Win PE 3.0 manual build - explorer shell problem.

Hi all.

I am trying to follow some instructions on how to build a Win Pe 3.0 boot image manually. I have followed a few different paths and am stuck on one problem. I cannot get the explorer shell to launch correctly.


Here is the process that I followed:

1: Build a Win PE 3.0 image by following steps from WAIK. (x86 build)
--> packages installed from WAIK are:

\x86\WinPE_FPs\winpe-hta.cab"
\x86\WinPE_FPs\winpe-legacysetup.cab"
\x86\WinPE_FPs\winpe-mdac.cab"
\x86\WinPE_FPs\winpe-pppoe.cab"
\x86\WinPE_FPs\winpe-scripting.cab"
\x86\WinPE_FPs\winpe-setup.cab"
\x86\WinPE_FPs\winpe-wds-tools.cab"
\x86\WinPE_FPs\winpe-wmi.cab"

\x86\WinPE_FPs\en-us\lp_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-hta_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-legacysetup_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-mdac_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-PPPOE_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-scripting_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-setup_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-wds-tools_en-us.cab"
\x86\WinPE_FPs\en-us\winpe-wmi_en-us.cab"

2: Use DISM to install needed hardware drivers
3: Use DISM to unmount the WIM file
4: User the oscdimage command line to build the bootable iso image.

5: Tested this to ensure that it was bootable in vmware.

---

next, I started customizing the image.
6: Mounted WIM
7: Opened regedit, used File - Load Hive - loaded the SOftware hive from PE
8: used File - load Hive - loaded the software hive from the Win 7 extracted install DVD
9: Exported the following keys:
HKLM\Software\Microsoft\Windows\currentversion\explorer
HKLM\Software\Classes
HKLM\Software\Microsoft\Internet Explorer
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Svchost

10: Edited the keys to change the D:\ to X:\
11: Edited the keys to remove the 44,00,... to read 58,00,..... (abbreviated the hex search codes)
(lso remove RunAS Interactive user entries in classes root reg keys.)
12: edited the exported reg key to import into the PE reg hive loaded in step 7)
13: imported the altered keys & verfiied that they didnt contain D: in any of them.
14: I then altered the ProfilePath value in the registry from x:\windows\system32\config\systemProfile to x:\users\default
15: I unloaded both hives. exited regedit.
16: I copied over the following folders from the extracted wim from the Win 7 install DVD to my 'mounted' wim folder. I did NOT replace existing files. I did NOT copy subfolders except where noted.
---> x:\windows\*.*
-----> x:\windows\system32\*.*
-----> x:\Program Files (all subs on this one)
------> x:\Users (all subs)
-------> x:\programdata
------> REcycle bin , Documents and SEttings, Perflogs (all empty folders)
-------> x:\windows\system32\en
--------> x:\windows\system32\en-us

17: I then unmounted the WIM, and updated the iso image.

When I boot my PE disk in VMWAre, I see Winpeshl.exe run and then I am at the command prompt. I can type explorer.exe and get the explorer file browser open (as if I double clicked on the my computer in nomal windows).

I then open taskmgr, kill the explorer process. Next, I open regedit, change the Windows NT\Current Version\Winlogon Shell value from the default of CMD.exe /k cmd.exe to 'explorer.exe'.

When I then try to open explorer, I get the grey 'windows update' setup type screen at the top but the gui never loads.

Any thoughts? My ultimate goal is to get a home grown custom version of the pe disk working for my job and I cannot use a build tool for the final version because i have to be able to document exactly what i did to get where I am going.

Any help would be appreciated.

upload your winpe somewhere and send the links with pm to me.

In file PE3-SOFTWARE_WLAN.reg of Make_PE3 project you can find

; needed for explorer.exe to be used as Shell



[HKEY_LOCAL_MACHINEPE3-SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]

"Shell"="explorer.exe"

"DefaultUserName"="Administrator"

"scremoveoption"="0"

"ShutdownFlags"=dword:00000007

"ForceAutoLogon"=dword:00000001

"DefaultPassword"="1"

"Background"="167 202 240"



; DesktopBackground - Sky=167 202 240 and Sea=10 59 118

If you Load the SOFTWARE hive of your PE offline as PE3-SOFTWARE
then you can make changes corresponding to the settings given above.

Wimb:
Tried that, still didnt work. Same thing.

I know that it is something simple that I am missing & I think that I saw this when I created my win xp based build a couple of years ago, but cannot remember what the fix was.

you are missing "Windowsen-USexplorer.exe.mui" and other mui files in that folder. I also cleaned a little. it will not loose any functionality. only deleted A FEW big garbages and current size is 451mb. It is some novice but some professinal work. It is also sp1 wim, to get it work on sp1 level also hard job. Congragulations. You also need new HKEY_LOCAL_MACHINE –> SYSTEM –> CurrentControlset –> Control -> Productoptions. Search and find the right key from topics. Took me 5 minutes to fix.

THANKS!!!

I had been pulling my hair out trying to figure out what I left out!

Now, onto customizing for my work's needs ))

you are missing "Windowsen-USexplorer.exe.mui" and other mui files in that folder. I also cleaned a little. it will not loose any functionality. only deleted A FEW big garbages and current size is 451mb. It is some novice but some professinal work. It is also sp1 wim, to get it work on sp1 level also hard job. Congragulations. You also need new HKEY_LOCAL_MACHINE –> SYSTEM –> CurrentControlset –> Control -> Productoptions. Search and find the right key from topics. Took me 5 minutes to fix.

What are the 'other files' mentioned? If its at all possible, I would really like to see the method from start to finish.

Also, what were the big files you removed? How could one trim this down further? I know I'm asking more than I can currently handle, but I would like to get to know what I need to build up to and eventually get there.

When adding extra files use a vlited 1 cd windows 7 builds as base. For example log and media sample files was in it.

Hi guys,
As mars0124 type...
- who can help with a draft/steps from the start to finish to "add explorer shell on WinPE3.1" ?

Thanks.

This seems to be what I, and many more techs are looking for. If one could make a clear, idiot-proof, step-by-step procedure, it would be a great help to myself and many.

The problem is that too many "hacks" are out there and I can't trust anything that is a pre-made ISO.

The only way for trust is to write up a step by step method that uses only Microsoft tools. Any third party tools is a possible security breach. This could be used by many field techs as a tool to run antivirus software such as Malwarebytes, Combofix, Emsisoft, etc.

Having this tool available could really help out humanity in the fight against cyber-crime and internet hooligans.

Only by numbers will a competent person do the right thing and respond with an answer.
"Like" this post to show that I'm not alone in this view.

-GreatG

ok, here is a quickie version of the instructions. These assume that you know how to use regedit and understand the basics of the registry, etc...

Hope that this helps.

----
1: Download and install the Windows 7 WAIK plus the WAIK update for Win 7 SP1
(see MS download site for directions on this)
2: Create a Base Win 7 PE image using WAIK.
(again see documentation online. below is the batch file that I use.)
------------------
call "C:Program FilesWindows AIKToolsPETools"copype.cmd x86 c:winpe-x86
pause
Dism /Mount-Wim /WimFile:C:winpe-x86winpe.wim /index:1 /MountDir:C:winpe-x86mount
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-hta.cab"
rem dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-legacysetup.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-mdac.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-pppoe.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-scripting.cab"
rem dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-setup.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-wds-tools.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPswinpe-wmi.cab"

dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uslp_en-us.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-hta_en-us.cab"
rem dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-legacysetup_en-us.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-mdac_en-us.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-PPPOE_en-us.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-scripting_en-us.cab"
rem dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-setup_en-us.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-wds-tools_en-us.cab"
dism /image:C:winpe-x86mount /Add-Package /PackagePath:"C:Program FilesWindows AIKToolsPEToolsx86WinPE_FPsen-uswinpe-wmi_en-us.cab"

rem - set language

Dism /image:C:winpe-x86mount /Set-AllIntl:en-US

rem - list packages

Dism /image:C:winpe-x86mount /Get-Packages
pause
copy "C:Program FilesWindows AIKToolsx86imagex.exe" C:winpe-x86mountWindowsSystem32
rem - unmount wim file
Dism /Unmount-Wim /MountDir:C:winpe-x86mount /Commit

pause
-----------------------------------
Note: Before writing a new Bootable DVD / iso image containing your finished DVD, you will have to rename the winpe.wim file to Boot.Wim
I went ahead and did this step before continuing.

3: Using the Win 7 SP1 integrated Boot DVD, extract the Install.Wim file (found in Sources folder on DVD).
* note: you will have several versions in the Install.Wim file. I use the one under #5 which is for Windows 7 Ultimate edition for my source files.
I think that Winzip will extract the files from the Install.wim )
4: Mount the Wim file created in step 2 to a temporary folder.
(example: command line that I use to do this is : dism /Mount-Wim /WimFile:C:winpe-x86Boot.wim /index:1 /MountDir:D:_Win7PE_Mount )
*from now on, when I refer to the extacted install.wim file, I will use 'InstallPoint' and when I refer to the Windows PE mount point, I will
use 'MountPoint' **
5: copy the following folders from the 'InstallPoint' to the 'MountPoint'.
when prompted, Merge folders and do NOT replace existing files.
InstallPoint:Documents and SEttings
InstallPoint:Perlogs
InstallPoint:Program Files
InstallPoint:ProgramData
InstallPoint:USERS
6: Copy the contents (FILES only, no Folders/Subfolders) from
InstallPoint:Windows to MountPoint:Windows
Do NOT replace existing files.
7: Copy the folder 'InstallPoint:windowssystem' to 'MountPoint:Windows' (end result is that you have a windowssystem folder now in the MountPoint)
8: *Important: Read this entire step before beginning **
Next, we are going to copy what is needed from the system32 folder
*copy only files only at this step. NOT Folders/Subfolders*
*to save space, I recommend excluding / NOT copying the following files:
c_*.nls
kbd*.dll
nlsdata*.dll
nlslex*.dll

Copy the files from InstallPoint:Windowssystem32 to MountPoint:WindowsSystem32
*Remember: NO Subfolders and do NOT replace existing files *
9: copy the following FOLDERS from 'InstallPoint:Windows to MountPoint:Windows
*Merge folders when prompted, do NOT replace existing files.*
addins
AppCompat
AppPatch
assembly
BitLockerDiscoveryVolumeContents
CSC
Cursors
debug
diagnostics
DigitalLocker
DownloadedProgramFiles
en-US
en
Globalization
HELP
IME
L2Schemas
LiveKernalReports
Media
Microsfot.net
ModemLogs
Offline Web Pages
Performance
PLA
Registration
RemotePackages
rescache
SchCache
ServiceProfiles
Setup
Shellnew
tapi
Tasks
Tracing
Twaing_32
vss
web
10: REmove the following folders from the MountPoint:WindowsSystem32 folder.
*unneeded for English language Win PE*)
ar-SA
bg-BG
cs-CZ
da-DK
de-DE
el-GR
es-ES
et-EE
fi-FI
fr-FR
he-IL
hr-HR
hu-HU
it-IT
ja-JP
ko-KR
lt-LT
lv-LV
nb-NO
nl-NL
pl-PL
pt-BR
pt-PT
ro-RO
ru-RU
sk-SK
sl-SI
sr-Latn-CS
sv-SE
th-TH
tr-TR
uk-UA
zh-CN
zh-HK
zh-TW

11: REmove the following folders from the MountPOint to reduce size.
program filesdvd maker
program filesgames
12: Copy over the following folders from the InstallPoint:windowsSystem32 folder to the MountPoint:Windowssystem32 folder
Do NOT replace existing files
If/When Prompted, Merge folders.
0409
drivers
en
en-us
MUI
wbem
***** This will give you all the files needed (and some extra) to create a Basic Win 7 SP1 based PE disk and allow explorer.exe to be run*****
REGISTRY KEYS:
This part will get a bit complicated.
1: We need to get a complete ClassesRoot registry key for Explorer to work properly (and additional keys).
A: use regedit to mount InstallSource:windowssystem32configsoftware hive to HKLMSOFTWARESOFTWARE_FROM_CD
b: use regedit to export HKLMSoftwareSoftware_From_CDCLASSES to .reg file
use regedit to export HKLMSoftwareSoftware_From_CDMicrosoftWindowsCurrentVersionExplorer to a .reg file
use regedit to export HKLMSoftwareSoftware_from_CDMicrosoftInternet Explorer to a .reg file.
c: Unmount HKLMSOFTWARESOFTWARE_FROM_CD hive.
For each of the files created in step B, do the following:
d: use a text editor (notepad) to edit the files from step B and replace "Software_from_CD" to "Software_FROM_PE"
Use a text editor (notepad) to edit the files to search and remove all instances of "Interactive User' from the file.
Use a text editor (notepad) to edit the files to search and replace "44,00,3a,00,5c" with "58,00,3a,00,5c"
*this replaces the hex codes for "D:" with "X:"
Use a text editor (notepad) to edit the files to search and replace "D:" with "X:"
Save each of the files (*example: Classes_for_pe.reg)
E: Use regedit to mount MountPoint:windowssystem32configsoftware hive to HKLMSOFTWARESoftware_FROM_PE
F: rename the "HKLMSoftwareSoftware_from_PEClasses" key to Classes.old
*just in case you need it*
G: import the reg files from step B.
(* This should create a new classes key in the HKLMSOFTWAREClasses_FOR_PE" key called Classes
(* Now you should see "HKLMSoftwareSoftware_FOR_PEClasses.old" and "HKLMSoftwareSoftware_FOR_PEClasses"
H Now, you will need to create the following value in the registry.
Browse to the key : HKLMSoftwareSoftware_FROM_PEMicrosoftWindows NTCurrentVersionWinlogon
using regedit, Right click on the right pane and create a new value.
Value Name: Shell
Value Type: String
Value shound be: explorer.exe
J: Unmount the HKLMSOFTWARESoftware_FROM_PE hive.
K: Unmount the MountPointWim file
(example: DISM /Unmount-Wim /MountDir:D:_Win7PE_Mount /commit )
L: Create your bootable ISO image.
(example batch file that I use to do this:
------
copy "C:Program FilesWindows AIKToolsx86Imagex.exe" C:Winpe-x86ISO
cd "C:Program FilesWindows AIKToolsx86"
oscdimg -n -bc:winpe-x86etfsboot.com c:winpe-x86ISO c:winpe-x86winpe-x86.iso
pause
------
test with virtual machine.