12 replies to this topic

[pscEx]

I have the following

Two nativeEx XP builds with FBWF differring only in Misc Setting:

• Open explorer.exe as shell
• Open cmd.exe as shell

After the builds, the %Target% are identical, besides the explorer/cmd entries in registry.

Maybe it should be mentioned that Misc Settings starts primarily PELoader as shell, which then loads Explorer / Cmd.

In Explorer shell, FBWF works with "Echo bla > x"
In Cmd shell, "Echo bla > x" gives the error "access denied". IMO that means, the disk is not writable, or better: fbwf cannot / does not buffer.

"net start fbwf " does not help.
Next "net start fbwf" brings the message that the service is already running.

IMO, starting the shell, does some magic actions.

To avoid Wonko's "yes", I do not ask "Does somebody know, ..."

My questions:
What are the magic actions?
How can I record them?

Peter

[Wonko the Sane]

"net start fbwf " does not help.
Next "net start fbwf" brings the message that the service is already running.

HOW is the FBWF service installed?

Maybe you can SC or INSTSRVR or DEVCON it.

The "net start" working the first time should mean that the driver is installed (but not running), but are all the (whatever) settings needed for FBWF in the Registry?

Or, in other words, would explorer automatically create "links" or "Re

[pscEx]

Here the console output when PELoader launches explorer.exe

And here when launching cmd.exe

For me the final status look identical.

Peter

[Wonko the Sane]

For me the final status look identical.

Yes.

What happens if you kill the cmd.exe session? (it should re-start automatically since it is designated as "shell")

Could it be some kind of dependency on another driver/service (that Explorer auto-starts and cmd.exe doesn't - just like it seems like happening to FBWF?)


Wonko

[pscEx]

What happens if you kill the cmd.exe session? (it should re-start automatically since it is designated as "shell")

Could it be some kind of dependency on another driver/service (that Explorer auto-starts and cmd.exe doesn't - just like it seems like happening to FBWF?)

#1: Kill reboots emulator and real CD.
#2 was exactly my question post #1:

IMO, starting the shell, does some magic actions.

My questions:
What are the magic actions?
How can I record them?

Peter

[Wonko the Sane]

#1: Kill reboots emulator and real CD.

This is "strange", maybe it is a behaviour "PE peculiar", this is the way I use in XPCLI to load bblean.

Any "DependonService" in the Registry?
http://support.micro...kb/193888/en-us
http://www.windowsne...pendencies.html


Wonko

[Rui Paz]

Here the console output when PELoader launches explorer.exe

And here when launching cmd.exe

For me the final status look identical.

Peter

Hi,

Based on the screenshots seems to me that you are not doing the exact same test on both builds, on first you are trying to write on drive R: and on the second on drive X: if i'm not wrong R: is Ram drive so it must be writable.

Maybe the fact of some path is missing can give this problem with FBWF.
___
Rui Paz

[pscEx]

Thanks!

I did not realize that!

I'm going to check everything again.

Peter

[pscEx]

Now test with cd to X:
No difference.

Peter

[pscEx]

I found it!

IMO, starting the shell, does some magic actions.
What are the magic actions?

Starting explorer.exe, processes the registry RunOnce ... entries.
That is not done when startimg cmd.exe.

rundll32 iernonce.dll,RunOnceExProcess

Solves the issue

Peter

[Wonko the Sane]

Good , but this looks like a workaround, according to:
http://dll.paretolog...il.php/iernonce
http://www.win7dll.i...rnonce_dll.html
http://www.msfn.org/...showtopic=19492
http://www.boot-land...?showtopic=4929
it could be that the "missing step" is not really iernonce.dll, but one of it's dependencies or Registry keys....

Maybe there is another way to run the same "keys" without needng this .dll?



Wonko

[pscEx]

Thanks, Wonko!

Currently I omly can repeat in my bad English, what an old Greek said: "I know that I know nothing ..."

This "RunOnce" seems not to solve all issues. I found situations where FBWF did not work. It really seems to depend on Explorer INSTALLED.

I postponed (for me) a deeper investigation.

Peter

[Wonko the Sane]

Currently I omly can repeat in my bad English, what an old Greek said: "I know that I know nothing ..."

Which makes a nice, round, TWO of us!


Wonko