component and if yes, how must it be
configured?

At this point can you check if anything changed in HKLM\System\MountedDevices key?
If nothing changed there, can you delete the key before you shutdown the runtime?

I can not make anything at this point because after etprep -all the
system reboots automatically resulting on the reported BSOD. So I
don't have a chance to investigate anything after this call.

Scary BSOD. Only thing I suspect you might haven't doen is enabling EWF. Did you do ewfmgr -enable?
Also, can we see your FBALog.txt?

I have tried to call ewfmgr c: -enable before etprep -all but nothing
has changed. The automatic reboot still lead to BSOD c000021a {Fatal
System Error}.
Here are the relevant parts of fbalog.txt:

01:26:50 - ConfigureEwf() Start.

01:26:51 - Getting EWF config parameters from registry.

01:26:51 - EWF Partition Size = 0 (KBytes), Levels = 1, Volumes = 1.

01:26:51 - Protected Volume Config #0 :

01:26:51 - Disk= 0,Part= 1,Type= RAM.

01:26:51 - Enable= Disabled, Optimize= 0, LazyWrite= N.

01:26:51 - Found 2 Hard Disks.

01:26:51 - Searching for El Torito disk.

01:26:51 - Disk0 signature = 0x760076.

01:26:51 - Disk1 signature = 0x4F544C45.

01:26:52 - Disk1 is an ElTorito disk.

01:26:52 - Checking Start value in System\CurrentControlSet\Services
\redbook key.

01:26:52 - Resetting Start value.

01:26:52 - Checking Start value in System\CurrentControlSet\Services
\Imapi key.

01:26:52 - Resetting Start value.

01:26:52 - Disk #0 layout info:

01:26:52 - PRIMARY partition,start=0x0000000000007e00,
len=0x000000000a06c200, type= 6

01:26:52 - PRIMARY partition,start=0x000000000a074000,
len=0x0000000038436000, type= 14

01:26:53 - FREE partition,start=0x00000000424aa000,
len=0x000000012bed4000, type= 0

01:26:53 - Allocating EWF in PRIMARY partition,
start=0x00000000424aa000, len=0x000000000000fc00.

01:26:54 - Created EWF partition on Disk = 0, partition = 3,size =
0x000000000000fc00 .

01:26:54 - ewfOpen.

01:26:54 - EWF Volume Config on Disk#0, Partition#3:

01:26:54 - Segments = 0, Max Volumes = 1, Max Levels = 1

01:26:54 - ewfAdd.

01:26:55 - Protected Volume Config on Disk0\Partition1 :

01:26:55 - Type = RAM, State= DISABLED.

01:26:56 - ewfClose

01:26:56 - Saving EWF configuration to registry:

01:26:56 - Protected Volume ArcName =
multi(0)disk(0)rdisk(0)partition(1).

01:26:56 - ConfigureEwf() End, status = 0x0.

01:26:56 - [CallEntryPointThread] C:\WINDOWS\system32\ewfdll.dll,
ConfigureEwf
01:26:56 - [FBASetProgressText] Resetting Setup Flag...
01:26:59 - [FBADoProperShutdown] Sleeping...
01:27:09 - [FBADoProperShutdown] Rebooting system...

Regards,
Alexander

 

[Alexander]

Hello,

once again.

In the meantime I tried to use the component EWF RAM Registry SP2.
First problem: If I add the El Torito CD component and make a
Dependency Check, the component Enhanced Write Filter will be added
automatically. If I then add EWF RAM Registry SP2 and make a
Dependency Check, the component Enhanced Write Filter must be
disabled. Ok so far. But if I do this and make a new Dependency Check,
a new component Enhanced Write Filter#2 is automatically generated and
must again be disabled (like the heads of Hydra). The only way to come
out of this is to build an image just after disabling the Enhanced
Write Filter and not to redo the Dependency check although the Build
process recommends this.

Ok, if I copy this EWF RAM Registry - El Torito - Image on my target
disk and boot from this, the FBA process stops without rebooting with
a light blue window. Every explicit reboot do this also. When
analyzing the file fbalog.txt one sees that the last entry is
[FBADoProperShutdown] Exiting process...

The fbalog.txt in the good FBA case goes on with
Configure Ewf() Start

This section is not there.
Also there is an error message in the bad case not occurring in the
good case:
[PnpEnumThread: Install Device} SetupDiCallClassInstaller Error:
0xe0000217, Device: Plug and Play Software Device Enumerator

Regards,
Alexander

 

[KM]

Alexander,

First of all I used the EWF component in RAM mode because that is the
way which is described in the book of Sean D. Liming. But I will try
EWF RAM Reg in new trials. But I don't know how to use it. Do I also
need the Enhanced Write Filter component and if yes, how must it be
configured?
http://msdn2.microsoft.com/en-us/library/ms940182.aspx

I can not make anything at this point because after etprep -all the
system reboots automatically resulting on the reported BSOD. So I
don't have a chance to investigate anything after this call.

You always have a chance to explore your image *offline*. meaning that just shutdonw hte image before it boots again and either -
boot to another OS on the same target or move the hard disk to another machine and explore the content there (better under XP Pro or
similar).
Basically you'd want to load SYSTEM hive (\windows\system32\config\system) in regedit on XP Pro (File-->Load Hive feature) and check
out whatever you want to.

I have tried to call ewfmgr c: -enable before etprep -all but nothing
has changed. The automatic reboot still lead to BSOD c000021a {Fatal
System Error}.
Here are the relevant parts of fbalog.txt:

Looked good to me.
The only thing I can think of is that since you used EWF RAM mode somehow etprep -all didn't do a good job switching to Reg mode
(to get rid of the config partition on the final CD). This is only explanation I can find for the fact that you see BSOD when
rebooting to the image on the same hard drive!

So the cure should be starting off with EWF RAM Reg at the first place. Set it up on the original hard disk first, make sure
everything is working and EWF is ON (you should be able to reboot after etprep there many times with no harm) and then burn CD.

=========
Regards,
KM

 

[KM]

Alexander,

What is the component "EWF RAM Registry SP2" you are referring to?
If you are with FP2007, that's what I thought, you should be using "Enhanced Write Filter" component (it will have the latest
revision of FP2007) and you mustn't disable it. Just make sure to start EWF disabled (clear the checkbox on EWF component settings
page) and you won't get FBA running in a loop.

Here is how you configure EWF RAM Reg mode: http://msdn2.microsoft.com/en-us/library/ms940182.aspx
Here is how you build El-Torito based image: http://msdn2.microsoft.com/en-us/library/ms933139.aspx

Also, just in case, make sure you config includes: "Plug and Play Software Device Enumerator" and "PnP (User mode)" components.