97 replies to this topic

[mbushnell]

Okay, I have everything you described above done now. But what about " I am using this tool PSWinRE.exe that came in the CheckPoint package to add the driver."?
Do I have to do something with this now? Maybe I missed something?
Thanks

[mbushnell]

Well still a no go for me. I did what I think is correct as per your instructions. But I do not get anything like what your saying you get.
I have posted what I get via a couple pictures.
Here is the link to see them.
http://www.mediafire...dmc89dxf4a6g5jb
http://www.mediafire...ppqdf8778q1jimb

[mbushnell]

typos!

[mbushnell]

Still hope you can assist me :-(

[mbushnell]

Okay, update here! I got it so that I now see the Checkpoint in the build, and when I boot to it. However when I click on the program, and click on the drive (Which it shows it as Fully Encrypted) an error box comes up saying" Unable to open driver interface"
I hope someone knows how to fix this last issue!

Thanks

[mbushnell]

I have not heard from anyone so I thought I would try this one more time.
Here is the latest. I have tried the scripts for checkpoint and have got it to the point where I can find the exe files booting to the Win7PE. But getting errors when trying to execute them. Its like the driver is not getting installed still. I even went through the instructions for using the tools that the other two members mentioned but still not firing on all cylinders. Maybe I am not following them correctly, or am missing something. I am very much hoping that someone can help me out so that I can get the Checkpoint\ Pointsec driver and app working within Win7PE_SE soon. Many thanks in advance!

[homes32]

sorry, not a whole lot more I can do since I don't have the files for checkpoint.
Its a bit unclear which methods your using now as you have mentioned trying several options from several scripts so It may help if you post your current script. (Please use code tags) and a current build log.

[mbushnell]

homes32, thanks for your help. I will post the scripts and log files tomorrow morning and hopefully we can figure something out from that. I have it so that the folder for Checkpoint gets created, but only if I manually goto it. It does not create a shortcut or start menu folder. So that is something I am still working on. I will also post the process I have performed thus far with results.
Thanks again!

[crashii75]

I have the icons and the program launches, I think we just need someone to figure out how to get the Pro_2k.sys file to load as a driver.

When I launch the Checkpoint program I get an error saying that it can't locate the driver.




[Main]
Title="CheckPoint FDE"
Description=CheckPoint Dynamic Mount
Selected=True
Level=5
Version=001
Author=BmW-MaN
Date=07.01.2011
Info=
NoWarning=False
Download_Level=0
[Variables]
%ProgramFolder%=CheckPoint
%ProgramEXE%=FDE_Dyn_Disk.exe
%ProgramTitle%="CheckPoint FDE"
[Process]
Echo,Processing %ProgramTitle%...
StrFormat,filename,%Scriptdir%,%scriptfolder%
ExtractFile,%ScriptFile%,Folder,Prot_2k.sys,%Target_Sys%\Drivers
RunFromRam,%pCheckBoxRunRam%
DirMake,"%target_prog%\CheckPoint"
FileCopy,"%ScriptDir%\Programfiles\*.*","%target_prog%\CheckPoint"
//Add_Shortcut,[Type],[Folder],[FullFileName],[Title],[Work Folder],[Parameters],[IconFile( .ico .exe)],[StartMode(1, 2, 3, or 4)]
If,%pCheckBoxStartMenu%,Equal,True,Add_Shortcut,StartMenu
//,%pTextBoxStartFolder%,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%ProgramTitle%
If,%pCheckBoxDesktop%,Equal,True,Add_Shortcut,Desktop,,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%pTextBoxStartTitle%
If,%pCheckBoxQuickL%,Equal,True,Add_Shortcut,QuickLaunch,,%PE_Programs%\%ProgramFolder%\%ProgramEXE%,%ProgramTitle%
[Interface]
pBevelShortcuts=pBevel1,1,12,6,6,395,170
pTextBoxStartTitle="Name for Shortcuts:",1,0,20,40,200,18,"CheckPoint Dynamic Mount"
pTextBoxStartFolder="Start Menu folder:",1,0,20,90,200,21,Encryption
pTextLabelShortcutsTo="Add shortcuts to:",1,1,260,20,135,20,8,Normal
pCheckBoxStartMenu="Start Menu",1,3,260,50,200,20,True
pCheckBoxDesktop="Desktop",1,3,260,70,200,20,True
pCheckBoxQuickL="QuickLaunch",1,3,260,90,200,20,False
pCheckBoxRunRam="Run from ram (boot.wim)",1,3,20,141,183,18,True
[EncodedFolders]

[crashii75]

It looks like the driver file - prot_2k.sys is getting copied into x:\windows\system32\drivers - but when I launch checkpoint dynamic mount the error is Unable to open driver interface.

[m3fan]

Which version of the Dynamic mount are you using and which version of Checkpoint is your HDD encrypted with? I tried 2.0 and it didnt work for me, but 1.4 works fine and i've been using it for 2 months now.

[m3fan]

Here is a log from the tool that adds the driver. If anyone can translate and add it to the script it would be great. I tried but have given up.

--------- Start ---------

2011-09-27 15:56:33  Folder: C:\Users\806274\Desktop\FDE-Dynamic_Mount_Utility_20\FDE_DMU20_WinPE\pswinre\

2011-09-27 15:56:33  Windows version 6.1 Build 7601 Service Pack 1

2011-09-27 15:56:33  System32 folder: C:\Windows\System32\

2011-09-27 15:56:33  Read line from INI file Auto=

2011-09-27 15:56:33  Read line from INI file MountWim=

2011-09-27 15:56:33  Read line from INI file Driver=

2011-09-27 15:56:33  Read line from INI file MountPoint=

2011-09-27 15:56:33  Read line from INI file WIMFile=

2011-09-27 15:56:33  Read line from INI file ImageX=

2011-09-27 15:56:56  Mount WIM file

2011-09-27 15:56:56  Skip mount

2011-09-27 15:56:56  Check if mount point contains windows folder

2011-09-27 15:56:56  Looks like it's mounted

2011-09-27 15:56:56  Copy file

2011-09-27 15:56:56  From: C:\Users\806274\Desktop\FDE_DMU_1.4\FDE_DMU\FDE filter 1.4\files\prot_2k.sys

2011-09-27 15:56:56  To: C:\MOUNT\Windows\System32\drivers\prot_2k.sys

2011-09-27 15:56:56  Copy file

2011-09-27 15:56:56  From: C:\Users\806274\Desktop\FDE_DMU_1.4\FDE_DMU\FDE filter 1.4\files\ccore32.sys

2011-09-27 15:56:56  To: C:\MOUNT\Windows\System32\drivers\ccore32.sys

2011-09-27 15:56:56  Failed to copy ccore32.sys, only needed on DMU 2.0 32 bit operating system

2011-09-27 15:56:56  Copy file

2011-09-27 15:56:56  From: C:\Users\806274\Desktop\FDE_DMU_1.4\FDE_DMU\FDE filter 1.4\files\ccore64.sys

2011-09-27 15:56:56  To: C:\MOUNT\Windows\System32\drivers\ccore64.sys

2011-09-27 15:56:56  Failed to copy ccore64.sys, only needed on x64 operating system

2011-09-27 15:56:56  Execute: "C:\Windows\System32\reg.exe" LOAD HKLM\Pointsec "C:\MOUNT\Windows\System32\config\SYSTEM"

2011-09-27 15:56:57  Return code: 0

2011-09-27 15:56:57  Check UpperFilters: Pointsec\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}

2011-09-27 15:56:57  prot_2k added to UpperFilters

2011-09-27 15:56:57  Open/create Pointsec\ControlSet001\Services\prot_2k

2011-09-27 15:56:57  Registry written OK

2011-09-27 15:56:57  Execute: "C:\Windows\System32\reg.exe" UNLOAD HKLM\Pointsec

2011-09-27 15:56:57  Return code: 0

2011-09-27 15:56:57  no DMU folder selected or error

2011-09-27 15:56:57  Unmount WIM file

2011-09-27 15:56:57  Skip unmount

2011-09-27 15:56:57  Exit

[mbushnell]

If anyone has gotten this to work with either a work around or the drivers installing please post your script, and instructions. I have been fighting this issue for over 3 months now and am about to pull out my hair (What I have left anyways). Thanks in advance.
Matt

[m3fan]

Hi all,

I have been working on this script for a while and i got it work with a workaround. It is for mounting encrypted CheckPoint drives. So i have a tool that came from the vendor to add the drivers and registry entries to WinPE but i am having hard time translating those into my script. Can anyone help or give me some pointers? I did read the tutorials on here but it doesn't mention anything about creating a service, etc. So below is the log from the CheckPoint tool that i need to convert to WinBuilder format. Thanks in advance.

--------- Start ---------

2011-11-15 13:58:24  Folder: C:\Users\806274\Desktop\FDE-Dynamic_Mount_Utility_20\FDE_DMU20_WinPE\pswinre\

2011-11-15 13:58:24  Windows version 6.1 Build 7601 Service Pack 1

2011-11-15 13:58:24  System32 folder: C:\Windows\System32\

2011-11-15 13:58:24  Read line from INI file Auto=

2011-11-15 13:58:24  Read line from INI file MountWim=

2011-11-15 13:58:24  Read line from INI file Driver=

2011-11-15 13:58:24  Read line from INI file MountPoint=

2011-11-15 13:58:24  Read line from INI file WIMFile=

2011-11-15 13:58:24  Read line from INI file ImageX=

2011-11-15 13:58:49  Mount WIM file

2011-11-15 13:58:49  Skip mount

2011-11-15 13:58:49  Check if mount point contains windows folder

2011-11-15 13:58:49  Looks like it's mounted

2011-11-15 13:58:49  Copy file

2011-11-15 13:58:49  From: C:\Users\806274\Desktop\FDE_DMU_1.4\FDE_DMU\FDE filter 1.4\files\prot_2k.sys

2011-11-15 13:58:49  To: C:\MOUNT\Windows\System32\drivers\prot_2k.sys

2011-11-15 13:58:49  Copy file

2011-11-15 13:58:49  From: C:\Users\806274\Desktop\FDE_DMU_1.4\FDE_DMU\FDE filter 1.4\files\ccore32.sys

2011-11-15 13:58:49  To: C:\MOUNT\Windows\System32\drivers\ccore32.sys

[b]2011-11-15 13:58:49  Execute: "C:\Windows\System32\reg.exe" LOAD HKLM\Pointsec "C:\MOUNT\Windows\System32\config\SYSTEM"

2011-11-15 13:58:50  Return code: 0

2011-11-15 13:58:50  Check UpperFilters: Pointsec\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}

2011-11-15 13:58:50  prot_2k added to UpperFilters

2011-11-15 13:58:50  Open/create Pointsec\ControlSet001\Services\prot_2k

2011-11-15 13:58:50  Registry written OK

2011-11-15 13:58:50  Execute: "C:\Windows\System32\reg.exe" UNLOAD HKLM\Pointsec[/b]

2011-11-15 13:58:50  Return code: 0

2011-11-15 13:58:50  no DMU folder selected or error

2011-11-15 13:58:50  Unmount WIM file

2011-11-15 13:58:50  Skip unmount

2011-11-15 13:58:50  Exit

[homes32]

your log is uselss as far as seeing what reg entries you need for the prot_2k service
if you want further help you need to post the contents of the following registry key

HKLM\System\ControlSet001\Services\prot_2k

I already posted a partal script for this here

services are created by creating a registry key
here is an example of a typical service entry:

Hive_Load,System

RegWrite,HKLM,0x4,"%reg%\ControlSet001\services\AntiVirService","Type","16"

RegWrite,HKLM,0x4,"%reg%\ControlSet001\services\AntiVirService","Start","2"

RegWrite,HKLM,0x4,"%reg%\ControlSet001\services\AntiVirService","ErrorControl","1"

RegWrite,HKLM,0x1,"%reg%\ControlSet001\services\AntiVirService","DisplayName","Avira#$sAntiVir#$sGuard"

RegAddBoot,HKLM,0x2,"SYSTEM\ControlSet001\services\AntiVirService","ImagePath","#$q%PE_Programs%\%ProgramFolder%\avguard.exe#$q"

RegWrite,HKLM,0x4,"%reg%\ControlSet001\services\AntiVirService","WOW64",0

RegWrite,HKLM,0x1,"%reg%\ControlSet001\services\AntiVirService","ObjectName","LocalSystem"

RegWrite,HKLM,0x3,"%reg%\ControlSet001\services\AntiVirService","FailureActions","80","51","01","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","00","00","00","00","01","00","00","00","00","00","00","00","00","00","00","00","00","00","00","00"

RegWrite,HKLM,0x1,"%reg%\ControlSet001\services\AntiVirService","Description","Offers#$spermanent#$sprotection#$sagainst#$sviruses#$sand#$smalware#$swith#$sthe#$sAntiVir#$ssearch#$sengine."

Hive_Unload,System

[m3fan]

I have posted my "working" script in the same thread that you mentioned, except that I use the vendor tool to add the drivers. It is not that difficult but still an extra hassle that should be part of the script. I have a fully working PE with the drivers, i booted from it and i looked in the registry, but there is no prot_2k service anywhere. I tried searching for Pointsec or prot_2k but it doesn't find anything. I wonder if it is being added under different name or something.

[homes32]

I have posted my "working" script in the same thread that you mentioned, except that I use the vendor tool to add the drivers. It is not that difficult but still an extra hassle that should be part of the script. I have a fully working PE with the drivers, i booted from it and i looked in the registry, but there is no prot_2k service anywhere. I tried searching for Pointsec or prot_2k but it doesn't find anything. I wonder if it is being added under different name or something.

from the log you posted it is loading the registry hive from C:MOUNT
is this where you mounted your boot.wim for editing? and if so what method did you use for mounting?

[m3fan]

That is correct. So first i build my PE with WinBuilder, including all apps and settings that i want. After it is all done, i open the created iso with MagicIso and extract the BOOT.WIM file from it. Then i mount Boot.wim manually with Imagex /mountrw boot.wim 1 c:Mount. Then i run the CheckPoint PSWinRE tool which adds the drivers to the mounted image. Then i imagex /unmount c:Mount /commit and put back Boot.wim in my original ISO or make a usb out of it. Works like a charm but it is too much extra work to do every time i want to update something on my PE. Searching the whole registry i couldn't find anything that is prot_2k.sys related. So bizarre..

Edited by m3fan, 15 November 2011 - 08:43 PM.

[m3fan]

Not sure what was i doing the first time but i did find the prot_2k Service so here it is what it looks like. I took screenshots. Also i did an export from the reg so we might be able to import that during the script?

[m3fan]

here is the export:

[HKEY_LOCAL_MACHINESYSTEMControlSet001servicesprot_2k]
"ErrorControl"=dword:00000002
"Start"=dword:00000000
"Tag"=dword:00000001
"Type"=dword:00000001

[HKEY_LOCAL_MACHINESYSTEMControlSet001servicesprot_2kEnum]
"0"="SCSIDisk&Ven_VMware_&Prod_VMware_Virtual_S5&1ec51bf7&0&000000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

So it should look something like this:

Hive_Load,System
RegWrite,HKLM,0x4,"%reg%ControlSet001servicesprot_2k","ErrorControl","2"
RegWrite,HKLM,0x4,"%reg%ControlSet001servicesprot_2k","Start","0"
RegWrite,HKLM,0x4,"%reg%ControlSet001servicesprot_2k","Tag","1"
RegWrite,HKLM,0x4,"%reg%ControlSet001servicesprot_2k","Type","1"
RegWrite,HKLM,0x4,"%reg%ControlSet001servicesprot_2k","Description"," CheckPoint#$sDriver"
Hive_Unload,System

I can test it tomorrow when i'm back at work, that's where all my files are.

Edited by m3fan, 15 November 2011 - 10:23 PM.

[homes32]

see if this helps out.
you will have to encode the files into the script.

• place the .script in your Apps folder
• open winbuilder and go the the script.
• press the little button that looks like a wrench (above the small green "play" button)
• click on the attachments tab
• click the "Add" button on the right
• add Prot_2k.sys and ccore32.sys to the drivers folder
• add all other files (FDE_Dyn_Disk.exe, etc.) to the program folder

regards,
Homes32

Attached Files

•  CheckpointFDE.script   28.18KB   1001 downloads

[m3fan]

see if this helps out.
you will have to encode the files into the script.

• place the .script in your Apps folder
• open winbuilder and go the the script.
• press the little button that looks like a wrench (above the small green "play" button)
• click on the attachments tab
• click the "Add" button on the right
• add Prot_2k.sys and ccore32.sys to the drivers folder
• add all other files (FDE_Dyn_Disk.exe, etc.) to the program folder

regards,
Homes32

Thanks Homes32. I think i'll stick with my own script for now though. I wasn't looking to get a whole script, just some help on the registry entries. My script has been working fine for me, minus the driver part and i have a workaround for it. I think i have figured it out and I will test it tomorrow. Your script certainly looks more advanced and elegant but i like to learn by trying until I improve mine . Your pointers in post#2 were certainly helpful. Thanks again.

[homes32]

nahh, nothing really advanced there. but thanks

RegWrite,HKLM,0x4,"%reg%ControlSet001servicesprot_2k","Description"," CheckPoint#$sDriver"

this line is wrong. the description string is not a dword it is a string (0x1)

also make sure you add the upper filter entry, this is important!
good luck.

homes32

[homes32]

If anyone has gotten this to work with either a work around or the drivers installing please post your script, and instructions. I have been fighting this issue for over 3 months now and am about to pull out my hair (What I have left anyways). Thanks in advance.
Matt

@mbushnell
this may or may not help you out.
Post #46


@m3fan
I merged your topic with this one as it is a continuation the discussions here and this way we keep everything in one place!

[m3fan]

I have finally completed the script. It took a lot of trial and error to figure out which registry entries need to be added. I had to take to registry snapshots before and after and then go from there. Here is the script with and the folder structure. Everyone would need to put in their own CheckPoint files as i am not sure if i can share those due to copyrights. Enjoy!

http://www.mediafire...1thbtjdjthsbd29

Edited by m3fan, 16 November 2011 - 09:08 PM.