38 replies to this topic

[ChrisR]

SIW2: I've already played with the very good pecmd.
It is a very good PE loader but unfortunately it is in Chinese and since version 3.9.2010.1013 there are in addition the annoying start bar.
I have a doc, a little old, translated into English by Aye Htay.
To continue learning about pecmd, can you share your pecmd.ini.

About switch to Admin account (thanks to Dera), the process is really similar to that of pecmd.
1. Load your display driver and network
2. Switch to admin - (with switch user start menu shortcut) or Automatically (in this case, choose 'Autostart Before Shell' in PENetwork).
3. Switch back to system - (automatically or if needed by using Restart shell as system shortcut in start menu.)
Thanks SIW2 for net stop/start UxSms, I did not have yet in the script.

Anyway: The user switching works but it is a bit long. After the switch, there is no autorun.cmd or RunOnce currently (I believe pecmd allows it more easily)
It is not an ideal solution which would to be able to boot directly in Admin.

For easier use, I modified a bit the script xDisplay

Here are the batch files generated by the script:

SwitchUser.cmd StartMenu shortcut: System Tools\Switch user\Switch user to Admin

@echo off

echo.

ECHO ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿

ECHO ³													  ³Û

ECHO ³   Switch to the Admin user account automatically.	³Û

ECHO ³													  ³Û

ECHO ³   Await the end of Network Startup...				³Û

ECHO ³													  ³Û

ECHO ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙÛ

ECHO ÿ ßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßßß

Echo.

Pause

start /b /wait secedit.exe /configure /db %systemroot%\security\database\unattend.sdb /cfg %systemroot%\security\templates\unattend.inf /log %systemroot%\security\logs\unattend.log

hiderun /w alogon.cmd

tsdiscon.exe

Secedit.exe..... allows to Rename the Administrator Account in Admin (for multilanguage support) without password
the patch Security is in attachment with unattend.inf, unattend.sdb copied in %target_win%\Security

alogon.cmd called by SwitchUser.cmd

reg add "hklm\software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultDomainName" /t REG_SZ /d "Win7pese" /f

reg add "hklm\software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /t REG_SZ /d "Admin" /f

reg add "hklm\software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoAdminLogon" /t REG_SZ /d "1" /f

reg add "hklm\software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultPassword" /t REG_SZ /d "" /f

reg add "hklm\software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "ForceAutoLogon" /t REG_DWORD /d "0x00000001" /f

reg add "hkcu\software\Microsoft\Windows\CurrentVersion\RunOnce" /v "psexec" /t REG_SZ /d "hiderun.exe /w psexec.cmd" /f

psexec.cmd (in RunOnce from alogon.cmd)

tskill explorer

psexec -i -d -s explorer

net stop UxSms

net start UxSms

[SIW2]

Hi Chris,

Sadly it seems lxl has abandoned pecmd project. Hard for me to follow the subtleties in Chinese- but I think he got upset when someone cracked it - allowing to stop the logo, change the icon etc.

That is not necessarily an immense problem - after all peshell is pretty old and still does most things well.

There has been a sort of attempt to put together a new 32 bit version by someone else - he left out a lot of things and put in some new functions which I couldn't understand.

I rely on pecmd for a lot of things - I don't know how do everything it is capable of - but enough to make it extremely useful.

There is really only one 64 bit version available - it works very well , but may set off your a/v.

The basic stuff is pretty simple to do - here is an example ini to load win7 pe, you can easily see what it is doing:

////////////////////////////////////////////////////////////////////////////////////////////////
_SUB OSD
DISP W1024 H768 B32 F60
LOGO %Windir%\Web\Wallpaper\Windows\winpe.jpg
_END
////////////////////////////////////////////////////////////////////////////////////////////////
_SUB OSInit
EXEC winpeshl
TEXT SIW2... WELCOME... L440 T360 R740 B400 $24
EXEC UX.EXE
INIT I
_END
////////////////////////////////////////////////////////////////////////////////////////////////
_SUB Createlnk
LINK %Desktop%\Paragon,x:\Program Files\PAR\Program\launcher.exe,,x:\Program Files\PAR\Program\launcher.ico
LINK %Desktop%\Macrium,x:\Program Files\Macrium\Reflect.exe
LINK %Desktop%\PENetwork,x:\Program Files\PENetwork\PENetwork.exe
LINK %Desktop%\EasyBcd,x:\Program Files\Neosmart Technologies\EasyBcd\EasyBcd.exe
LINK %Desktop%\NT6Repair,x:\Program Files\Neosmart Technologies\EasyBcd\Bin\NT6Repairx86.exe

LINK %StartMenu%\BootTools\BootIce,x:\Program Files\Bootice.exe
LINK %StartMenu%\BootTools\Bcdtool,x:\Program Files\Bcdtool.exe
LINK %StartMenu%\BootTools\MultiBootRepair,x:\Program Files\Neosmart Technologies\EasyBcd\Bin\DualBootRepair.exe
LINK %StartMenu%\BootTools\Nt6Installer,%SystemRoot%\system32\NT6Installer.cmd,,%SystemRoot%\system32\Windows7.ico

LINK %StartMenu%\DataRecovery\Recuva,x:\Program Files\Recuva.exe
LINK %Startmenu%\DataRecovery\PowerDataRecovery,x:\Program Files\PW\PDR.exe
LINK %Startmenu%\Paragon\BootCorrect,x:\Program Files\PAR\Program\bootcorrect.exe,,x:\Program Files\PAR\Program\launcher.ico
LINK %Startmenu%\Paragon\P2PAdjust,x:\Program Files\PAR\Program\P2PAdjust.exe,,x:\Program Files\PAR\Program\launcher.ico
LINK %Startmenu%\Paragon\P2PAnalysis,x:\Program Files\PAR\Program\P2PAnalysis.exe,,x:\Program Files\PAR\Program\launcher.ico
LINK %StartMenu%\Registry\Regscanner,x:\Program Files\Regscanner.exe
LINK %StartMenu%\Registry\ServicesPe,x:\Program Files\ServicesPe.exe
LINK %Startmenu%\MSIscsi,X:\Windows\System32\iscsicpl.exe
LINK %Startmenu%\Gimagex,X:\Program Files\Gimagex.exe
LINK %Startmenu%\MsInfo,%SystemRoot%\system32\Msinfo32.exe
LINK %Startmenu%\MSImageRestore,%SystemRoot%\system32\bmrui.exe
LINK %StartMenu%\MsRecEnvX64,x:\sources\recovery\RecEnv.exe
LINK %StartMenu%\EsetAV,x:\Program Files\ESET\Eset Online Scanner\ESETSmartInstaller.exe
LINK %StartMenu%\PowerIso,x:\Program Files\PowerIso\PowerIso.exe

PINT %SystemRoot%\explorer.exe
PINT %SystemRoot%\regedit.exe
PINT %SystemRoot%\system32\diskmgmt.msc
PINT %SystemRoot%\system32\devmgmt.msc
PINT %SystemRoot%\System32\Services.msc
PINT %SystemRoot%\system32\notepad.exe
PINT x:\Program Files\Ntpwedit.exe
PINT x:\Program Files\Produkey.exe

PINT %SystemRoot%\system32\notepad.exe,Taskband
PINT %SystemRoot%\system32\cmd.exe,Taskband
PINT x:\Program Files\FSC.exe,Taskband
PINT x:\Program Files\Internet Explorer\iexplore.exe,Taskband
PINT x:\Program Files\PW\PartitionWizard.exe,Taskband
//PINT x:\Program Files\PENetwork\PENetwork.exe,Taskband
PINT X:\Program Files\TeamViewerPortable\TeamViewer.exe,Taskband
PINT %SystemRoot%\system32\Hotswap!.exe,Taskband
_END
////////////////////////////////////////////////////////////////////////////////////////////////
_SUB LoadShell
TEXT SIW2 Setting Up... L440 T360 R740 B400 $24
EXEC @!=netcfg.exe -e -c p -i MS_NDISWAN
TEXT SIW2 Installing Drivers... L440 T360 R740 B400 $24
EXEC @!=netcfg.exe -e -c p -i MS_PPPOE
HOTK #95,PECMD.EXE SHUT R
HOTK #255,PECMD.EXE SHUT
CALL $%WinDir%\System32\Macromed\Flash\Flash10l.ocx
FORX %WinDir%\System32\*.ocx,Regocx,0,CALL $%Regocx%
CALL $%WinDir%\System32\SysFxUI.dll
CALL $x:\Program Files\PowerIso\pwrisosh.dll
EXEC =REGEDIT /S %CurDir%\PECUSTOM.REG
TEXT SIW2 Loading Desktop... L440 T360 R740 B400 $24
SHEL %SystemRoot%\explorer.exe
LOGO
_END
////////////////////////////////////////////////////////////////////////////////////////////////
CALL OSD
CALL OSInit
CALL Createlnk
CALL LoadShell
WAIT 1000
TEAM FILE %public%\desktop\desktop.ini|FILE %desktop%\desktop.ini
FILE %AppData%\Microsoft\Windows\Start Menu\Programs\Accessories
DEVI %WinDir%\inf\net*.inf
WAIT 3000
DEVI %WinDir%\inf\hdaudio.inf
////////////////////////////////////////////////////////////////////////////////////////////////////

[SIW2]

Pemd will check the bottom of the ini to see if you are calling any subroutines - otherwise, it will start from the top of the ini and work down - a bit like a batch file.

EXEC is execute, options are run silent !, and wait till it finishes =

For non executables, use the shell execute function $

CALL $X:Program FilesPowerIsopwrisosh.dll is equivalent to regsvr32 "X:Program FilesPowerIsopwrisosh.dll"

You don't use "" with pecmd - delimiter is a comma , not a space

It uses it's own algorithm for installing drivers DEVI

DEVI %WinDir%infnet*.inf

Edited by SIW2, 15 June 2012 - 01:26 PM.

[SIW2]

There are so many great things it can do - a particular favourite is to throw up a message box with MESS command, e.g.

MESS Installing Drivers-Desktop refreshes when done @Self Closes#OK*3000

Even better - throw up yes-no message and pecmd will respond to your answer e.g.

_SUB whatever
MESS Launch Noted now ?@Notepadlaunch ?#YN
FIND $%YESNO%=YES,EXEC NOTEPAD.EXE
_END
CALL whatever

Edited by SIW2, 15 June 2012 - 01:53 PM.

[SIW2]

TEAM command1|command2|command3 etc

don't need to bother with subroutine - just put this in a text file , name it something.ini and load it with pecmd ( for testing you might want to put pecmd on ini openwith list )

MESS Launch Noted now ?@Notepadlaunch ?#YN
FIND $%YESNO%=YES,TEAM EXEC NOTEPAD.EXE|MESS YOU HAVE LAUNCHED NOTEPAD @Done It#OK

Edited by SIW2, 15 June 2012 - 02:02 PM.

[ChrisR]

Hi SIW2,

Shame that lxl abandoned his great project. Certainly the best PE loader currently but unfortunately in Chinese.

Thank you for all this information and your pecmd.ini
If I find time, I'll play around with it again.

Regarding of the w7pese project, I do not think to use it, there would be too many adjustments to make

[SIW2]

You are welcome.

I just changed a win7pese build to use pecmd.exe - very easy to do.

The snag is - you can't use it with peshell or they will fight. ( Of course you don't need peshell at all if you have pecmd)

The other snag is ( for 64 bit ) , it will set off users a/v.

There are 32 bit versions that don't cause any a/v problems,

I will have a look and see if I can find what versions I can dig up.

Are we going way off topic here?

Edited by SIW2, 15 June 2012 - 02:53 PM.

[ChrisR]

Are we going way off topic here?

Yes, I think, a little
but the train is running and there is another thread on TeamViewer active right now.

I just changed a win7pese build to use pecmd.exe - very easy to do.

Yes, manually as I did previously it is not so complicated, I need to learn more about the syntax.
Then for the project, I had already thought but too lazy to do it

The Idea is to make a script in Finals, before postconfig script (only if explorer shell)
With a skeleton for pecmd.ini
And with an au3 program (open source) that will read the config file Win7PE.cfg.
And for each entry convert them into pecmd.ini
[shortcuts] - LINK
[PINTOOL] section - PINT
[autorun] and [postconfig] in EXEC (I'm not sure of the syntax for wait,nowait,hidewait,hidenowait)
[registry] - REGI
[association] - I don't know ?

and also the reading peshell.ini for resolution .DISP W1024 H768 B32 F60

and probably other things like
Drivers - DEVI
Aero theme with TEAM EXEC UX|SHEL %SystemRoot%\explorer.exe
Hotkey - HOTK #95,PECMD.EXE SHUT R //Sleep key to restart
...
Is there a command for cdusb.exe to assign the drive Y in automatic (really convenient) other than EXEC

Shortly: a bit of work to do it automatically
knowing that cdusb + shortcuts + peshell works well.

[SIW2]

Yes, there is something for associate - can't remember but can probably find it.

There is also something to assign letters - I haven't used that myself but have seen one or two others using it - will try and find how it works.

You might find it easier instead of REGI to use

EXEC @REG ADD "hklmsoftwareMicrosoftWindows NTCurrentVersionWinlogon" /v "DefaultDomainName" /t REG_SZ /d "Win7pese" /f

Same with

EXEC @REG DELETE

THEN PECMD JUST USES REG.EXE

PINT pins to start menu by default e.g.

PINT %SystemRoot%system32notepad.exe

For pin to taskbar add ,Taskbar e.g.

PINT %SystemRoot%system32notepad.exe,Taskbar


Our Chinese friends like to have a petools folder somewhere, which they use an ini to hunt for

This kind of thing:
_SUB Loadext
TEXT Link in external program...
TEAM LOAD Z:PE-Toolsext.ini|LOAD Y:PE-Toolsext.ini|LOAD X:PE-Toolsext.ini|LOAD W:PE-Toolsext.ini|LOAD V:PE-Toolsext.ini|LOAD U:PE-Toolsext.ini|LOAD T:PE-Toolsext.ini|LOAD S:PE-Toolsext.ini|LOAD R:PE-Toolsext.ini|LOAD Q:PE-Toolsext.ini|LOAD P:PE-Toolsext.ini|LOAD O:PE-Toolsext.ini|LOAD N:PE-Toolsext.ini|LOAD M:PE-Toolsext.ini|LOAD L:PE-Toolsext.ini|LOAD K:PE-Toolsext.ini|LOAD J:PE-Toolsext.ini|LOAD I:PE-Toolsext.ini|LOAD H:PE-Toolsext.ini|LOAD G:PE-Toolsext.ini|LOAD F:PE-Toolsext.ini|LOAD E:PE-Toolsext.ini|LOAD D:PE-Toolsext.ini|LOAD C:PE-Toolsext.ini
_END


There is also %CurDrv% if that helps

Edited by SIW2, 15 June 2012 - 06:58 PM.

[SIW2]

Sorry , missed the bit about hide and wait

Nohide Nowait : EXEC thing.exe

Hide Nowait: EXEC !thing.exe

No hide Wait: EXEC =thing.exe

Hide Wait: EXEC !=thing.exe

Can associate filetype by putting this in pecmd.ini

EXEC cmd.exe /c assoc .iso=UltraISO

can't recall how to do it the other way.

Also useful is set variable with ENVI e.g.

ENVI MYDRV=Z:

CALL $%MYDRV%\some.dll

Reset it to empty :

ENVI MYDRV=

Edited by SIW2, 15 June 2012 - 07:48 PM.

[SIW2]

I have never used cdusb. Don't you just run it from winpeshl.ini and it sets letter automatically to y?

pecmd exec not working?

perhaps try this in pecmd.ini

exec cmd.exe /c %curdir%cdusb.exe

It might need to be the first entry.

If it needs to wait

exec =cmd.exe /c %curdir%cdusb.exe

[MedEvil]

Nice tip! Thanks.

[SIW2]

Oh yeah , forgot about that, thanks.

@Wimb,

I am having a look at getting wmp12 going in my win7 sp1 build.

Any tips about that?

I can't get the thing to behave yet.