133 replies to this topic

[wimb]

Have you examined HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlServiceGroupOrder : List ? Have you used LoadOrd to examine the service order?

I did not do yet, but will investigate it now.

Can you please share how you installed DriveGuard? Was it by .INF or installer program or manual copy of .SYS files and manual Registry entries? How many files are involved?

In running XP then right click on ubdrvgd.inf, click on Install
In this way only ubdrvgd.sys file is Installed in system32drivers
+ Install in registry ControlClass{4D36E967-E325-11CE-BFC1-08002BE10318} LowerFilters ubdrvgd and in registry Services ubdrvgd

ServiceGuard or any other component of USBoot are NOT used by me and I did not make manual changes.

[wimb]

I used LoadOrder and can see that ubdrvgd.sys belongs to PNP Filter Group
whereas waitbt32.sys (v7 but renamed) belongs to SCSI Miniport

I hope this helps ....

[Sha0]

...
I hope this helps ....

Thanks. What I'm suggesting is actually to examine the service order before booting with WaitBt on the new hardware, then after all the new hardware has been installed, before the shutdown. If you compare these, I'm curious if the USB drivers' order changes.

I didn't mean to compare WaitBt and DriverGuard.

[Doodoo]

What I'm suggesting is actually to examine the service order before booting with WaitBt on the new hardware, then after all the new hardware has been installed, before the shutdown

Just to have a bit more insight into what DriveGuard does (and does not), it might also be useful to examine the service order before booting with DriveGuard on the new hardware, then after all the new hardware has been installed, before the shutdown (without having ServiceGuard installed, of course)

In the meantime, I'll try the lastest WaitBt and report if it avoids the BSOD 7B for me (at least on first boot) !

[wimb]

= =

Just before Shutdown on AMD = At boot of Intel Dual Core = Just before Shutdown Intel Dual Core (after auto install new hardware)

This is a sequence of LoadOrder for XP VHD with waitbt32.sys v7 driver
The Tags of USB Services are changing, but the Group remains Boot Bus Extender
What is the meaning of the Tags ?
Is this observation important or not ?

[Doodoo]

What is the meaning of the Tags ?

Read this: http://support.microsoft.com/kb/115486

[wimb]

Read this: http://support.microsoft.com/kb/115486

Thanks for the interesting Link.

For the Reboot case giving BSOD 7B we see that WinVBlock disk arrived before USBSTOR
That is strange since usbstor has Group=Boot Bus Extender which loads before wvblk32 of Group=SCSI miniport

For me it is still confusing .....
And it remains unclear why and how DriveGuard ubdrvgd driver can prevent BSOD 7B in this case

[Doodoo]

That is strange since usbstor has Group=Boot Bus Extender which loads before WVBlk32.sys driver Group=SCSI miniport

Sha0 will better than me explain the details... but I believe it does not really matter that WinVBlock is loaded first.... The problem is that it goes looking for the backing disk some time after being loaded, before the backing disk is actually available.
See http://reboot.pro/14...125#entry126110

[Sha0]

Hey wimb, could you please try importing this .REG file? I'm wondering if you could import it

• After copying waitbt.sys but before the first boot on the "troublesome" hardware
• After all "troublesome" hardware has finished installing

Please don't apply this to any "gold" image you might have, because you won't be able to reverse its Registry changes. The point of this Registry file is to better control when your USB drivers are started. You can use LoadOrder afterwards to have a look at what happens. Thanks, wimb, and Doodoo, too.

Windows Registry Editor Version 5.00



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesusbohci]

"Start"=dword:00000000

"Tag"=dword:00000001

"Group"="USB Boot"



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesusbuhci]

"Start"=dword:00000000

"Group"="USB Boot"

"Tag"=dword:00000002



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesusbehci]

"Start"=dword:00000000

"Tag"=dword:00000003

"Group"="USB Boot"



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesnusb3xhc]

"Start"=dword:00000000

"Group"="USB Boot"

"Tag"=dword:00000004



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesusbhub]

"Start"=dword:00000000

"Group"="USB Boot"

"Tag"=dword:00000005



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesnusb3hub]

"Start"=dword:00000000

"Tag"=dword:00000006

"Group"="USB Boot"



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesusbccgp]

"Start"=dword:00000000

"Group"="USB Boot"

"Tag"=dword:00000007



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUSBSTOR]

"Start"=dword:00000000

"Group"="USB Boot"

"Tag"=dword:00000008



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswaitbt]

"Start"=dword:00000000

"Group"="SCSI Miniport"

"Type"=dword:00000001



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlGroupOrderList]

"USB Boot"=hex:08,00,00,00,01,00,00,00,02,00,00,00,03,00,00,00,04,00,00,00,05,

00,00,00,06,00,00,00,07,00,00,00,08,00,00,00



[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlServiceGroupOrder]

"List"=hex(7):53,00,79,00,73,00,74,00,65,00,6d,00,20,00,52,00,65,00,73,00,65,

00,72,00,76,00,65,00,64,00,00,00,42,00,6f,00,6f,00,74,00,20,00,42,00,75,00,

73,00,20,00,45,00,78,00,74,00,65,00,6e,00,64,00,65,00,72,00,00,00,53,00,79,

00,73,00,74,00,65,00,6d,00,20,00,42,00,75,00,73,00,20,00,45,00,78,00,74,00,

65,00,6e,00,64,00,65,00,72,00,00,00,55,00,53,00,42,00,20,00,42,00,6f,00,6f,

00,74,00,00,00,53,00,43,00,53,00,49,00,20,00,6d,00,69,00,6e,00,69,00,70,00,

6f,00,72,00,74,00,00,00,50,00,6f,00,72,00,74,00,00,00,50,00,72,00,69,00,6d,

00,61,00,72,00,79,00,20,00,44,00,69,00,73,00,6b,00,00,00,53,00,43,00,53,00,

49,00,20,00,43,00,6c,00,61,00,73,00,73,00,00,00,53,00,43,00,53,00,49,00,20,

00,43,00,44,00,52,00,4f,00,4d,00,20,00,43,00,6c,00,61,00,73,00,73,00,00,00,

46,00,53,00,46,00,69,00,6c,00,74,00,65,00,72,00,20,00,49,00,6e,00,66,00,72,

00,61,00,73,00,74,00,72,00,75,00,63,00,74,00,75,00,72,00,65,00,00,00,46,00,

53,00,46,00,69,00,6c,00,74,00,65,00,72,00,20,00,53,00,79,00,73,00,74,00,65,

00,6d,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,00,72,00,20,00,42,00,

6f,00,74,00,74,00,6f,00,6d,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,

00,72,00,20,00,43,00,6f,00,70,00,79,00,20,00,50,00,72,00,6f,00,74,00,65,00,

63,00,74,00,69,00,6f,00,6e,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,

00,72,00,20,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,79,00,20,00,45,00,

6e,00,68,00,61,00,6e,00,63,00,65,00,72,00,00,00,46,00,53,00,46,00,69,00,6c,

00,74,00,65,00,72,00,20,00,4f,00,70,00,65,00,6e,00,20,00,46,00,69,00,6c,00,

65,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,00,72,00,20,00,45,00,6e,

00,63,00,72,00,79,00,70,00,74,00,69,00,6f,00,6e,00,00,00,46,00,53,00,46,00,

69,00,6c,00,74,00,65,00,72,00,20,00,43,00,6f,00,6d,00,70,00,72,00,65,00,73,

00,73,00,69,00,6f,00,6e,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,00,

72,00,20,00,48,00,53,00,4d,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,

00,72,00,20,00,43,00,6c,00,75,00,73,00,74,00,65,00,72,00,20,00,46,00,69,00,

6c,00,65,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,46,00,53,00,46,

00,69,00,6c,00,74,00,65,00,72,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,

20,00,52,00,65,00,63,00,6f,00,76,00,65,00,72,00,79,00,00,00,46,00,53,00,46,

00,69,00,6c,00,74,00,65,00,72,00,20,00,43,00,6f,00,6e,00,74,00,65,00,6e,00,

74,00,20,00,53,00,63,00,72,00,65,00,65,00,6e,00,65,00,72,00,00,00,46,00,53,

00,46,00,69,00,6c,00,74,00,65,00,72,00,20,00,43,00,6f,00,6e,00,74,00,69,00,

6e,00,75,00,6f,00,75,00,73,00,20,00,42,00,61,00,63,00,6b,00,75,00,70,00,00,

00,46,00,53,00,46,00,69,00,6c,00,74,00,65,00,72,00,20,00,52,00,65,00,70,00,

6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,00,00,46,00,53,00,46,00,69,

00,6c,00,74,00,65,00,72,00,20,00,41,00,6e,00,74,00,69,00,2d,00,56,00,69,00,

72,00,75,00,73,00,00,00,46,00,53,00,46,00,69,00,6c,00,74,00,65,00,72,00,20,

00,55,00,6e,00,64,00,65,00,6c,00,65,00,74,00,65,00,00,00,46,00,53,00,46,00,

69,00,6c,00,74,00,65,00,72,00,20,00,41,00,63,00,74,00,69,00,76,00,69,00,74,

00,79,00,20,00,4d,00,6f,00,6e,00,69,00,74,00,6f,00,72,00,00,00,46,00,53,00,

46,00,69,00,6c,00,74,00,65,00,72,00,20,00,54,00,6f,00,70,00,00,00,46,00,69,

00,6c,00,74,00,65,00,72,00,00,00,42,00,6f,00,6f,00,74,00,20,00,46,00,69,00,

6c,00,65,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,42,00,61,00,73,

00,65,00,00,00,50,00,6f,00,69,00,6e,00,74,00,65,00,72,00,20,00,50,00,6f,00,

72,00,74,00,00,00,4b,00,65,00,79,00,62,00,6f,00,61,00,72,00,64,00,20,00,50,

00,6f,00,72,00,74,00,00,00,50,00,6f,00,69,00,6e,00,74,00,65,00,72,00,20,00,

43,00,6c,00,61,00,73,00,73,00,00,00,4b,00,65,00,79,00,62,00,6f,00,61,00,72,

00,64,00,20,00,43,00,6c,00,61,00,73,00,73,00,00,00,56,00,69,00,64,00,65,00,

6f,00,20,00,49,00,6e,00,69,00,74,00,00,00,56,00,69,00,64,00,65,00,6f,00,00,

00,56,00,69,00,64,00,65,00,6f,00,20,00,53,00,61,00,76,00,65,00,00,00,46,00,

69,00,6c,00,65,00,20,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,45,00,76,

00,65,00,6e,00,74,00,20,00,4c,00,6f,00,67,00,00,00,53,00,74,00,72,00,65,00,

61,00,6d,00,73,00,20,00,44,00,72,00,69,00,76,00,65,00,72,00,73,00,00,00,4e,

00,44,00,49,00,53,00,20,00,57,00,72,00,61,00,70,00,70,00,65,00,72,00,00,00,

43,00,4f,00,4d,00,20,00,49,00,6e,00,66,00,72,00,61,00,73,00,74,00,72,00,75,

00,63,00,74,00,75,00,72,00,65,00,00,00,55,00,49,00,47,00,72,00,6f,00,75,00,

70,00,00,00,4c,00,6f,00,63,00,61,00,6c,00,56,00,61,00,6c,00,69,00,64,00,61,

00,74,00,69,00,6f,00,6e,00,00,00,50,00,6c,00,75,00,67,00,50,00,6c,00,61,00,

79,00,00,00,50,00,4e,00,50,00,5f,00,54,00,44,00,49,00,00,00,4e,00,44,00,49,

00,53,00,00,00,54,00,44,00,49,00,00,00,4e,00,65,00,74,00,42,00,49,00,4f,00,

53,00,47,00,72,00,6f,00,75,00,70,00,00,00,53,00,63,00,68,00,65,00,64,00,75,

00,6c,00,65,00,72,00,47,00,72,00,6f,00,75,00,70,00,00,00,53,00,70,00,6f,00,

6f,00,6c,00,65,00,72,00,47,00,72,00,6f,00,75,00,70,00,00,00,41,00,75,00,64,

00,69,00,6f,00,47,00,72,00,6f,00,75,00,70,00,00,00,53,00,6d,00,61,00,72,00,

74,00,43,00,61,00,72,00,64,00,47,00,72,00,6f,00,75,00,70,00,00,00,4e,00,65,

00,74,00,77,00,6f,00,72,00,6b,00,50,00,72,00,6f,00,76,00,69,00,64,00,65,00,

72,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,56,00,61,00,6c,00,69,00,64,

00,61,00,74,00,69,00,6f,00,6e,00,00,00,4e,00,65,00,74,00,44,00,44,00,45,00,

47,00,72,00,6f,00,75,00,70,00,00,00,50,00,61,00,72,00,61,00,6c,00,6c,00,65,

00,6c,00,20,00,61,00,72,00,62,00,69,00,74,00,72,00,61,00,74,00,6f,00,72,00,

00,00,45,00,78,00,74,00,65,00,6e,00,64,00,65,00,64,00,20,00,42,00,61,00,73,

00,65,00,00,00,50,00,43,00,49,00,20,00,43,00,6f,00,6e,00,66,00,69,00,67,00,

75,00,72,00,61,00,74,00,69,00,6f,00,6e,00,00,00,00,00

EDIT: You might have to disable "USB boot watcher".

[wimb]

After STOP and Disable UsbBootWatcher then the USB Boot registry was applied in running XP VHD



The USB Services are visible as Group USB Boot just before SCSI miniport

Results:
- applied on AMD then booting but with 1 min delay in building Desktop
- appllied before 1st Boot on Intel Dual Core gives BSOD 7B
- applied after 1st boot and auto install of new hardware then Intel Dual Core gives BSOD 7B

So creating a New Group USB Boot for USB Services loaded before SCSI miniport does not prevent the BSOD 7B

I consider the case as closed and can live with the DriveGuard ubdrvgd.sys driver that prevents BSOD 7B,
unless there are new ideas on replicating the behaviour of the DriveGuard driver.

[Sha0]

...
- appllied before 1st Boot on Intel Dual Core gives BSOD 7B
...

That doesn't make sense, because it was working before. Maybe a waitbt32.sys versus waitbt.sys problem, again. Oh well. Thanks for all the testing, wimb! I was anxious about this because your WinDbg output suggests that DriveGuard does very little, if anything other than cause a delay. So "replicating the behaviour" seems very difficult. Just for fun, here's a test that you can do only if you feel like it: Attachment

[wimb]

That doesn't make sense, because it was working before.

Well, a lot has changed. The USB Services now belonging to USB Boot Group are loaded after the System Bus Extender Group,
where pciide.sys and intelide.sys and PartMgr to belong.
Originally the USB Services were in Boot Bus Extender and loaded before the System Bus Extender Group
and besides the logic it can also mean a difference in timing.

I have tested waitbt_wimb driver which has AddDevice pausing steps of 10 sec
The longer pausing per step does not help.
For Reboot with Intel Dual Core, then WinVBlock disk arrived before USBSTOR of Samsung Portable USB-harddisk,
which results in BSOD 7B

[Sha0]

Ok, I put the 10-second delay into the DriverEntry routine now, too: Attachment

The USB drivers are still supposed to start before both WaitBt and WinVBlock, so I'm not sure why a slight timing difference due to the System Bus Extender Group would matter.

[wimb]

Ok, I put the 10-second delay into the DriverEntry routine now, too:  waitbt_wimb2.zip   2.51KB   4 downloads

The DriverEntry delay combined with the AddDevice delay of waitbt works OK and prevents BSOD 7B

Reboot on Intel Dual Core showing USBSTOR arrives before WinVBlock disk



I used original settings for USB Services belonging to Group=Boot Bus Extender and UsbBootWatcher is being used to keep the settings.

I hope that Doodoo and Michele13 and others can confirm that this approach of waitbt can indeed prevent BSOD 7B

[Wonko the Sane]

@Sha0

Being the known picky guy I am (and also somehow a perfectionist) , a question.
Can the WaitBt either:

• read a setting file for the delay(s)
  or
• (more simply) be hexedited directly to change the delay(s) (we could do this with grub4dos dd command)

(of course within a "reasonable" range, let's say 3 to 20 seconds)


This way one could increase the delay on"more problematic" hardware and set it to a minimum on "good one".


Wonko

[Sha0]

The DriverEntry delay combined with the AddDevice delay of waitbt works OK and prevents BSOD 7B
...

At last!

...
Can the WaitBt either:

• read a setting file for the delay(s)
  or
• (more simply) be hexedited directly to change the delay(s) (we could do this with grub4dos dd command)

...

Yes. However, there is something attractive about the original idea of waiting for the boot device up until some maximum span of time has come to pass. Let's see if that strategy can be blended with today's findings; no need for user intervention.

wimb, I have a tricky question for you: When you saw the DriverEntry delay message, did the USB-disk-arrival message appear before 10 seconds elapsed, or after 10 seconds elapsed, starting from the DriverEntry message? I should have put timestamps, maybe.

[wimb]

When you saw the DriverEntry delay message, did the USB-disk-arrival message appear before 10 seconds elapsed, or after 10 seconds elapsed, starting from the DriverEntry message?

From seeing DriverEntry until USBSTOR Disk arrived is taking 33 sec in total on Intel Dual Core

DriverEntry pausing 12sec > AddDevice pausing 11 sec > AddDevice pausing 10 sec > Disk arrived USBSTOR

[VV2006]

33 sec in total

This is too long, unlike DriveGuard.

Edited by VV2006, 09 October 2012 - 04:30 PM.

[Sha0]

This is too long, unlike DriveGuard.

Version 0.0.0.8 should deal with that. It's attached to the original post. What do you think is reasonable?

[wimb]

Version 0.0.0.8 should deal with that. It's attached to the original post. What do you think is reasonable?

Version 8 is working OK but there is no improvement in the boottime.
The time from DriverEntry until Disk arrived USBSTOR is again 33 sec

I compared the Total boottime for waitbt and DriveGuard diver using same XP VHD without using /SOS option.

Total boottime (from boot.ini until sound in Desktop) for Intel Dual Core laptop
waitbt = 63 sec and DriveGuard = 48 sec

Total boottime (from boot.ini until sound in Desktop) for AMD Desktop
waitbt = 180 sec and DriveGuard = 108 sec and without delay driver 83 sec

So waitbt uses more time than DriveGuard to protect against BSOD 7B
The 15 sec extra on Intel Dual Core is not a real problem, but the extra 72 sec or 97 sec feels like a problem I think.

So it is a good idea of Wonko to be able to select or set delay time in grub4dos menu.

[wimb]

Increasing the AddDevice pausing per step to 10 seconds did not work.
Then you added DriverEntry pausing mechanism that is working,
but you kept the value of 10 seconds per step.

I think we can try now to reduce the waiting to the original 1 second per step
and see if that is already sufficient now we use the extra DriverEntry pausing.

[Sha0]

Increasing the AddDevice pausing per step to 10 seconds did not work.
Then you added DriverEntry pausing mechanism that is working,
but you kept the value of 10 seconds per step.

I think we can try now to reduce the waiting to the original 1 second per step
and see if that is already sufficient now we use the extra DriverEntry pausing.

Yes, I had thought about this, and maybe you're right.

However, just having a delay in DriverEntry is equivalent to want the ancient Wait10 driver did, isn't it?! That would be quite a round-about way to end up back where we started! Does Wait10 actually fix your test, too?

[Doodoo]

Hi Sha0,
I've only been able to test version 0.0.0.8 on one problematic machine, but on this one, it works and avoids the BSOD 7B. However, a few seconds (10, 15 ?) after the windows desktop has appeared, and whilst drivers for the unknown hardware are installed, I now get a BDOD 7E.... any ideas ? Thinking about it... this seems to remind me of something...

[Sha0]

Hi Sha0,
I've only been able to test version 0.0.0.8 on one problematic machine, but on this one, it works and avoids the BSOD 7B. However, a few seconds (10, 15 ?) after the windows desktop has appeared, and whilst drivers for the unknown hardware are installed, I now get a BDOD 7E.... any ideas ? Thinking about it... this seems to remind me of something...

I do have an idea. Rename the WindowsINF directory in the image file temporarily so that Windows can't install hardware. If it boots and remains stable, then it must be the installation of a device that's causing the issue. That's a starting point, at least.

[wimb]

Hi Sha0,
I've only been able to test version 0.0.0.8 on one problematic machine, but on this one, it works and avoids the BSOD 7B. However, a few seconds (10, 15 ?) after the windows desktop has appeared, and whilst drivers for the unknown hardware are installed, I now get a BDOD 7E.... any ideas ? Thinking about it... this seems to remind me of something...

That's funny, I just had the same experience on the ASUS P4P800-E with Intel Pentium 4 processor at my friend's home tested earlier.
http://reboot.pro/98...775#entry159779

At home I had prepared on my AMD machine three equal XP VHD files which have full DriverPacks Chipset + MassStorage + LAN integrated (KTD)
On booting from ASUS P4P800-E with Intel Pentium 4 processor I get in case of
- no extra driver gives BSOD 7B
- with DriveGuard driver - Booting OK and new hardware found is properly installed
- with waitbt v8 driver - Booting OK but on auto Install of new hardware I get BSOD 7E - On Reboot stable but IDE Controller has exclamation mark
which I tried to solve, but then again BSOD 7E

So It remains rather tricky.

I will also test old wait10 driver (is that waitbt32.sys version 0.0.0.4 that is used in IMG_XP_64 package ?)