7 replies to this topic

[Antonjo]

After looking around for a while, I am unable to find a proper reference to devio.exe switches and formats, such as "shm:..."

 

Any reference? 

 

[Wonko the Sane]

After looking around for a while, I am unable to find a proper reference to devio.exe switches and formats, such as "shm:..."

 

Any reference? 

ON command line devio:

 

 

devio - Device I/O Service ver 3.02
With support for Microsoft VHD format, custom DLL files and shared memory proxy
operation.
Copyright © 2005-2012 Olof Lagerkvist.

Usage:
devio [-r] tcp-port|commdev diskdev [blocks] [offset] [alignm] [buffersize]
devio [-r] tcp-port|commdev diskdev [partitionnumber] [alignm] [buffersize]

tcp-port can be any free tcp port where this service should listen for incoming
client connections.

commdev is a path to a communications port, named pipe or similar where this
service should listen for incoming client connections.

commdev can also start with shm: followed by an section object name for using
shared memory communication.

Default number of blocks is 0. When running on Windows the program will try to
get the size of the image file or partition automatically, otherwise the client
must know the exact size without help from this service.

Default number of blocks for dynamically expanding VHD image files are read
automatically from VHD header structure within image file.

Default alignment is 1 bytes.
Default buffer size is 2097152 bytes.

For syntax help with custom I/O DLL under Windows, type:
devio --dll

Our good friend Olof  has a knack (just like all the good Linux guys and most programmers generally) to provide (often complex) syntax explanation/reference in a non-intuitive (and rigorously without examples) way.

 

Wonko

[Antonjo]

 

Thanks. I am able to create a 100M virtual disk

 

aim_ll -a -s 100M -f .\abc.ima

Then, with Windows diskmgmt.msc, I can create and format two partitions on it.

Dismount it:

 

aim_ll -d

and mount the second partition with:

 

devio shm:hd1 .\abc.ima  2
aim_ll -a -t proxy -o shm -f hd1

Can I also partition/format it with the CLI? I mean something similar to:

 

imdisk -a -t file -s 100M -f .\abc.ima -p "/fs:NTFS /q /v:ImDisk /y /c"

but including partitions.

[Wonko the Sane]

I don't get it.

 

You have a disk driver (the Arsenal Image Mounter) that mounts a "whole disk" image as if it was a real disk.

On this real disk you can use - say - Diskpart to create and format partitions.

When you use IMDISK you (notwithstanding the name) you have a volume driver that mounts a "volume" [1] that has an option to directly run the "normal" format windows executable. (in this latter case the format will happen as if it was a "floppy", i.e. with 0 sectors before).

Then you have devio which is a sort of "redirector" or "proxy", i.e. it (magically) transforms "something" into an object accessible by the driver.

Of course which object is accessible will determine what operations are possible on it.

If you share via devio ONLY the 2nd partition most probably that is ONLY a drive (please read as "volume" [1]) just like what you mount in IMDISK, and you can of course format it (with the same caveat as above) but you cannot obviously partition it.

Olof attempted to make the AIM as similar to IMDISK as possible, so yes , the -p option in AIM_LL has the same functionalities as in IMDISK.

Do run:

aim_ll.exe 2>aim_ll.txt

to be able to have an easy to read output of the help, you will find:

 

-p "format-parameters"

If -p is specified the 'format' command is invoked to create a

filesystem when the new virtual disk has been created.

"format-parameters" must be a parameter string enclosed within

double-quotes. The string is added to the command line that starts

'format'. You usually specify something like "/fs:ntfs /q /y", that

is, create an NTFS filesystem with quick formatting and without user

interaction.

 

But - more generally - you might want to describe the actual problem and ask the actual questions (the final scope, rather than the how to do something along the route you chose to get to that scope, maybe there is a shorter or better way)

 

Wonko

 

 

[1] in this context "volume" means "the whatever that gets a drive letter in explorer" it is years we are debating if we should call that thing a partition, a volume, a drive or a filesystem, and Olof has a quirk for using "disk" everywhere.

[Antonjo]

the -p option in AIM_LL has the same functionalities as in IMDISK.

 

 

 

My point is:

aim_ll  -a -t file -s 100M -f .\abc.ima -p "/fs:NTFS /q  /y /c" 

(besides opening a boring formatting GUI)  creates and formats a single partition taking the whole abc.ima space. 

I would like to create and format two distinct partitions. 

 

Now I see only two options. After creating and mounting the Arsenal virtual disk, use:

1) diskmgmt.msc

2) diskpart

 

However, 1) is not scriptable; 2) is too dangerous to script, because it relies on "select disk num". Num is a dynamically assigned disk number. Use the wrong num and you make huge damages. 

Given that Arsenal supports partitions, is it  possible to pass partitioning commands to "-p"? Or is there some other tool to partition abc.ima (perhaps through devio)?

Edited by Antonjo, 29 April 2017 - 07:35 PM.

[Wonko the Sane]

#2 Diskpart has been scripted since years, of course you need to put in the script some "solid" error prevention provisions, if you prefer you can use another tool, as an example MBRWizard, but still you need to *select something*.

 

The point that you still seems to be missing is that the "objects" involved are "different".

 

The image that AIM creates (and mounts) is to all effects a non-partitioned (virtual) disk drive.

 

The "object" of a partitioning command is a disk drive.

 

The "object" of a formatting command is a volume (or in this case a partition since a primary partition is in practice corresponding to a volume) or, in the case of a non-pre-partitioned device, the whole device (aka a "superfloppy", just like what IMDISK uses).

 

When AIM creates the virtual disk, it is just a bunch of 00's, an extent mapped as a physicaldrive, until it is not partitioned there is no way to format any partition on it (they simply don't exist yet).

 

You would need six commands in sequence:

1) Create the backing file and mount the disk <- this is the main thing AIM does

2) Make it a valid Windows disk, i.e. initialize it (basically this means writing at least the 55AA magic bytes and the disk signature)

3) Write the first partition table entry

4) Write the second partition table entry

5) Format the first partition

6) Format the second partition

 

If you are afraid of fiddling with a mounted disk MBR, nothing prevents you from scripting the creation of the file (and initializing its MBR and writing the two partition table entries while offline) then mount the pre-initialized and pre-partitioned disk with AIM, but still in order to format the two partitions (volumes) you will need to select them. 

 

About scripting diskpart, it is not at all difficult, in the same batch script you can use diskpart to list all disks, then create a new one with AIM and select the disk that was not present before, but wouldn't be much simpler to issue a aim_ll -l command, the output will be *like*:

 

 

C:\>aim_ll.exe -l
Device number 000100
SCSI port number 5 device number 000100
Image file: \??\C:\testimgmount.img
Size: 26214400 bytes (25 MB), Queued I/O Image File, HDD.
Disk device is \\?\PhysicalDrive2

Any possible error if you select disk 2 in diskpart?

 

Wonko

[Antonjo]

>  #2 Diskpart has been scripted since years ...  the "objects" involved are "different". 

Thanks, I know this, only I am not looking for a risk assessment on Diskpart, but for an alternative file based. 

 

The DiscUtils Module for PowerShell seems an easy way to go:

Import-Module DiscUtils.psd1
New-VirtualDisk hd.vhd -Type VHD-dynamic -Size 100MB
New-PSDrive vhd -PSProvider virtualdisk -Root hd.vhd -ReadWrite
Initialize-VirtualDisk vhd: -VolumeManager Bios -Signature 0x12345678
New-Volume vhd: -Size 50MB -Type WindowsNtfs -Active
New-Volume vhd: -Size 49MB -Type WindowsNtfs
Format-Volume vhd:\Volume0 -Filesystem Ntfs 
Format-Volume vhd:\Volume1 -Filesystem Ntfs 
Remove-PSDrive -Name  vhd
aim_cli.exe /mount /filename=hd.vhd 

Interestingly, the whole code can run in a non-privileged shell.

 

[Wonko the Sane]

From RAW to dynamic VHD in no time.

 

Wonko