53 replies to this topic

[Zoso]

I am having trouble with Truecrypt (5.1 upto 6.2a)

I'd like to learn how the bootloader works so I can figure out how to get truecrypt to work on my new notebook.

the problem Im having is: after I enter my password it just hangs with blinking cursor.


from reading trucrypts forums I see it is a very popular problem but I cant find a solution there.


I have tried many different bios settings and such with no success.

I feel like If I knew what the bootloader is doing I could mabey figure out why it hangs.

it seems to be a hardware issue with my new notebook to me because I have a USB HDD with XP (USBoot prepaired) that is trucrypted and it works fine in my old desktop but wont boot in my notebook.


with the exact same USB HDD and XP but without truecrypt it boots fine in the notebook.

does anyone know whats going on in the truecrypt bootloader?

thanks,

LP

[...Tim...]

Did you use full disk or partition encryption?

Eventually you may try to prepare (initialize MBR / partitions / format) your USB device from scratch with NTFS on a Win Vista/Server 2008 machine and create a copy of 'ntldr' named 'bootmgr' in the root directory of the system partition.

Tim

[Zoso]

hi Tim,

Full system encryption.

would win7 also work for that purpose (I can load its image faster) and could you explain why the vista/2008 format on the USB for use with XP?

Ive been using the HP tool for formating USB FD & HDDs to make them "bootable" and it seems to work on all the USB drives Ive used so far.

I guess formating them with vista or 2008 and mabey seven would work for this purpose also now?

the USB Flash drive is showing activity (about 7 or 8 blinks of the built in activity light on it) after the password is entered then it stops so I assume it is looking for something and cant find it but thats all I have.

Ive all but eliminated a real hardware issue now too by removing everything including the onboard SATA HDD.

I have been reading everything I can find about this and havent found a solution yet. I just dont know enough about whats happening in the boot proccess.

Im learning.. but the fact that this USB stick boots fine without truecrypt leads me to belive that the TC bootloader is missing something it expects or not expecting something it sees. wish I knew.

unless otherwise instructed, my plan is to start over. since I was using USBoot I never had to nlite my XP to manually install the SATA drivers for this machine, it just detected them and I pointed it to them.

I am hoping if I start over and install clean slipstream w/SATA then USBoot prepair then truecrypt it I will have success but if not I plan to try MRs grub4dos wiki instructions even though multi booting it isnt what I really need.

I'll probably end up with alot more knowledge in the process and then find out it was something really simple.


thanks for your input.

[Zoso]

hi again Tim,

also, I was reading your post on 911cd

http://www.911cd.net...o...=21711&st=0

where someone describes the same problems I have.

post #8 you mention:

"Anyway this message is being displayed from the TrueCrypt INT13h boot filter at the point that the partition boot sector and ntldr should take over. Sometimes the XP boot sector seems to cause problems so you may try to completely reinitialize your UFD from an installation of Windows Vista or Server 2008 that seems to come with an improved boot sector."


I do not know how to "completely reinitialize your UFD" because I do not understand what or how to "reinitialize" could you explain that to me please?

thanks again

[ktp]

@Zoso
The blinking cursor problem is probably due to boot sector code. Refer to this :
http://www.boot-land...?showtopic=8528

Anyhow I assume that your USB key did not pass successfully TrueCrypt preboot authentification (PBA).

What I recommend :
- Ensure that your USB boots with normal XP boot sector (or with the patched one using method mentioned if the mentioned topic).
- Encrypt your USB key partition with TrueCrypt that would execute preboot authentification (PBA). Successful PBA is a requirement.

[Zoso]

hi ktp,

I see that I failed to mention that the USB key is formatted NTFS and the stick is 4GB HP flash with only one partition.

Truecrypt is/was installed on this USB key and working in my desktop machine (passed PBA on another machine)

I think this key is confirmed to boot with "normal XP boot sector" but I cant say for certain it is a normal XP boot sector because it is prepaired to boot USB by USBoot program so I need to learn how to confirm this (how to look at boot sector and interpret the results)

PBA does work fine in another machine which is also the same machine that I installed truecrypt on this USB key.



thanks

[...Tim...]

I think this key is confirmed to boot with "normal XP boot sector" but I cant say for certain it is a normal XP boot sector because it is prepaired to boot USB by USBoot program so I need to learn how to confirm this (how to look at boot sector and interpret the results)

At the time being (actual release 2.10) USBoot will not touch neither the MBR nor any partition boot sector at all.

Tim

[ktp]

PBA does work fine in another machine which is also the same machine that I installed truecrypt on this USB key.

I am quite sure that the blinking cursor problem is due to the XP boot sector as mentioned. The problem occurs depending on the BIOS. Refer to the mentioned topic on how to verify and patch the FAT32/NTFS boot sector.

if(!strncmp(buf+3,"MSWIN4.1",8) &&

	   buf[0xE6] == 0x0F &&

	   buf[0xE7] == 0x82 &&

	   buf[0xE8] == 0x4A &&

	   buf[0xE9] == 0x00) {

  printf("FAT32 boot loader detected. Killing CHS code.\n");

  buf[0xE6] = buf[0xE7] = buf[0xE8] = buf[0xE9] = 0x90; // NOP THE CRAP

	} else if(!strncmp(buf+3,"NTFS",4) &&

		buf[0xD9] == 0x0F &&

		buf[0xDA] == 0x82 &&

		buf[0xDB] == 0x3A &&

		buf[0xDC] == 0x00) {

	  printf("NTFS boot loader detected. Killing CHS code.\n");

	  buf[0xD9] = buf[0xDA] = buf[0xDB] = buf[0xDC] = 0x90; // NOP THE CRAP

As in the above code, at your NTFS boot sector offset 0xD9 you should see 0F 82 3A 00. They have to be patched with NOPs (90 90 90 90).

You might want start all again (un-truecrypt, patch the boot sector, verify that it still boots on all machines, verify that PBA passes on the current failing machine, then truecrypt the whole partition again).

[Zoso]

Tim, what do you mean by "reinitialize"? simply re-format in vista or 2008?

ktp, I may try that but that thread refers to an Mp3 disc and my USB key also boots fine in my new notebook without truecrypt installed.


I have been using the HP format tool on all my USB drives both Flash and HDD successfully. besides this issue with truecrypt which may or may not be related.

about USBoot, once I have ran that program through all three phases I have been able to copy then paste everything into another USB drive formatted with the HP tool (NTFS) and then the drive Ive pasted all the files/folders in will boot too. I wonder if thats an issue here?

I think I need to learn about boot sectors more. what will help me do that? I'd like to look at all my drives and see the boot sector then compare them but I dont know how. is that what hex editors are for?

are there other tools available besides the HP format tool I could try for formating to make USB sticks bootable that may also play well with truecrypt?

I'd like to try that then copy my USBoot OS into it again. I'll try with another USB drive what I have now (with trucrypt issue) to see if I get the same results and report back.

(edit) I have just tried a USB HDD formatted with HPtool NTFS single partition then copied my USBoot XP then truecrypt PBA failed again.


(edit) tried again this time formatted same USB HDD with vista OS, NTFS single partition then copied USBoot XP then truecrypt, PBA failed again.


this notebook has WUSB, (wireless USB) its so new that there are no WUSB devices out yet (that Im aware of) they said there will be WUSB hubs, monitors, printers, etc. now Im wondering if there will be WUSB Flash and HDDs available also, wouldnt that be cool to boot from a WUSB HDD in the room but not attached to the system! anyway, I cant help but wonder if the WUSB could be an issue here?

too many possible factors involved for me to figure out. anyone have suggestions on how to start from scratch to get a truecrypted XP OS booting on USB?


thanks again

[Zoso]

since direct answers are so hard to come by lately Ive been reading everywhere alot about USB booting..

found this post by Dietmar himself: http://www.911cd.net...showtopic=14292

"Many Bioses are searching ONLY in the lowest memory of the USB Stick after them.

And if you delete them, they are copied late too high!!!
The bootprocess will stop then very early with a blinking Cursor"

time for me to get winhex and get my hands dirty..

Im just not ready to start all over from scratch yet.

[was_jaclaz]

Well, I would consider to do some more "accurate" searches.

No matter what Dietmar thought and said almost 4 years ago, the symptoms is typical of a badly partitioned USB stick, and even more typical of a stick formatted through the HP USB formatting utility.

In the meantime several different programs have been written and new findings made.

Here is a list of more "current utilities":
http://www.msfn.org/...93-page-17.html

BEFORE trying those, go through this thread:
http://www.911cd.net...showtopic=21955

Where you may find some answers to your questions.



jaclaz

[Zoso]

Thanks Jaclaz, I was hoping for your input!

well I dloaded winhex and its more complicated than Dietmar made it seem, that didnt stop me but the edit function is only available in the full version so that did stop me (I guess thats a good thing)

is there available a good hexeditor that is free or shareware? I have DiskInvestigator on Ubcd4win but I dont think it allows editing. I have changed my plan from Dietmars post 4 years ago but I would like to learn more about boot sectors and MBR etc and I would also like to see disk contents as raw and learn more.

Ive read some of your brief mentions of dissatisfation with the HPtool and now it is nice to have your direct input on a better way. I will follow and read the links you have provided. mabey MSFN,org is back up now, I was not able to view it earlier today.

anyway, what do you think about booting wireless USBHDD Hahha! how soon before that is reality?


thanks

[was_jaclaz]

Yes, msfn seems a bit erratic right now...

Here are the links, anyway:
Fuwi's Bootable USB-Drive Utility
http://www.911cd.net...showtopic=21702

RMPREPUSB.EXE:
http://www.boot-land...?showtopic=7739

Make_USB.EXE:
http://www.msfn.org/...howtopic=121446
http://www.msfn.org/...o...21446&st=20

FBINST:
http://www.boot-land...?showtopic=7932

well I dloaded winhex and its more complicated than Dietmar made it seem, that didnt stop me but the edit function is only available in the full version so that did stop me (I guess thats a good thing)

Usually it's the carpenter, not the saw, that makes the plank cut at the right length...

is there available a good hexeditor that is free or shareware?

Here:
http://www.boot-land...?...=8296&st=12
http://www.boot-land...?showtopic=8734

jaclaz

[Zoso]

I started from scratch (or so I thought) with XPPsp2, formatted NTFS single partition again except this time with RMPrepUSB, it seemed like the best choice at the time.

Full fresh XP and I did not add anything after the XP set-up except truecrypt then USBoot. boots USB fine as expected then I started truecrypt and failed pre boot authentication (PBA) again with only blinking cursor after password entered!

decided to try DriveCrypt Plus Pack (DCPP) on the same set-up and I get exactly the same result except after entering password it said "Loading OS" but still hangs with a blinking cursor!

both TC and DCPP work on this notbook from local HDD and they both work on USB in my desktop but the same USBs both Flash and HDD types that boot fine in the desktop with system encryption wont in the notebook.


but heres where Im at now. after DCPP I reformatted again NTFS single partiton to try another aproach by installing TC boot authentication before copying system with USBoot thinking I can resume encryption if it works. the problem I have now is that when I booted, the DCPP PBA password screen is still there ??? even after installing TC. of course it hangs with blinking cursor but its not supposed to be DCPP.

what I learned is that formatting does not take care of the MBR. now I need to learn how to prepair a notebook that has no floppy for formatting (BTW this is my first notebook/desktop replacement)

in the past I have allways used a w98 floppy with debug, fdisk, and format commands to start from scratch, my routine was this:

-DEBUG
-F200 L1000 0
-A CS:100
-MOV AX,301
-MOV BX,200
-MOV CX,1
-MOV DX,80
-INT 13
-INT 20
-G
Cntl+Alt+Del

then FDISK then FORMAT

I dont actually know what the DEBUG routine does exactly only that it allways worked on every ATA HDD Ive ever used it on to clear the drive for starting over. it was passed onto me by an online friend many moons ago.


I would like to learn the best routine to get the same or better results with SATA and USB drives in my notebook that has no floppy. is the above DEBUG routine actually safe for all HDD? and if so is it safe to put it on a CD and run it and the same for Fdisk and format w98 style?


I really only use XP, this notebook came with Vista but I was able to obtain all the drivers to down grade. I prefer XP because it doesnt take 16GB of space like the Vista OEM and because I am very familiar with XP.

more of topic (but I could really use the help) this notebook is 64bit, my XP is 32 so is 64bit XP possible as upgrade or is 64bit XP a stand alone version?

back on topic (sorta) what is the best way to remove the DCPP loader that is stuck on my USB HDD? Ive never used the w98 DEBUG>FDISK>FORMAT routine on any USB drive, is that safe todo or should I look into MBR tools? any and all suggestions are greatly apreciated!

Im starting to think my USB MBRs are the issue with TC PBA now but there is still so many variables with the new hardware here..

Ive got BIOS options Ive never seen/used before like "pre-boot execution environment" and the boot options are USB HDD, CD/DVD, Drive0 HDD (why Drive0, is that an issue?) Floppy (there is no Floppy on this machine!) Network, and heres one I really dont get: USB Memory. in the boot options list.. what is that for?

I have no reasonable documentation for this system, Ive been looking but the OEM is holding out for some reason. in the Bios security screen Ive got option: Flash write enabled or disable. (dont know what that is yet either)

Advanced screen has IEEE1394 controller enable/disable

CPU features Speed Step Technolgy enable/dissable (have no idea)
X-Bit functionality enable/disable (ditto)

did I mention AHCI? that too..

anyway, Ive got alot of catching up and learning todo.. sorry if most of this is out of place but I really admire the collective wisdom of this board here and Im sure these isues and problems Im having would be nothing for some of the members here so Im just tossing it out there..

thanks

[was_jaclaz]

what I learned is that formatting does not take care of the MBR. now I need to learn how to prepair a notebook that has no floppy for formatting (BTW this is my first notebook/desktop replacement)

in the past I have allways used a w98 floppy with debug, fdisk, and format commands to start from scratch, my routine was this:

-DEBUG
-F200 L1000 0
-A CS:100
-MOV AX,301
-MOV BX,200
-MOV CX,1
-MOV DX,80
-INT 13
-INT 20
-G
Cntl+Alt+Del

then FDISK then FORMAT

I dont actually know what the DEBUG routine does exactly only that it allways worked on every ATA HDD Ive ever used it on to clear the drive for starting over. it was passed onto me by an online friend many moons ago.


I would like to learn the best routine to get the same or better results with SATA and USB drives in my notebook that has no floppy. is the above DEBUG routine actually safe for all HDD? and if so is it safe to put it on a CD and run it and the same for Fdisk and format w98 style?

Definititely formatting DOES NOT deal with the MBR.
What you may be still missing is that in some cases also FDISK/partitioning may lead to different results.

The BEST choice is to ALWAYS start "from clean", as a number of utilities (and in some cases the OS itself) may "pick up" some OLD values (from the DATA contained in a previous MBR and/or bootsector) creating a resulting "problematic" MBR or partition.

My advice:
1. Zero out first, say 100 sectors:
http://www.boot-land...?...=4015&st=21
2. Start again, basing of reports of "successful" Truecrypt stories:
http://www.boot-land...?showtopic=8096

Search on the board for posts/threads by members ktp and online, they both have experimented several ways "connected" to Truecrypt.



jaclaz

[bilou_gateux]

I have no reasonable documentation for this system, Ive been looking but the OEM is holding out for some reason. in the Bios security screen Ive got option: Flash write enabled or disable. (dont know what that is yet either)

Any write access to the BIOS Flash device (BIOS Update or BIOS Module Modification)with manufacturer or other BIOS Flash tools will fail on a module where the BIOS UpdateProtection is enabled.

[Zoso]

thank you bilou_gateux for the very helpful reply. this will come in handy if I try to use the OEM restore/vista CD again. the first time I used it, I found it had changed my bios settings AND repartitioned my drive which was an unpleasant suprise to me. I will dissable this option until it is needed. thanks!


back to my original problem with the TC loader hanging with blinking cursor. I will try next Jaclaz's latest suggestion and zero out the first 100 sectors.

after that I would like to try each suggestion posted here in order, the problem with that is I dont understand what ...Tim... suggests can anyone else tell me what he means by "reinitialize"?

after I figure that out and try it, if it doesnt work I will try the next suggestion from ktp and proceed from there. hopefully I will dicover and resolve the issue at some point.

Jaclaz, I ran accross a post you made about the differences in the HPtool MBR and the XP MBR but I cant find it now but anyway, it seemed to have some clues. I'll keep looking.

thanks

[was_jaclaz]

Jaclaz, I ran accross a post you made about the differences in the HPtool MBR and the XP MBR but I cant find it now but anyway, it seemed to have some clues. I'll keep looking.

This one, I presume :
http://www.boot-land...?...=2246&st=15

the fix is however already included in a couple of the given utilities and in MBRBATCH/MKIMG:
http://www.boot-land...?showtopic=3191
http://www.boot-land...?showtopic=5000
this, particularly, may be of interest to you:
http://www.boot-land...?...c=5000&st=1
(if you use my indirect method you have NO reasons to wipe the stick before)

jaclaz

[Zoso]

yes, thats the one! I dont know how you remember so much.

also, I have read your mentions of using acronis and other disk editors, I have used acronis to delete OEM partitions and resize, create new etc.

what is a better way to do this on my new notebook OEM HDD? I want to start from scratch (Zeros) and then make three partitions.

OK, dsfok zeroed it out fine then the drive dissappeared from explorer but the USB tray icon still indicated and USBdeviceview program indicated it was still there so I went to disc management and finally discovered what ....Tim.... was talking about reinitializing!

now Ive zeroed it and Im reloading win7 so that I can "reinitialize" the USB key there in hopes that will help or resolve this. I will report back with success or failure if failure then I will try ktp's suggested method next.

[was_jaclaz]

also, I have read your mentions of using acronis and other disk editors, I have used acronis to delete OEM partitions and resize, create new etc.

what is a better way to do this on my new notebook OEM HDD? I want to start from scratch (Zeros) and then make three partitions.

Just to clear this part, what you may have read it's me mentioning that I "abandoned" Partition Magic several years ago, and that I found slightly better Acronis BUT that I DO NOT recommend using EITHER, as well as ANY of the other nice looking , graphical, "intelligent" apps, not because they are not nice looking, graphical and "intelligent" but because they tend to:

• in particular cases, luckily rare, PROBLEMS
• use in some particular cases one or more hidden sectros
• generally conveying the feeling to the user that creating/moving/resizing/formatting partitions can be taken "lightly"

I personally find that partitioning should be:

• planned accurately
• thought a bit upon the plan
• done
• let alone

To do the above you need only :

• some patience
• some knowledge
• tools freely available or already included with the OS(es)

Of course nothing prevents one from using a GUI tool like PM or Acronis or any of the other ones, but if he/she knows what he/she is doing is definitely a plus.





jaclaz

[Zoso]

so can you resize a partition from within the OS or should resizing be avoided?

OK so now I have zeroed the USB HDD then initialized it, formated NTFS single partition active withn win7 then USBoot prepaired it with XP, tested boot works then installed TC and failed PBA again with only blinking cursor after password entered so its not a TC/HPtool incompatability issue.

I really thought I had it in the bag this time! oh well, onto ktps suggested method..

EDIT: ktp wrote "Refer to the mentioned topic on how to verify and patch the FAT32/NTFS boot sector."

which led me here: http://blog.clemens....ndows_3170.html

but I cant find directions for use, only "here is my bootloader patch, use it at your own risk" so I dont know how to apply this patch. any suggestions? thanks

[was_jaclaz]

so can you resize a partition from within the OS or should resizing be avoided?

If you follow the plan:

I personally find that partitioning should be:

• planned accurately
• thought a bit upon the plan
• done
• let alone

you shouldn't need it.

Let's clear this part also: there is nothing "bad" in resizing a partition, just as there is nothing bad in bringing down the wall between your kitchen and dining room to rebuild it one foot apart because your fridge is bigger than you thought, but is it "smart"?

Doesn't it represent a possible cause of dust/inconvenience?

Isn't it something that you could have avoided if you took your time checking the drawings and fridge BEFORE building the wall?

EDIT: ktp wrote "Refer to the mentioned topic on how to verify and patch the FAT32/NTFS boot sector."

which led me here: http://blog.clemens....ndows_3170.html

but I cant find directions for use, only "here is my bootloader patch, use it at your own risk" so I dont know how to apply this patch. any suggestions? thanks

Right idea , wrong (actually partial ) link:
http://www.boot-land...?...ic=8528&hl=
http://www.911cd.net...o...1702&st=129
read a few posts, then go back to
http://www.boot-land...?...=8528&st=21
which is crosslinked here:
http://www.911cd.net...o...1702&st=241

It's called internet navigation....doing some ping-pong is part of the game....

The idea by Clemens Fruhwirth:
http://blog.clemens....ndows_3170.html
is very good.

If one does not feel confident applying it manually with a hex heditor, dencorso was so kind as to post a compiled version.



jaclaz

[Zoso]

yes, Master Link ;-) but those are reposts.. and not everyone likes or in my case has the extra spare time for ping-pong.

it is unusual that member "ktp" seemed to have given up on the very same solution he suggests or mabey he just didnt follow up on that thread.

guess I'll have to unzip the 7zip file and see what I can figure out from there.

it may be the solution but I think I may have read (or dreamed) that mabey for some unknown to me reason the TC bootloader tries to boot HDD#0 with the intel/phoenix, processor/bios combo instead of the USB HDD#1 but not with the AMD/phoenix combo.

truecrypt is open source so its odd that I cant find any info on its bootloader.

I wonder what happened to BootLand member "mr_" he seemed to have the most experience in this area. mabey his need for TC is way more legit than me just wanting to protect my data from thieves or the OEM in case of warranty repair etc on the new notebook. that guy was the closest Ive seen to James Bond on any of the forums.

[was_jaclaz]

it is unusual that member "ktp" seemed to have given up on the very same solution he suggests or mabey he just didnt follow up on that thread.

The actual problem in the given thread was actually a much more complex (and different) one.

Using my usual wooden plank examples, ktp thought (rightly) that to join two planks all he needed was a hammer and some nails, but what he actually needed was a custom made inlaid cabinet.

.. and not everyone likes or in my case has the extra spare time for ping-pong.

Life is tough , and the game has it's Rules.

If you choose the RED pill, the rabbit hole is deeper than you might think.

I wonder what happened to BootLand member "mr_" he seemed to have the most experience in this area. mabey his need for TC is way more legit than me just wanting to protect my data from thieves or the OEM in case of warranty repair etc on the new notebook. that guy was the closest Ive seen to James Bond on any of the forums.

I though that it was just because he seemed to live surrounded by hackers:
http://www.boot-land...?...=5274&st=13
http://www.boot-land...?...=5274&st=19




jaclaz

[Zoso]

I cant find it.. each link you drop has 10 or more other links.

how do I use dencorso's compiled method?