Jump to content











Photo
- - - - -

McAfee Wintech/EETech on Vista PE


  • Please log in to reply
26 replies to this topic

#1 Stu

Stu
  • Members
  • 4 posts
  •  
    United Kingdom

Posted 07 January 2011 - 04:36 PM

Hi,

I am trying to get McAfee EETech (prev. wintech) to work in VistaPE using Wintech. I have tried converting BartPE inf files but there are issues with drivers. Someone has got it to work in VistaPE using WAIK and a batch file. Can anyone give me any clues how to make this into a WinPE .script file? I'm lost.

So the functional bit of the batch file goes:

echo %time% SCRIPT - Inject Drivers
rem This section shows how you can inject new drivers into the image as we go. Just put
rem in the Support Files_v6/Drivers directory.

for /d %%l in ("Support Files_v6\includedrivers\*.*") do (for %%q in ("%%l\*.inf") do peimg /inf="%%q" "%wtpath%\mount\Windows")


echo %time% SCRIPT - Get additional Fonts
for Workspace Support

copy "%windir%\Fonts\cour*.*" "%WTPath%\mount\Windows\fonts"

echo %time% SCRIPT - Get additional tools etc
for %%l in (regedt32.exe wdi.dll) do copy "%windir%\System32\%%l" "%WTPath%\mount\Windows\system32"

echo %time% SCRIPT - Overlay for Program files, Windows and System32
xcopy "Support Files_v6\Program Files" "%WTPath%\mount\Program Files" /e /y /i
xcopy "Support Files_v6\Windows" "%WTPath%\mount\Windows" /e /y /i


echo %time% SCRIPT - Adding Registry Settings
reg load hklm\SafeBoot "%WTPath%\mount\windows\system32\config\system"
reg import "Support Files_v6\registry changes.reg"
reg unload hklm\safeboot

echo %time% SCRIPT - Removing Startnet.cmd
del "%WTPath%\mount\Windows\system32\startnet.cmd"

echo.
echo %time% SCRIPT - Commit Changes, unmount and create CD on your ok.
echo You can use this time to make last minute changes to the CD image before
echo it gets finalized.
echo.
echo you can find the image at "%WTPath%\mount"
echo.
pause
imagex /unmount "%WTPath%\mount" /commit

echo %time% SCRIPT - Changing Boot File
copy "%WTPath%\winpe.wim" "%WTPath%\ISO\sources\boot.wim"

echo %time% SCRIPT - Creating an ISO CD Image
oscdimg -n -b"%WTPath%\etfsboot.com" "%WTPath%\iso" "%WTPath%\WinTech.iso"

goto terminate

:terminate
echo %time% SCRIPT - Finished.


---

The reg file is the following:



Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\safeboot\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}]
"UpperFilters"=hex(7):50,00,61,00,72,00,74,00,4d,00,47,00,52,00,00,00,4d,00,66,00,65,\
00,45,00,70,00,65,00,50,00,63,00,00,00,00,00

[HKEY_LOCAL_MACHINE\safeboot\ControlSet001\Services\MfeEpEPc]
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000003


[HKEY_LOCAL_MACHINe\safeboot\ControlSet001\Enum\Root\LEGACY_TCPIPREG]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINe\safeboot\ControlSet001\Enum\Root\LEGACY_TCPIPREG\0000]
"Service"="tcpipreg"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000020
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="TCP/IP Registry Compatibility"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINe\safeboot\ControlSet001\Enum\Root\LEGACY_TCPIPREG\0000\Control]
"ActiveService"="tcpipreg"

[HKEY_LOCAL_MACHINe\safeboot\ControlSet001\Services\tcpipreg]
"DisplayName"="TCP/IP Registry Compatibility"
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,74,00,63,00,70,00,69,00,70,00,72,\
00,65,00,67,00,2e,00,73,00,79,00,73,00,00,00
"Description"="Provides compatibility for legacy applications which interact with TCP/IP through the registry. If this service is stopped, certain applications may have impaired functionality."
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000001
"DependOnService"=hex(7):74,00,63,00,70,00,69,00,70,00,00,00,00,00

[HKEY_LOCAL_MACHINe\safeboot\ControlSet001\Services\tcpipreg\Enum]
"0"="Root\\LEGACY_TCPIPREG\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001


The rest is just flat files as far as I can tell, which could be put in a /files folder under the app/eetech dir in winbuilder.

If anyone could help it would be much appreciated, I'll upload it and make it available if it ever works.

Thanks!
Stu.

#2 Api

Api
  • Members
  • 9 posts
  •  
    Germany

Posted 07 January 2011 - 08:39 PM

Hi,

what version of McAfee EEPC you try to get work? EEPC v5 (Wintech) or EEPC v6 (EETec)?

i already wrote a script for v5 and VistaPE but there is a big bug from Wintech: if you use a PE based on Vista or Win7 and authenticate with Wintec, it will destroy the local Database from EEPC

please read this Post AND THE COMMENTS: http://simonhunt.wor...intech-and-pe3/

i don't use v6 so i don't know if the bug is there too. If you want, i can post my script


i hope you can understand my bad english :/

#3 sbaeder

sbaeder

    Gold Member

  • .script developer
  • 1338 posts
  • Location:usa - massachusettes
  •  
    United States

Posted 07 January 2011 - 08:52 PM

Hi,

I am trying to get McAfee EETech (prev. wintech) to work in VistaPE using Wintech. I have tried converting BartPE inf files but there are issues with drivers. Someone has got it to work in VistaPE using WAIK and a batch file. Can anyone give me any clues how to make this into a WinPE .script file? I'm lost.

Well, the "clues" are mostly in the help files and existing scripts and the tutorial section in the winbuilder forum...But starting out it can be a bit overwhelming...

So the functional bit of the batch file goes:

In general, the project (and right up front, I'll add as disclaimer - I don't know the specifics of the VistaPE project) is going to some of the work for you as far as mounting the images, etc.

echo %time% SCRIPT - Inject Drivers
rem This section shows how you can inject new drivers into the image as we go. Just put
rem in the Support Files_v6/Drivers directory.

for /d %%l in ("Support Files_v6\includedrivers\*.*") do (for %%q in ("%%l\*.inf") do peimg /inf="%%q" "%wtpath%\mount\Windows")

This looks like it is using the "peimg" tool to inject the drivers. In the Win7PE_SE project, there is a "dism" script that does something similar, so if it was only the drivers, you might check to see if the project already has a way to do this...

echo %time% SCRIPT - Get additional Fonts
for Workspace Support

copy "%windir%\Fonts\cour*.*" "%WTPath%\mount\Windows\fonts"

many project have a checkmark to copy fonts, but in general, this could be done with a few copy commands. A good source of online help is the manual, and also the "magic wand"...here, they are just doing a copy out of the "source" into the target (which they mounted)

echo %time% SCRIPT - Get additional tools etc
for %%l in (regedt32.exe wdi.dll) do copy "%windir%\System32\%%l" "%WTPath%\mount\Windows\system32"

Same here...

echo %time% SCRIPT - Overlay for Program files, Windows and System32
xcopy "Support Files_v6\Program Files" "%WTPath%\mount\Program Files" /e /y /i
xcopy "Support Files_v6\Windows" "%WTPath%\mount\Windows" /e /y /i

and here...

echo %time% SCRIPT - Adding Registry Settings
reg load hklm\SafeBoot "%WTPath%\mount\windows\system32\config\system"
reg import "Support Files_v6\registry changes.reg"
reg unload hklm\safeboot

Here is just the same sort of thing could be done using the winbuilder commands to write the files (on a section by section basis) to the new hives being constructed...again, look at example scripts

echo %time% SCRIPT - Removing Startnet.cmd
del "%WTPath%\mount\Windows\system32\startnet.cmd"

Not sure why they are removing this, but you could write the same sort of scripting to see if that files existed, and if so, remove it

echo %time% SCRIPT - Commit Changes, unmount and create CD on your ok.
echo You can use this time to make last minute changes to the CD image before
echo it gets finalized.
echo.
echo you can find the image at "%WTPath%\mount"
echo.
pause
imagex /unmount "%WTPath%\mount" /commit

echo %time% SCRIPT - Changing Boot File
copy "%WTPath%\winpe.wim" "%WTPath%\ISO\sources\boot.wim"

All this is typically done in the "finalize" scripts, before making the media (ISO or USB), which is what the rest of their script is doing...

As I said, not familiar with the variables and so on used by VistaPE, but if you run the project once, and look at the log, you will get a better feel for some of it, and also look at the existing scripts using the built-in editor and it's "magic wand" (which has templates for the syntax), and the scripting tutorials, which give a high level overview of things.

Good Luck, and I'm pretty sure others (more knowledgeable than I) will also chime in.

[edit - added]
From looking at a forum posting, which linked to the scripting, AND now understanding what this is, and why you need drivers (to decrypt the disk!), I think that the big issue is adding the drivers, and that could be as easy as looking at the project to see if they have a way to do that (peimg was the way it was done in vista - now in win7's PE, it's DISM, but same idea)...so concentrate on that aspect of it!

#4 Api

Api
  • Members
  • 9 posts
  •  
    Germany

Posted 07 January 2011 - 10:11 PM

ok, i took a litte look at the orginal script from simon where your batch and reg are from and it's pretty easy:

copy all files to the right folder (only the EEPC related files are needed) and add the following reg-entries:


[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}]

"UpperFilters"=hex(7):50,00,61,00,72,00,74,00,4d,00,47,00,52,00,00,00,4d,00,66,00,65,\

00,45,00,70,00,65,00,50,00,63,00,00,00,00,00



[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MfeEpEPc]

"Type"=dword:00000001

"Start"=dword:00000000

"ErrorControl"=dword:00000003


the only driver you need is MfeEpePc.sys, copy them to sys32\drivers, this is a filesystem driver - no need for peimg

all the other stuff is not needed for vistape or win7pe


Edit:
here the ready script:

[Main]

Title=EETech

Description=

Selected=False

Level=5

Version=001

Author=Api

Date=07.01.2011

Info=



[Variables]

%ProgramFolder%=EETech

%ProgramEXE%=EETech.exe

%ProgramTitle%=EETech



[Process]

Echo,Processing %ProgramTitle%...

StrFormat,filename,%Scriptdir%,%scriptfolder%

RunFromRam,%pCheckBoxRunRam%

CopyProgram,%ScriptDir%\EETech\Programfiles

//

//Add_Shortcut,[Type],[Folder],[FullFileName],[Title],[Work Folder],[Parameters],[IconFile( .ico .exe)],[StartMode(1, 2, 3, or 4)]

If,%pCheckBoxStartMenu%,Equal,True,Add_Shortcut,StartMenu,%pTextBoxStartFolder%,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

If,%pCheckBoxDesktop%,Equal,True,Add_Shortcut,Desktop,,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

If,%pCheckBoxQuickL%,Equal,True,Add_Shortcut,QuickLaunch,,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

//

FileCopy,"%ScriptDir%\EETech\System32\*.*","%TargetDir%\Windows\System32"

Hive_Load,System

reg_add,0x7,"%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}","UpperFilters","PartMGR","MfeEpEPc"

reg_add,0x4,"%reg%\ControlSet001\Services\MfeEpEPc","Type","1"

reg_add,0x4,"%reg%\ControlSet001\Services\MfeEpEPc","Start","0"

reg_add,0x4,"%reg%\ControlSet001\Services\MfeEpEPc","ErrorControl","3"

Hive_Unload,System



[Interface]

pBevelShortcuts=pBevel1,1,12,6,6,395,170

pTextBoxStartTitel="Name for Shortcuts:",1,0,20,40,200,18,%ProgramTitle%

pTextBoxStartFolder="Start Menu folder:",1,0,20,90,200,21,%scriptfolder%

pTextLabeShortcutsTo="Add shortcuts to:",1,1,260,20,135,20,8,Normal

pCheckBoxStartMenu="Start Menu",1,3,260,50,200,20,True

pCheckBoxDesktop="Desktop",1,3,260,70,200,20,False

pCheckBoxQuickL="QuickLaunch",1,3,260,90,200,20,False

pCheckBoxRunRam="Run from ram (boot.wim)",1,3,20,141,183,18,False




copy everything from the folder where eetech.exe located is to <scriptfolder>\eetech\programfiles, the safeboot-folder to <scriptfolder>\eetech\system32 (i am not shure if this folder is realy needed) and MfeEpePc.sys to <scriptfolder>\eetech\system32\drivers

Edited by Api, 07 January 2011 - 10:42 PM.


#5 Stu

Stu
  • Members
  • 4 posts
  •  
    United Kingdom

Posted 10 January 2011 - 11:12 AM

Thanks very much for all your help here guys.

Lost my access for the weekend but I'll give it a bash now.

I'm amazed what a full response you have given.

I'll report back shortly....

It is building now, this is a black art I think, no matter what I tried when it came to build time there where two app folders in the tree on the left, one containing eetech, the other containing the rest. With yours it is in the App folder, and has shortcut options.

Edited by Stu, 10 January 2011 - 11:22 AM.


#6 Stu

Stu
  • Members
  • 4 posts
  •  
    United Kingdom

Posted 10 January 2011 - 02:18 PM

Well,

That all seems to work, I can boot up and load the program, and no errors about missing drivers. I'll encrypt the laptop and see if the bug exists that you mentioned (these are just test machines), and yes this is v6 that I'm playing with.

Thanks so much for your help. If I test it and it all works where is the best place to put the files? It is 3.3 MB zipped.

#7 Api

Api
  • Members
  • 9 posts
  •  
    Germany

Posted 10 January 2011 - 05:53 PM

:( no prob, i'm looking forward to the result

If I test it and it all works where is the best place to put the files? It is 3.3 MB zipped.

i'm not shure if it's ok to do that because eepc is no freeware and i don't know where, if you upload it to a one-click-hoster it will be offline in short time

btw: i hate eepc v5 - sooo many bugs :wodoo: how is v6?

#8 Stu

Stu
  • Members
  • 4 posts
  •  
    United Kingdom

Posted 12 January 2011 - 03:58 PM

Well it worked!

Successfully removed the encryption and encryption software (authenticated from machine recovery information, now in xml format not sbd). Tested the workspace but not the MBR restore.

v6 looks the same as v5 , but things do seem to work from a DR point of view.

I got the files myself from http://sites.google....te/ctogonewild/ and they seem to get away with it :thumbsup:

So to get the whole thing working with that link and your script shouldn't be too much of a challenge when coupled with this forum topic.

So to be clear:

1. Download the MakePECD2v6.zip from http://sites.google....ntersting-files

2. Create a folder for eetech under Winbuilder\Projects\VistaPE-CAPI\Apps\ (for the purposes of the following Steps I called it EERecovery)

3. Open notepad and copy and paste the following:

[Main]

Title=EETech

Description=

Selected=False

Level=5

Version=001

Author=Api

Date=07.01.2011

Info=



[Variables]

%ProgramFolder%=EETech

%ProgramEXE%=EETech.exe

%ProgramTitle%=EETech



[Process]

Echo,Processing %ProgramTitle%...

StrFormat,filename,%Scriptdir%,%scriptfolder%

RunFromRam,%pCheckBoxRunRam%

CopyProgram,%ScriptDir%\EETech\Programfiles

//

//Add_Shortcut,[Type],[Folder],[FullFileName],[Title],[Work Folder],[Parameters],[IconFile( .ico .exe)],[StartMode(1, 2, 3, or 4)]

If,%pCheckBoxStartMenu%,Equal,True,Add_Shortcut,StartMenu,%pTextBoxStartFolder%,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

If,%pCheckBoxDesktop%,Equal,True,Add_Shortcut,Desktop,,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

If,%pCheckBoxQuickL%,Equal,True,Add_Shortcut,QuickLaunch,,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

//

FileCopy,"%ScriptDir%\EETech\System32\*.*","%TargetDir%\Windows\System32"

Hive_Load,System

reg_add,0x7,"%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}","UpperFilters","PartMGR","MfeEpEPc"

reg_add,0x4,"%reg%\ControlSet001\Services\MfeEpEPc","Type","1"

reg_add,0x4,"%reg%\ControlSet001\Services\MfeEpEPc","Start","0"

reg_add,0x4,"%reg%\ControlSet001\Services\MfeEpEPc","ErrorControl","3"

Hive_Unload,System



[Interface]

pBevelShortcuts=pBevel1,1,12,6,6,395,170

pTextBoxStartTitel="Name for Shortcuts:",1,0,20,40,200,18,%ProgramTitle%

pTextBoxStartFolder="Start Menu folder:",1,0,20,90,200,21,%scriptfolder%

pTextLabeShortcutsTo="Add shortcuts to:",1,1,260,20,135,20,8,Normal

pCheckBoxStartMenu="Start Menu",1,3,260,50,200,20,True

pCheckBoxDesktop="Desktop",1,3,260,70,200,20,False

pCheckBoxQuickL="QuickLaunch",1,3,260,90,200,20,False

pCheckBoxRunRam="Run from ram (boot.wim)",1,3,20,141,183,18,False


Save this as eetech.script in the EERecovery folder you just created.

4. Create a subfolder in EERecovery called "eetech", and then create two subfolders in eetech called "Programfiles" and "system32"

5. Extract the \Support Files_v6\Windows\System32\Drivers and \Support Files_v6\Windows\System32\Safeboot folders from MakePECD2v6.zip to the EERecovery\eetech\system32 folder.. IMPORTANT - Do not copy the files in \Support Files_v6\Windows\System32 or your Vista PE will fail to load. (I tried to take that shortcut).

6. Extract all folders in the Support Files_v6\Program Files\McAfee\Endpoint Encryption for PC v6\ from MakePECD2v6.zip to the EERecovery\eetech\Programfiles folder

That's it, you now have EEPC v6 in a VistaPE CD, made with Winbuilder.

Big Kudos here to Api who made this possible and simon for the original script.

I would highly recommend you then make this into a bootable USB stick (instructions everywhere - google is your friend)., so that you can authenticate from file by simply extracting the recovery xml from ePO and dumping it on the USB stick.

I hope someone can make some use of this... Just another use for VistaPE!

Stu.

Edited by Stu, 12 January 2011 - 04:31 PM.


#9 m3fan

m3fan

    Member

  • Members
  • 32 posts
  •  
    United States

Posted 04 April 2011 - 10:33 PM

Thank you all for the great instructions. I was able to get the script to work with EEtech. I wanted to attach the working plugin here if someone needs it, but i cant find the right button for that, LOL.

I was also trying to get the old WinTech 5.2 to work the same way and it works for the most part as far as adding the program and shortcut, but it says the driver is not loaded when I try to authenticate. Any guidance on that one? Thanks

Here is what i came up with:

[Main]

Title=SafeBoot

Description=Safeboot Recovery

Selected=True

Level=5

Version=001

Author=

Date=04.04.2011

Info=



[Variables]

%ProgramFolder%=safeboot

%ProgramEXE%=SbWinTech.exe

%ProgramTitle%=SafeBoot



[Process]

Echo,Processing %ProgramTitle%...

StrFormat,filename,%Scriptdir%,%scriptfolder%

RunFromRam,%pCheckBoxRunRam%

CopyProgram,%ScriptDir%\safeboot\Programfiles

//

//Add_Shortcut,[Type],[Folder],[FullFileName],[Title],[Work Folder],



[Parameters],[IconFile( .ico .exe)],[StartMode(1, 2, 3, or 4)]

If,%pCheckBoxStartMenu%,Equal,True,Add_Shortcut,StartMenu,



%pTextBoxStartFolder%,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,



%pTextBoxStartTitel%

If,%pCheckBoxDesktop%,Equal,True,Add_Shortcut,Desktop,,%PE_Programs%\



%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

If,%pCheckBoxQuickL%,Equal,True,Add_Shortcut,QuickLaunch,,%PE_Programs



%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitel%

//

FileCopy,"%ScriptDir%\safeboot\System32\*.*","%TargetDir%\Windows\System32"



Hive_Load,System

reg_add,0x7,"%reg%\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}","UpperFilters","PartMGR","SafeBoot"

reg_add,0x4,"%reg%\ControlSet001\Services\SafeBoot","Type","1"

reg_add,0x4,"%reg%\ControlSet001\Services\SafeBoot","Start","0"

reg_add,0x4,"%reg%\ControlSet001\Services\SafeBoot","ErrorControl","3"

Hive_Unload,System



[Interface]

pBevelShortcuts=pBevel1,1,12,6,6,395,170

pTextBoxStartTitel="Name for Shortcuts:",1,0,20,40,200,18,



%ProgramTitle%

pTextBoxStartFolder="Start Menu folder:",1,0,20,90,200,21,



%scriptfolder%

pTextLabeShortcutsTo="Add shortcuts to:",1,1,260,20,135,20,8,Normal

pCheckBoxStartMenu="Start Menu",1,3,260,50,200,20,True

pCheckBoxDesktop="Desktop",1,3,260,70,200,20,False

pCheckBoxQuickL="QuickLaunch",1,3,260,90,200,20,False

pCheckBoxRunRam="Run from ram (boot.wim)",1,3,20,141,183,18,False


Edited by m3fan, 04 April 2011 - 10:35 PM.


#10 Api

Api
  • Members
  • 9 posts
  •  
    Germany

Posted 08 April 2011 - 02:13 PM

Hi m3fan,

the script for 5.x looks almost the same, but read the comments here: http://simonhunt.wor...intech-and-pe3/
if you try to use 5 with vistape or win7pe, you will destroy the local database

if you still want test 5.2, then i can post my plugin

#11 m3fan

m3fan

    Member

  • Members
  • 32 posts
  •  
    United States

Posted 18 April 2011 - 01:15 PM

Hi m3fan,

the script for 5.x looks almost the same, but read the comments here: http://simonhunt.wor...intech-and-pe3/
if you try to use 5 with vistape or win7pe, you will destroy the local database

if you still want test 5.2, then i can post my plugin


Thanks Api,

I got the script to work but that bug is there. I did noticed that once you authenticate and it destroys the local data store. I guess I'll have to use v6. I just don't like the interface on it and i don't see a button to Restore Original MBR and SafeBoot MBR. I think only one of them was on there and i use both sometimes. Either way, i learned a lot about how these scripts work in the process :cheers:.

Regards.

#12 luckymikr

luckymikr
  • Members
  • 1 posts
  •  
    United States

Posted 14 December 2011 - 05:16 PM

Ok, I'll admit it, I'm a noob! I keep getting a error about the script and the path specified is invalid. I believe the error is here:
FileCopy,"%ScriptDir%safebootSystem32*.*","%TargetDir%WindowsSystem32"
I'm using Winbuilder for Win7PE_SE, building on x86.
Please help.
Mike

#13 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 02 January 2013 - 03:03 PM

I know this is an old post. but i cannot get this to work. I get it all added to the system. But when i provide the code of the day and the xml to unlock the drive, it does not work. The drive doesnt become unlocked within winpe. 



#14 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 02 January 2013 - 03:10 PM

I know this is an old post. but i cannot get this to work. I get it all added to the system. But when i provide the code of the day and the xml to unlock the drive, it does not work. The drive doesnt become unlocked within winpe. 

What is "this"?

What is the "system"?

 

Please try to be detailed if you want someone to provide meaningful help/assistance.

 

:cheers:

Wonko



#15 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 02 January 2013 - 05:36 PM

"This" as in this process. I followed the post from Stu above. 

 

I sucessfully get EETech and the driver integrated into my WinPE project. The program works as expected. But when providing the Code of the day and the xml within eetech the drive should then "unlock" and be readable. It however does not.



#16 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 02 January 2013 - 08:39 PM

"This" as in this process. I followed the post from Stu above. 

 

I sucessfully get EETech and the driver integrated into my WinPE project. The program works as expected. But when providing the Code of the day and the xml within eetech the drive should then "unlock" and be readable. It however does not.

 

I was talking of EXACTLY WHICH script or "process" you are using. I should guess now that it is the one in post #8?

 

And WHICH EXACT version of the McAfee thingy you are using.

 

And WHICH EXACT project you are using.

 

 

As an example, if you are using a PE based on later-than-Vista of any kind you need to have the disk offline, cannot say if this applies to your build.

 

In any case - as always - the remark was intended to help you by having more probabilities to get helped and helped "properly", it seems like the message didn't went through properly.

Just in case:

http://homepage.ntlw...ard-litany.html

 

 

:cheers:

Wonko



#17 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 02 January 2013 - 09:27 PM

Wonko, even though it must be your time of the month. Im using WinPE7SE, Im using the EXACT script and files mentioned in post 8 by STU, which i thought would of beeen clearly understood.

 

I guess ill go into disk management and take it offline before authenticating and see what happens


Edited by emerica243, 02 January 2013 - 09:31 PM.


#18 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 02 January 2013 - 11:02 PM

Not to mention after browsing the net regarding EETech and WinPE3, taking the disk offline first did not matter.

 

What ive tried.

 

Took the disk offline, authorized with the code of the day and the xml file in EETech application. Brought the disk back online, still shows as an unsupported file system and windows wants to format it which is incorrect. When supplying the code of the day and the xml the drive should unlock and become readable. 

 

 

Again, im using WinPE7SE project. An x86 source and the exact files and script mentioned above in post 8.


Edited by emerica243, 02 January 2013 - 11:03 PM.


#19 Guest_Boot_Monkey_*

Guest_Boot_Monkey_*
  • Guests

Posted 03 January 2013 - 12:06 AM

As people have mentioned, you *MUST* be careful when using WinPE 3.X and beyond.

 

The way to go is to ..............

 

Use a WinFE base, which is the same as WinPE, but with the all important reg entries that are ESSENTIAL for WinPE 3.X and beyond.

Also use Colin's WProtect.exe to control the access to drives.  Then you'll be safe, but always use caution with any tool that accesses drives, if you're trying to deal with encryption and forensics.

 

Take a look at the WinFE section.

 

I'll get around to posting, my scripts and solutions, when I get a chance.  It will seem like duplication from what others have provided, but my solution works for me 100% and doesn't eat any drives, like by Beta did.


  • Brito likes this

#20 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 03 January 2013 - 12:43 AM

Boot Monkey, thanks for the info. Ill check out this WinFE. Keep in mind that i have a reasoning for using PE3.

 

Basically at work we run Windows XP and Windows 7. The XP Machines use the older endpoint encryption, probably v5. And we use a WinPE2\Safeboot disc to manage unlocking\decrypting drives if the system becomes unbootable.

 

For windows 7 we use a seperate winPE2\EETech bootable disc.

 

The point of separate discs annoyed me so thats when i spents weeks trying to create a single boot stick that would boot two seperate winpe2x isos. The two that we use at work.

 

Starting with trying to just use the grub boot loader to just mount the isos and boot htem fom memory did not work. It seemed id always get a BSOD 0x000007B error when trying to mem load any WINPE v2 isos with grub. So then i found WinBuilder and saw i could create a WinPE3 and also include a winPE2 on the same boot stick. So i used the Winpe2(safeboot) source in the winbuilder for Safeboot management of windows xp machines. And then found this thread to incorporate the EETech management in the winpe3 source of my winbuilder project.

 

And this is pretty much where i am now. If youre saying WinPE3 and End point encryption dont play well thats fine. I dont have a problem using WinPE2. But i dont know how to go about getting two seperate WinPE sources on a single usb boot stick.

 

It would be always to be able to manage Safeboot and EETech encryption in a singe PE environment but i dont know if thats possible?



#21 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 03 January 2013 - 10:06 AM

In post #10 there is a link to this page, as a warning:

http://ctogonewild.c...intech-and-pe3/

where this info is posted:

 

 

UPDATE – 12th Sep 2012 – Don’t forget if you are using WinPE3.1, you need to take the disk offline before authenticating with WinTech/EETech . If you don’t, pesky WinPE3.1 will start writing to the private pre-boot area and will corrupt it. There are comments to this effect below, and also on https://community.mc...e/200194#200194

 

AND more comments that may be of use, that however clearly show how there are differences with each specific version of the eetech AND differences with them "coupled" to a PE 2.x or 3.x, so the exact version of everything does matter.

 

 

:cheers:

Wonko



#22 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 03 January 2013 - 12:59 PM

Wonko, thanks for the information. Using the disk offline trick i am able to Decrypt a drive just fine. But i see nothing mentioning about the drive just unlocking when authenticated like it should. Sometimes when we just need to view data in a winpe environment, unlocking the drive is what we need to do. Decrypting a whole drive for hours just isnt logical. 

 

Needless to say, this sucks. 



#23 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 16066 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 03 January 2013 - 01:19 PM

Wonko, thanks for the information. Using the disk offline trick i am able to Decrypt a drive just fine. But i see nothing mentioning about the drive just unlocking when authenticated like it should. Sometimes when we just need to view data in a winpe environment, unlocking the drive is what we need to do. Decrypting a whole drive for hours just isnt logical. 

 

Needless to say, this sucks. 

Well, to be more comprehensive ;) the WHOLE McAfee EETech thingy actually sucks (or more porbably the WHOLE McAfee) :w00t:.

I mean, we are talking of an "emergency recovery" that is not supported by the makers of the (BTW Commercial) tool on a PE (which is the only actual environment on which such a thing makes sense). :frusty:

 

One of the given links suggests (and again there is no way to know to WHICH EXACT version of the EETech thingy it is referred to and even if it was explicited, you still failed to provide info in the actual EXACT VERSION you are running) a trick:

https://community.mc...tart=0&tstart=0

by decrypting only a small number of sectors in the "Workspace" (whatever this is).

 

:cheers:

Wonko



#24 emerica243

emerica243

    Member

  • Members
  • 30 posts
  •  
    United States

Posted 03 January 2013 - 01:42 PM

Thank you wonko, did not see that thread. Ill give that a try, Ive started a thread on Mcafee link below. But maybe about the version info youre looking for is what ive just posteed on mcafee in my detailed post. THanks again for helping.

 

https://community.mc.../51141?tstart=0



#25 Guest_Boot_Monkey_*

Guest_Boot_Monkey_*
  • Guests

Posted 07 January 2013 - 10:44 AM

You shouldn't need to use two discs. Although there *can* be exceptions. Thanks Wonko

 

I've just finished designing a WinPE3.1 build based on Win7SP1 for Encryption that is on XP and 7 using the one Wintech version.

 

 

Also use Colin's WProtect.exe to control the access to drives.

 

Like I said, you should use Write Protect to control the mounting of drives.

 

Once you've gone through all  the WinFE stuff and winfe.wordpress.com etc, you'll get the hang of it.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users