36 replies to this topic

[Sha0]

I did not have a Windows installation on the local HDD, so it's possible that one might be prompted to choose the Windows installation to log into. I will have to test this and if so, provide additional information about how to bypass it. Good point, Wonko. - Sha0

[Wonko the Sane]

I did not have a Windows installation on the local HDD, so it's possible that one might be prompted to choose the Windows installation to log into. I will have to test this and if so, provide additional information about how to bypass it. Good point, Wonko. - Sha0

Already given in the link:
http://www.911cd.net...o...20983&st=25

Basically if the "real" hard disk has no Windows install on it, you are free to do whatever you wish with RC.
If a Windows install is found, RC will read the two keys in the Registry of the install(s) it can find and prompt you to choose which install to "connect" to.
Since 99,99% of people wouldn't think about it, the two keys are in 99,99% of the cases set:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=0

which DISABLES the SET command and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=0

which asks for the password of the install.

The "no more CATCH 22" trick simply creates on the same media RC is, a "fake" Windos install, which you can choose to "connect to" and makes you "free of the restrictions", allowing you to copy files and access paths.

The problem is the media on which RC is, for the fake windows install the media has to be detected as a HD like device (hence the question about map and map arc): I doubt that the trick will work with this "from network" boot.


Wonko

[Sha0]

Ok, I can think of two solutions for this.

1. A way to embed an HDD image in WinVBlock. The embedded image could then have a spoof Windows installation on it for logging into.
2. The rather complicated:

NIC PXE -> PXELINUX (pxelinux.0)
PXELINUX loads its config-file

DEFAULT cmdcons_smb

LABEL cmdcons_smb

  COM32 ifmemdsk.c32

  APPEND have_memdisk need_memdisk

LABEL need_memdisk

  KERNEL memdisk

  INITRD spoofwin.hdd keeppxe

LABEL have_memdisk

  PXE startrom.0

where SPOOFWIN.HDD has the "catch 22" spoofing on it, as well as SYSLINUX installed with the following config-file:

DEFAULT redo_pxe

LABEL redo_pxe

  KERNEL undionly.krn

where UNDIONLY.KRN is gPXE's undionly.lkrn build target, which would then loop back to PXELINUX. The second time around, IFMEMDSK.C32 would see that there's a MEMDISK established and chain to Windows' STARTROM.0. With WinVBlock added to the mix, WinVBlock would provide the spoofing HDD to the Recovery Console, who would then offer it as a possible Windows installation to log on to.

I'll have to code IFMEMDSK.C32, which could be useful for other "establish MEMDISK then loop back to a boot menu/choices" scenarios. Also possibly useful might be the experimental MEMDISK.C32...

[Wonko the Sane]

It seems to me like nice.

The smallest I could get the SOFTWARE hive was 8192 bytes, how small can the HD image be?
The config file can stay in 512 bytes.
How much is it needed for syslinux?

I could prepare a "default" minimal image.


Wonko

[Sha0]

Good day Wonko,

I'm still working on IFMEMDSK.C32 for Syslinux but won't trouble you for a special minimal image, since I'm familiar with your instructions for what's required. I'll post again when I've got it ready for download.

[Brito]

Hi Sha0,

I liked your tutorial:
http://www.boot-land...?...ost&p=95985

Can you repeat it on a separate post to keep inside the tutorials section for future reference?

Thank you.

[Wonko the Sane]

Can you repeat it on a separate post to keep inside the tutorials section for future reference?

I don't know, wouldn't it be better to make a video of it?

BTW, this time seriously, maybe we should have a bifurcation of the section.
Tutorials->Textual
Tutorials->Videos


Wonko

[RulerOf]

Shao,

I followed your guide, but much to my dismay I'm a little stuck.

I tried modifying the WINNT.SIF and the TXTSETUP.SIF files in the NetXP and i386 folders to include /debug and attached WinDBG to it, but couldn't get any info.

Any idea why I'm stuck here?



I used an XP Pro SP3 OEM disk as the source (retail disk from MSDN that I modded to do OEM reinstalls) because the ISO was handy. Everything else was prepared on an XP SP2 and then SP3 machine, but the same result with each source.

Happens with both rom based gPXE and native Intel PXE. Chainloaded gPXE, oddly, seems to make startrom.0 crash. Not sure why though

Aside, excellent work! And, hope you're well

-RulerOf

[RulerOf]

Any idea why I'm stuck here?

Ah HAH!

With special thanks to the fellow who posted [url="http://"http://forums.techarena.in/windows-xp-support/71497.htm#post318514"]this.[/url]

Though I had added NetXP to the null shares list, other security settings were preventing ANONYMOUS LOGON access to the share.

1) Ensure that the Guest account is enabled on the machine.
2) Ensure that the Guest account isn't denied access from the network.

Change these under the security options in the local machine policy editor (Start > Run > gpedit.msc).

Both of these were true in my setup, and TFTP got it as far as that screenshot, but SMB was necessary for everything after that point. The tip-off was that \\Server\NetXP was still asking for a password in spite of the fact that it was added as a null session share.

Time to play now



-RulerOf

[Wonko the Sane]

The link in the above post is not valid, here is the correct one:
http://forums.techar....htm#post318514


Wonko

[Sha0]

...Can you repeat it on a separate post to keep inside the tutorials section for future reference?...

Absolutely. Here it is: http://www.boot-land...showtopic=11084

[Sha0]

Good day Wonko,

I'm still working on IFMEMDSK.C32 for Syslinux but won't trouble you for a special minimal image, since I'm familiar with your instructions for what's required. I'll post again when I've got it ready for download.

Oops. Uhh... I guess this never got completed. When it does, I'll put it here.