Jump to content











Photo
- - - - -

booting vista/2008/w7 from usb sub folder


  • Please log in to reply
175 replies to this topic

#1 anystupidname

anystupidname
  • Members
  • 5 posts
  •  
    United States

Posted 21 May 2009 - 06:54 PM

I have placed the win2008 (32bit) install files to x\2K8 on my thumb drive.

directory structure looks like this:

root

x

2K8

boot

efi

sources

...

bootmgr

W7b

XPP

root
(the usual menu.lst and other submenus and grldr are on root)

Using a menu.lst entry such as:

title blah
find --set-root /bootmgr
chainloader /bootmgr

or other variations, I try to initiate the boot/install but the bootmgr fails (not grub4dos) saying it can't locate "\boot\BCD" which is here "\x\2K8\boot\". I tried with bootmgr in the root of the thumb drive just for giggles too. I've also tried the thumb drive formatted FAT32 but it is currently NTFS. Neither seems to make a difference although NTFS has less fragmentation problems.

Any suggestions would be much appreciated.

#2 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 22 May 2009 - 09:10 AM

Well, you cannot do whatever you want, and definitely NOT with Windows files.

\boot\BCD needs to be in \boot\BCD, as it is hard coded in BOOTMGR.

Or you need to hexedit and patch BOOTMGR.

The path is fixed and it is independent from the filesystem used.

READ here:
http://www.911cd.net...showtopic=19168
http://www.boot-land...?showtopic=1656

jaclaz

#3 anystupidname

anystupidname
  • Members
  • 5 posts
  •  
    United States

Posted 24 May 2009 - 12:59 AM

Well, you cannot do whatever you want, and definitely NOT with Windows files.


But but but, I WANNA...!

\boot\BCD needs to be in \boot\BCD, as it is hard coded in BOOTMGR.

Or you need to hexedit and patch BOOTMGR.

The path is fixed and it is independent from the filesystem used.

READ here:
http://www.911cd.net...showtopic=19168
http://www.boot-land...?showtopic=1656

jaclaz


OK, thanks, I'll give that a try.

#4 clunk

clunk
  • Members
  • 3 posts
  •  
    United States

Posted 02 June 2009 - 12:51 AM

\boot\BCD needs to be in \boot\BCD, as it is hard coded in BOOTMGR.

Or you need to hexedit and patch BOOTMGR.


My situation is close to the original poster...

I have googled everywhere for a guide or something to hexedit BOOTMGR, but I cannot find one that works. I looked at the links you provided but I do not see any reference to \Boot\BCD anywhere in BOOTMGR, and I've used about 4 different hex editors just to make sure.

Anywho, what I am trying to do is have a vista pe and also have a vista installer, bootable from usb, and I can select whether to run the PE or install Vista. I have both PE's complete, there is nothing wrong with them, and I have grub4dos configured. I just want to have two bootmgr files (one named bootmgr for the PE, and one named vstamgr, for vista.) I want the bootmgr to point to \boot\BCD, and vstamgr to point to \boot\VST (or whatever name will work).

I know it's possible, I've seen people say they have done it before...

Also, is BOOTMGR and BOOTMGR.EXE the same thing? I have a BOOTMGR file, but I haven't come across any EXE's....

Please help jaclaz, I know you can ;)

#5 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 02 June 2009 - 06:04 AM

BOOTMGR is the Vista/7 bootmanager.

BOOTMGR.EXE is the PXE Vista/7 bootmanager.

What you want to hexedit is BOOTMGR (with NO extension).

IF BOOTMGR.EXE vs. BOOTMGR is similar to the known SETUPLDR.BIN vs. SETUPLDR.EXE, the BOOTMGR is BOOTMGR.EXE with the initial code stripped off.

See this:
http://www.boot-land...amp;#entry10580

You need to search for UNICODE strings.

Though it won't be that easy.

Here:
http://www.911cd.net...showtopic=19168

Victor888 says BOOTMGR can't be modified.

He usually knows where his towel is. ;) ;)

Why don't you simply edit the BCD store:
  • 1 BOOTMGR
  • 1 BCD (in \boot\BCD)
  • 2 Entries in it
like all the rest of the world? :)

A site that you may find interesting:
http://www.multibooters.co.uk/

jaclaz

#6 was_JFX

was_JFX

    Frequent Member

  • Advanced user
  • 483 posts
  •  
    Germany

Posted 02 June 2009 - 05:05 PM

I want the bootmgr to point to \boot\BCD, and vstamgr to point to \boot\VST (or whatever name will work).

You need a bootmgr form a vista SP0 dvd (CRC: 543E715A)

At adress 54B68 there should be BCD in UNICODE which you can change to VST.

To get rich of the checksum protection change 74 03 to EB 1A at adress E28.

Save the new file as vstamgr, that's all.

#7 clunk

clunk
  • Members
  • 3 posts
  •  
    United States

Posted 02 June 2009 - 06:24 PM

You need a bootmgr form a vista SP0 dvd (CRC: 543E715A)

At adress 54B68 there should be BCD in UNICODE which you can change to VST.

To get rich of the checksum protection change 74 03 to EB 1A at adress E28.

Save the new file as vstamgr, that's all.



Thanks!!! That did the trick!
I kept using the bootmgr off a Vista SP1 DVD so maybe thats why...

The reason I wanted separate bootmgr's and BCD's is so I can just use the grub4dos menu, instead of going to the bootmgr and selecting what to boot to from that. Saves an extra step.

Thanks a bunch!

#8 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 02 June 2009 - 06:31 PM

The reason I wanted separate bootmgr's and BCD's is so I can just use the grub4dos menu, instead of going to the bootmgr and selecting what to boot to from that. Saves an extra step.


I see. ;)

Happy that a solution has been found. ;)

Maybe a missing feature of grub4dos is the ability, like good ol' XOSL had, to "feed" a sequence of characters to the chainloaded target. :)

With XOSL, if you had a BOOT.INI with two choices, you could make a menu entry that sent a "ENTER" directly (and thus select and boot the default item), one sending a "down arrow" and an "ENTER", thus selecting and booting first item, and one sending "down arrow", down arrow" and "ENTER" and thus selecting and booting second item.

jaclaz

#9 CypherBit

CypherBit

    Newbie

  • Members
  • 10 posts
  •  
    Slovenia

Posted 31 July 2009 - 10:52 PM

I'm trying to do something similar but failing.

The structure of my USB is such that grldr and menu.lst are at the root and that's it as far as files. WinPE 3.0 RC (which works just fine if copied on the root) needs to be in a folder named WinPE.

If I just copy the entire structure under the WinPE folder and use:
title Windows PE 3.0 RC

find --set-root /winpe/bootmgr

chainloader /winpe/bootmgr
I get "an error occurred while attempting to read the boot configuration data".

I tried following the suggestion from JFX by using a hex editor and adding WinPE before BCD, but that produces "Will boot NTLDR from drive 0x80, partition=0x0(hidden sectors=0x3f) "

Is what I'm trying to do even possible...since I'm not just changing, but adding quite a few characters to bootmgr? Any other way of doing it, will making any changes to BCD help (such as: device ramdisk=[boot]\winpe\sources\boot.wim,{7619dcc8-fafe-11d9-b411-000476eba25f})?

#10 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 01 August 2009 - 08:00 AM

I tried following the suggestion from JFX by using a hex editor and adding WinPE before BCD, but that produces "Will boot NTLDR from drive 0x80, partition=0x0(hidden sectors=0x3f) "

Is what I'm trying to do even possible...since I'm not just changing, but adding quite a few characters to bootmgr? Any other way of doing it, will making any changes to BCD help (such as: device ramdisk=[boot]\winpe\sources\boot.wim,{7619dcc8-fafe-11d9-b411-000476eba25f})?


Well, NO.

JFX said that you can change the 3 (three) characters BCD to some other 3 (three) characters.

If you want to hex-edit BOOTMGR adding (or removing) characters you need to patch ALL or most "jmp" instructions inside the BOOTMGR code, which are probably in the order of magnitude of several hundreds.

It would be faster re-writing a BOOTMGR substitute starting from scratch.

An example to clear the base concept

0x010 jump to address 0x15
0x012 text "BCD"
0x015 do something else


If you change the three characters, it will become:

0x010 jump to address 0x15
0x012 text "VST"
0x015 do something else

and it will work, since the "do something else" is still at address 0x015.
If you add a 2 characters, like winpe:

0x010 jump to address 0x15
0x012 text "WINPE"
0x017 do something else

it won't work, and you need to patch the jmp:

0x010 jump to address 0x017
0x012 text "WINPE"
0x017 do something else


jaclaz

#11 CypherBit

CypherBit

    Newbie

  • Members
  • 10 posts
  •  
    Slovenia

Posted 01 August 2009 - 08:50 AM

Thank you for the explanation jaclaz, I thought why not try.

You said "It would be faster re-writing a BOOTMGR substitute starting from scratch.", since changing all the jmp instructions is probably not the way to go. How do I go about doing this?

Is there any other method of making this work so the files are all neatly in one folder and not at the root?

#12 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 01 August 2009 - 11:38 AM

You said "It would be faster re-writing a BOOTMGR substitute starting from scratch.", since changing all the jmp instructions is probably not the way to go. How do I go about doing this?

It's a CATCH 22, if you need to ask it, you can't do it. :P

Is there any other method of making this work so the files are all neatly in one folder and not at the root?


NO, but if you use 3 (three) characters it works.

Now, not counting punctuation signs and extended characters you have 26 A...Z and 10 0...9 characters to choose from, which, if my math doesn't fail me today, give you 36^3 possibilities, i.e. 46,656 different combinations.

A bird in the hand is worth two in the bush


:P

If you just "clear" your mind from what you wanted to do and shorten WinPE to WPE, you can do it. :idea:

:)

jaclaz

#13 maanu

maanu

    Gold Member

  • Advanced user
  • 1134 posts
  •  
    Pakistan

Posted 01 August 2009 - 04:00 PM

hi jfx ,

i was just wondering if it is possible to use the patched bootmgr to use on 7 ? either pe or as installed OS ?

a guy at wuyou forums developed a tool to edit bcd . at least thats what i could understand . he has the same nick on znpc , and is the same guy who coded gui for fbinst /,
i have requested him to do an english version . i hope he ll reply ...

#14 was_JFX

was_JFX

    Frequent Member

  • Advanced user
  • 483 posts
  •  
    Germany

Posted 01 August 2009 - 04:12 PM

hi maanu,

Well possible is it, but not so flexible as with Vista SP0 one, the nice M$ guys have given this file a stupid protection. :idea:

If I have some time I will create a Patcher for the 4 RTM files (Vista SP0/Sp1/SP2 and Seven SP0).

Currently other things have my attention, but may 2 weeks this should be done.

:P

#15 CypherBit

CypherBit

    Newbie

  • Members
  • 10 posts
  •  
    Slovenia

Posted 01 August 2009 - 04:49 PM

If you just "clear" your mind from what you wanted to do and shorten WinPE to WPE, you can do it. :idea:

I'm definitely willing to try other things, but I don't quite understand how shortening WinPE to WPE does the trick, since the bootmgr still points to BOOT\BCD and not WPE\BOOT\BCD. Changing it to BOOT\WPE dioesn't mean I have a single folder on the root of the USB.

I could of course be missing your point altogether (if so please be a bit more verbose).

#16 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 01 August 2009 - 06:01 PM

I'm definitely willing to try other things, but I don't quite understand how shortening WinPE to WPE does the trick, since the bootmgr still points to BOOT\BCD and not WPE\BOOT\BCD. Changing it to BOOT\WPE dioesn't mean I have a single folder on the root of the USB.

I could of course be missing your point altogether (if so please be a bit more verbose).


What I posted was just an example for the three characters BCD->WPE, i.e. I was just trying to explain how hexediting a file works (or completely fails to).

It does not necessarily "do the trick", but it's all you have available, now.

Life is tough. :P

AFAIK noone has found a way to do what you want to, or to say it better to do what it seems like you are wanting to.

So this:

needs to be in a folder named WinPE.

should be rephrased:
your choice:
  • not actually "needed"
  • still "needed" and undoable

If you explain WHY it is "needed" there may be alternative ways to reach that goal.

For example if the "need" is that of NOT having a \boot\ directory in root, this can be done by using a floppy image :P:
http://www.multibooters.co.uk/
http://www.multiboot....uk/floppy.html

Explain which are the limitations you have, and maybe a solution or a workaround may come out. :)

:idea:

jaclaz

#17 CypherBit

CypherBit

    Newbie

  • Members
  • 10 posts
  •  
    Slovenia

Posted 01 August 2009 - 06:16 PM

jaclaz thank you for the quick replies.

You're right it's not a requirement, more a desire of mine. I'd like to setup my Multiboot USB so I only have two files at the root, grldr and menu.lst. Then for each OS a separate folder, so the root would look like this:

grldr
menu.lst
WPE
DellDiagnostic
Memtest
KonBoot
...

It's basically just ascetics and the fact I'd have an easier time distinguishing between all the OSs , esp. when I need to update/replace one of them with a newer version. I only want to carry around a single USB key so a floppy isn't an option.

If having WinPE in a folder and not spread around in BOOT, EFI, SOURCES all over the root is not an option, I'll live with it, but I'm willing (with assistance) to experiment quite a bit before giving in.

#18 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 01 August 2009 - 07:00 PM

If having WinPE in a folder and not spread around in BOOT, EFI, SOURCES all over the root is not an option, I'll live with it, but I'm willing (with assistance) to experiment quite a bit before giving in.

Right attitude! :P

It's basically just ascetics and the fact I'd have an easier time distinguishing between all the OSs , esp. when I need to update/replace one of them with a newer version. I only want to carry around a single USB key so a floppy isn't an option.


Well, I was talking about a floppy image (saved wherever you like on the USB stick and mapped/loaded with grub4dos).....:idea:

Now:
  • we can most probably get away with \BOOT
  • EFI should not be needed on a non EFI platform :)
  • I also guess that \Sources\ path can be changed somehow and somewhere :P

:P

jaclaz

#19 CypherBit

CypherBit

    Newbie

  • Members
  • 10 posts
  •  
    Slovenia

Posted 01 August 2009 - 08:12 PM

I had an idea and unfortunately it appears it's a bad one.
I thought why not edit bootmgr by changing from BOOT\BCD to WiPE\BCD. Then copy the entire content of BOOT to WiPE. And SOURCES to WiPE as well. It produces "Will boot NTLDR from drive 0x80, partition=0x0(hidden sectors=0x3f)".

Does this error relate to bootmgr being incorrect or BCD or something else alltogether?

I like the idea of a floppy image, if that would do what I need, but I currently have no idea how to even get started in that direction.

#20 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 02 August 2009 - 10:08 AM

I had an idea and unfortunately it appears it's a bad one.
I thought why not edit bootmgr by changing from BOOT\BCD to WiPE\BCD. Then copy the entire content of BOOT to WiPE. And SOURCES to WiPE as well. It produces "Will boot NTLDR from drive 0x80, partition=0x0(hidden sectors=0x3f)".

Does this error relate to bootmgr being incorrect or BCD or something else alltogether?

I like the idea of a floppy image, if that would do what I need, but I currently have no idea how to even get started in that direction.


WHAT produces that? :idea:

The message:

"Will boot NTLDR from drive 0x80, partition=0x0(hidden sectors=0x3f)"


is the output of a grub4dos command root(hdx,y).

If you are using command line mode, you should issue, after you get that message a boot command.

I.e. it seems that you didn't EVEN START booting. :P

About floppy image, it's easy, just install to your sistem a virtual floppy disk driver, such as VFD from ken kato (more specifically a floppy disk driver):
http://chitchat.at.i...vmware/vfd.html
or IMDISK (a more general virtual disk driver):
http://www.ltr-data.se/opencode.html
http://www.boot-land...s/?showforum=59

then, read "between the lines" of these:
http://www.boot-land...?showtopic=3963
http://www.msfn.org/...howtopic=127593
http://www.boot-land...?showtopic=8555

And follow the given article:
http://www.multiboot....uk/floppy.html

jaclaz

#21 ktp

ktp

    Silver Member

  • Advanced user
  • 773 posts

Posted 04 August 2009 - 09:28 AM

@CypherBit

About patching bootmgr.exe, I found this topic that could be of interest :
http://www.boot-land...?showtopic=1656 (post #3)

#22 was_jaclaz

was_jaclaz

    Finder

  • Advanced user
  • 7101 posts
  • Location:Gone in the mist
  •  
    Italy

Posted 04 August 2009 - 09:59 AM

@CypherBit

About patching bootmgr.exe, I found this topic that could be of interest :
http://www.boot-land...?showtopic=1656 (post #3)


...which opens a whole new range of possibilities, when compared to this one (post #2 of this thread) :):

...
READ here:
...
http://www.boot-land...?showtopic=1656
...


:idea:

:P

:P

jaclaz

#23 zhdali

zhdali
  • Members
  • 1 posts
  •  
    Italy

Posted 27 December 2009 - 09:40 PM

hi maanu,

Well possible is it, but not so flexible as with Vista SP0 one, the nice M$ guys have given this file a stupid protection. :dubbio:

If I have some time I will create a Patcher for the 4 RTM files (Vista SP0/Sp1/SP2 and Seven SP0).

Currently other things have my attention, but may 2 weeks this should be done.

;)


I have searched for a while in the forum but not find another useful information about hexedit bootmgr.
I followed the instructions to patch bootmgr from JFX (post #6 of this topic ) and everything works perfectly, i can now boot multiple version of winpe (seven and vista) directly from grub menu.
But I would be able to patch the bootmgr of windows 7, (on some pc vista sp0 bootmgr hangs). Does anyone know how to do for bypass the checksum error of the file, or may indicate a link with some explanation?

#24 was_JFX

was_JFX

    Frequent Member

  • Advanced user
  • 483 posts
  •  
    Germany

Posted 29 December 2009 - 12:17 AM

My, my how fast the time can pass ;)

Well, with Vista SP2 version and later, there are now at least 3 protections, that avoid modification of bootmgr file.

However, the RC's and the Vista SP0 versions of bootmgr containing the exact same 32bit binary like the bootmgr.exe in Windows\Boot\PXE folder inside boot.wim.

This PXE one in Win7 version looks very clean. :)

If anyone get this one with any stub working for normal boot, there might be a chance.


BTW: Don't know but couldn't something like the NT boot floppy help here :)


;)

#25 steve6375

steve6375

    Platinum Member

  • Developer
  • 7566 posts
  • Location:UK
  • Interests:computers, programming (masm,vb6,C,vbs), photography,TV,films
  •  
    United Kingdom

Posted 30 March 2010 - 02:17 PM

You need a bootmgr form a vista SP0 dvd (CRC: 543E715A)

At adress 54B68 there should be BCD in UNICODE which you can change to VST.

To get rich of the checksum protection change 74 03 to EB 1A at adress E28.

Save the new file as vstamgr, that's all.


This patch is incorrect. You need to patch address E28 with the bytes EB 03.

If using debug then the instructions are (to make it use \boot\bc1 instead of \boot\bcd) - what you type is in bold

D:\>copy bootmgr bootmg1
1 file(s) copied.

D:\>debug bootmg1
-r
AX=0000 BX=0006 CX=B238 DX=0000 SP=E625 BP=0100 SI=0000 DI=0000
DS=18CA ES=18CA SS=18CA CS=18CA IP=0100 NV UP EI PL NZ NA PO NC
18CA:0100 E9D501 JMP 02D8
-e f28
18CA:0F28 74.eb<space> 03.03 <space> E9. <enter>
-e 68ca:4c6c (note add 5000 to address in italics)
68CA:4C68 42.31 00. <enter>
-w
Writing 6B238 bytes
-q

You now have bootmg1 which will use \boot\bc1 instead of \boot\bcd

change 31 to 32 for bc2, or 33 for bc3, etc.


To make a new BCD file run this script

copy \boot\bcd \boot\bc1
bcdedit /store \boot\bc1 /set {bootmgr} nointegritychecks YES
bcdedit /store \boot\bc1 /create {ramdiskoptions} /d "Ramdisk options"
bcdedit /store \boot\bc1 /set {ramdiskoptions} ramdisksdidevice boot
bcdedit /store \boot\bc1 /set {ramdiskoptions} ramdisksdipath \Boot\boot.sdi
bcdedit /store \boot\bc1 /set {default} device ramdisk=[boot]\sources\boot1.wim,{ramdiskoptions}
bcdedit /store \boot\bc1 /set {default} osdevice ramdisk=[boot]\sources\boot1.wim,{ramdiskoptions}


@jaclaz

I am trying to patch bootmgr using grub4dos write command.
If I do

chainloader /bootmgr

and then read 0x7c00 I do NOT get the first 4 bytes of bootmgr. I want to patch the bootmgr as above but I can't seem to find the correct locations in memory once chainloaded???
  • KamrulCox likes this




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users