Jump to content











Photo
- - - - -

How to change the path boot.ini of NTLDR in Windows XP


  • Please log in to reply
5 replies to this topic

#1 meoit

meoit

    Newbie

  • Members
  • 23 posts
  • Location:Linux
  •  
    Thailand

Posted 06 September 2016 - 04:23 AM

Hello all.

 

Today, I have a question.

 

How to change the path boot.ini of NTLDR in Windows XP?.

 

Normal, Boot.ini located in C:\

 

Now, I want custom to C:\MyPath\Boot.ini

 

So, this is possiable?.

 

Thanks.



#2 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13748 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 06 September 2016 - 07:45 AM

Not really, unless you hack the NTLDR.

What you can try doing is to plainly hex-edit it, BUT you need to stay within the \BOOT.INI length, a similar approach works/worked in some tests, but needs to be confirmed, please remember that some versions of NTLDR have a checksum.

Something *like*

\1234\bi

might do, see:
http://www.msfn.org/...can-be-omitted/
Only seemingly unrelated:

http://www.911cd.net...showtopic=24649

http://reboot.pro/to...lash-drive-ufd/

 

 

:duff:

Wonko


  • meoit likes this

#3 meoit

meoit

    Newbie

  • Members
  • 23 posts
  • Location:Linux
  •  
    Thailand

Posted 06 September 2016 - 03:27 PM

Thanks Wonko!.

 

But "\MyPath\Boot.ini" string length = 16

and "\boot.ini" string length = 9

 

Not equal :|

 

How can I increase string length by using HexEditor/ HxD / Hex WorkShop?.



#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13748 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 06 September 2016 - 06:59 PM

Thanks Wonko!.

 

But "\MyPath\Boot.ini" string length = 16

and "\boot.ini" string length = 9

 

Not equal :|

 

How can I increase string length by using HexEditor/ HxD / Hex WorkShop?.

 

EXACTLY. :)

 

EITHER:

You "plainly hex edit" the NTLDR with HexEditor/HxD/Hex Workshop (relatively easy but "limited" to the 9 characters of "available space").

OR:

You "hack" the NTLDR i,e, you disassemble/reverse engineer the NTLDR, find pointers to that string, create a "code cave" of some kind or move the pointers to an existing one, and re-build the NTLDR

 

The latter more or less equates to "don't EVEN THINK of attempting this", after several hours, days, weeks of banging your head against the problem, you won't make it anyway :(.

 

:duff:

Wonko


  • meoit likes this

#5 meoit

meoit

    Newbie

  • Members
  • 23 posts
  • Location:Linux
  •  
    Thailand

Posted 07 September 2016 - 05:04 AM

Thanks Wonko

 

So, how to I can disassemble / reverse engineer NTLDR ?.



#6 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13748 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 07 September 2016 - 08:27 AM

You would probably start here:

http://reboot.pro/to...disksys-xp2003/
https://codywu2010.w...ldr-first-part/

http://www.reteam.or...hread.php?t=323

http://standa-note.b...of-windows.html

but where exactly (and when) you will arrive is to be seen.

Without being VERY familiar with the theory of operation and with the specific tools needed it will be a loong journey, as you will need to learn (and learn quickly) quite a few things.

 

:duff:

Wonko






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users