5 replies to this topic

[meoit]

Hello all.

 

Today, I have a question.

 

How to change the path boot.ini of NTLDR in Windows XP?.

 

Normal, Boot.ini located in C:\

 

Now, I want custom to C:\MyPath\Boot.ini

 

So, this is possiable?.

 

Thanks.

[Wonko the Sane]

Not really, unless you hack the NTLDR.

What you can try doing is to plainly hex-edit it, BUT you need to stay within the \BOOT.INI length, a similar approach works/worked in some tests, but needs to be confirmed, please remember that some versions of NTLDR have a checksum.

Something *like*

\1234\bi

might do, see:
http://www.msfn.org/...can-be-omitted/
Only seemingly unrelated:

http://www.911cd.net...showtopic=24649

http://reboot.pro/to...lash-drive-ufd/

 

 

Wonko

[meoit]

Thanks Wonko!.

 

But "\MyPath\Boot.ini" string length = 16

and "\boot.ini" string length = 9

 

Not equal :|

 

How can I increase string length by using HexEditor/ HxD / Hex WorkShop?.

[Wonko the Sane]

Thanks Wonko!.

 

But "\MyPath\Boot.ini" string length = 16

and "\boot.ini" string length = 9

 

Not equal :|

 

How can I increase string length by using HexEditor/ HxD / Hex WorkShop?.

 

EXACTLY.

 

EITHER:

You "plainly hex edit" the NTLDR with HexEditor/HxD/Hex Workshop (relatively easy but "limited" to the 9 characters of "available space").

OR:

You "hack" the NTLDR i,e, you disassemble/reverse engineer the NTLDR, find pointers to that string, create a "code cave" of some kind or move the pointers to an existing one, and re-build the NTLDR

 

The latter more or less equates to "don't EVEN THINK of attempting this", after several hours, days, weeks of banging your head against the problem, you won't make it anyway .

 

Wonko

[meoit]

Thanks Wonko

 

So, how to I can disassemble / reverse engineer NTLDR ?.

[Wonko the Sane]

You would probably start here:

http://reboot.pro/to...disksys-xp2003/
https://codywu2010.w...ldr-first-part/

http://www.reteam.or...hread.php?t=323

http://standa-note.b...of-windows.html

but where exactly (and when) you will arrive is to be seen.

Without being VERY familiar with the theory of operation and with the specific tools needed it will be a loong journey, as you will need to learn (and learn quickly) quite a few things.

 

Wonko