1396 replies to this topic

[wimb]

The Main menu is not working either.

Scripting for *.grub2 does not work because there is no regexp module loaded, so the script cannot find any files.

 

if exist  fred.grub2   will work, but if exist *.grub2 does not work.

 

OK, so it is not simple to make it working ....

 

It is a pity, since you are so close to having UEFI Secure support for your program.

 

How to make Ubuntu Or Linux ISO booting with persistence support without using extraction of the ISO ? Is it possible ?

[steve6375]

I have managed to make it work by hard-coding the paths to the .grub2 configuration files.

So the .grub2 menu files must be named

antivirus_menu.grub2

backup_menu.grub2

linux_menu.grub2

security_menu.grub2

utilities_menu.grub2

or

custom_menu.grub2 through to custom5_menu.grub2 which can be added by the user.

 

The user can add more .grub files by adding a source command

e.g. /_ISO/MAINMENU/grub2/custom_menu.grub can use

 

source $isofpath/user1.cfg

 

to load more menus.

 

I will tidy it up and test some more before uploading a new version in a day or two.

 

 

[wimb]

That sounds great. Nice to hear that a solution  will be possible 

[steve6375]

yes, persistence is possible for many linux versions as long as they support the needed kernel parameters.

[wimb]

yes, persistence is possible for many linux versions as long as they support the needed kernel parameters.

 

Thanks, I just realised Ubuntu and Linux Mint ISO with persistence using your Make_Ext.exe program to create the casper-rw file with ext3 filesystem. 

[steve6375]

Beta10 of the grub2 menu system is now available.

https://rmprepusb.bl...a10-is-now.html

http://www.easy2boot...efi-grub2-ptn2/

[wimb]

Beta10 of the grub2 menu system is now available.

https://rmprepusb.bl...a10-is-now.html

http://www.easy2boot...efi-grub2-ptn2/

 

Thanks, Perfect ! 

 

UEFI Secure booting with Grub2 is working OK 

 

ubuntu.iso  and  linuxmint.iso and knoppix.iso are all three booting in UEFI Secure mode from Main Menu

 

[Wonko the Sane]

Thanks, Perfect ! 

 

UEFI Secure booting with Grub2 is working OK 

 

ubuntu.iso  and  linuxmint.iso and knoppix.iso are all three booting in UEFI Secure mode from Main Menu

 

Good.   

So we can officially start calling it "insecure boot", the only thing that may keep the evil maid    out of your precious files is back to "disallow booting from external media AND password protect the BIOS, pardon UEFI".

 

Wonko

[steve6375]

TBH - I don't understand why it (grub2) can be allowed to boot unsigned files!

 

It seems to allow the linux command after a secure boot. I thought only the linuxefi command would be allowed which checks for secure boot efi files.

 

It boots clonezilla and gparted with no problem too!

[wimb]

TBH - I don't understand why it (grub2) can be allowed to boot unsigned files!

 

It seems to allow the linux command after a secure boot. I thought only the linuxefi command would be allowed which checks for secure boot efi files.

 

It boots clonezilla and gparted with no problem too!

 

Good to hear about it 

 

Life is much easier now for Multi-booters .....

 

And such solution is needed since in real life you encounter quite often (and sometimes only) UEFI Secure booting computer

 

However, I can say that bootx64.efi + grubx64.efi signed files of Ubuntu don't support all these ISO's

 

It is the Grub2 files of Linux Mint that opens Pandora's box ....

[steve6375]

Well, Pandora's box has indeed been opened and now cannot be closed!

grub2 can now load pretty much anything from ext2 or FAT volumes on a Secure Boot.

How long will it take Microsoft to realize it...?

Looks like BitLocker is a must now since Secure Boot is completely useless.

So malware could replace the EFI boot files with these files plus a small OS on the EFI partition (or KonBoot) and it would still secure boot to God knows what!

[wimb]

Well, Pandora's box has indeed been opened and now cannot be closed!

grub2 can now load pretty much anything from ext2 or FAT volumes on a Secure Boot.

How long will it take Microsoft to realize it...?

Looks like BitLocker is a must now since Secure Boot is completely useless.

So malware could replace the EFI boot files with these files plus a small OS on the EFI partition (or KonBoot) and it would still secure boot to God knows what!

 

Yes, but booting from USB-Stick made with Microsoft MediaCreationTool offers already easy acces to your internal harddisk when BitLocker is not used.

 

[steve6375]

Well, if you have physical access, you can boot to Ubuntu or many other signed OS's and do anything.

But now we don't need physical access as it can Secure Boot from the internal hard disk...

Say we have a Windows system which runs a virus\malware (e.g. you open an attachment in an email) which can replace the EFI boot files with this grub2 which could then run any sort of unsigned mini OS root kit code which could log passwords, or infect unencrypted Windows files on NTFS partitions, or just encrypt the drive and ask for a ransom, etc. - all with Secure Boot enabled in the BIOS and no physical access required.

[wimb]

You are right.

 

Houston we have a problem ....

[steve6375]

E2B v1.A9e Beta can now directly boot from an unmodified Windows NT6-based (Vista to SVR2019) ISO and then load the same ISO into WinNTSetup ready for you to deploy. This means you can MBR boot from a Windows ISO and do a GPT\UEFI install to the target disk without needing to boot via UEFI or using .imgPTN files on the E2B drive.

 

You can even make an install batch file yourself to run a diskpart script first and then launch WinNTSetup with any parameters you wish.

 

https://rmprepusb.bl...-available.html

[steve6375]

So you are using the standard NTFS IODD firmware and you have formatted the disk as NTFS?

[steve6375]

Did you reset the IODD? It may be trying to load a specific ISO which was on the previous drive because it remembers the previous payload files and always tries to reload them on power on, so you must reset it.

https://www.rmprepus...tutorials/ve200

 

If you fiddled with the firmware 'months ago' are you sure you didn't leave it with exFAT firmware?

 

If that does not work, go back to basics.

Format the USB drive using Windows as a Primary NTFS partition and make a \_ISO folder and copy over a iso file.

Make sure the disk is in MBR format by using diskpart  convert MBR.

[steve6375]

Glad I could help.

The latest E2B v1.A9 Beta adds useful new features for IODD such as extension overrides.

http://www.easy2boot...ognised-by-e2b/

http://www.easy2boot...a-zalman-ve200/

[steve6375]

https://rmprepusb.bl...ith-refind.html

 

Latest E2B and MPI Tool Kit now allows you to select and boot UEFI-bootable images on UEFI-only systems without needing to boot in CSM mode first or use Easy2Boot.

[Alhaitham]

Thanks a lot for this great tool.

[Rootman]

Steve, thanks for the update, I've been wanting a tool to do what E2B does but with EFI and this looks like it.

 

I'm working through the winbuilder to try and get the miniwinpe now.  Any guidlines on what packages to choose and what to disable? 

[steve6375]

Link is in this blog article

https://rmprepusb.bl...ith-refind.html

 

 

at very bottom of page.