81 replies to this topic

[karyonix]

When booting with full XP Intel RAMBOOT image on AMD64 machine, then frequently the Wizard New Hardware found appears,
which requires user interaction.

1. One way to prevent New Hardware Wizard is making the device not new.
If devices is already installed, it is not new hardware. Just like when you prevent RAM Disk installation message.
http://www.boot-land...?...ost&p=79761
After you install drivers in RAM Windows, you may save SYSTEM hive to image and manually copy driver files (.sys, .dll) to disk image. This can prevent New Hardware Wizard only in known machine.

2. When you insert new USB flash drive, there is no New Hardware Wizard appearing.
It seems if Windows already have driver that match new device installed and and the driver package have been signed by trusted publisher. It will install driver for new device automatically.

[wimb]

2. When you insert new USB flash drive, there is no New Hardware Wizard appearing.
It seems if Windows already have driver that match new device installed and and the driver package have been signed by trusted publisher. It will install driver for new device automatically.

Yes, it would be interesting if we can use this mechanism for all devices.
But what are the required registry settings to treat any device in this way ?

[was_jaclaz]

The mechanism is present on Windows XP Embedded (very similar to the poorman's way previously hinted):
http://www.msfn.org/...ard-t62224.html
but it seems like it is not working on "normal" XP (things may have changed with later SP's/hotfixes)

Something that may clear part of the questions:
http://technet.micro...y/bb490837.aspx

Note Some buses, such as Peripheral Component Interconnect (PCI) and universal serial bus (USB), take full advantage of Plug and Play. Older buses, such as Industry Standard Architecture (ISA), do not take full advantage of Plug and Play, and require more user interaction to ensure that devices are correctly installed

Some more things to read/explore:
http://support.micro...kb/938596/en-us
http://msdn.microsof...y/ms790308.aspx



jaclaz

[rawr]

When booting with full XP Intel RAMBOOT image on AMD64 machine, then frequently the Wizard New Hardware found appears,
which requires user interaction.
....
Does anyone has a working solution ?

i think this is covered by registry entries jfx posed (iv not played with fira disk + universal setup so far ) ,
maby something (batch/reg/script) in this of use ..

http://www.jimsingh....vmware-esx.html

[wimb]

1. One way to prevent New Hardware Wizard is making the device not new.
If devices is already installed, it is not new hardware. Just like when you prevent RAM Disk installation message.
http://www.boot-land...?...ost&p=79761
After you install drivers in RAM Windows, you may save SYSTEM hive to image and manually copy driver files (.sys, .dll) to disk image. This can prevent New Hardware Wizard only in known machine.

Thanks karyonix, this is the way to go.

• Boot with full XP FiraDisk RAMBOOT Image e.g. XPRT.img
  
• Install Drivers with DriverForge
  
• Run ERUNT.exe to collect Registry files SYSTEM SOFTWARE SECURITY and SAM
  
• Reboot with XP Workstation
  
• Mount XPRT.img with ImDisk
  
• Upate in mounted XPRT \WINDOWS\system32\config the 4 registry files SYSTEM SOFTWARE SECURITY and SAM
  
• Update in mounted XPRT \WINDOWS\system32\drivers and \WINDOWS\inf folders with driver files
  
• UnMount XPRT.img

After doing the above procedure on several machines you have a portable (almost) Universal XP OS.
Take care to set intelppm Service to Manual with Start=3 for SYSTEM registry collected on Intel machine.

In this way you can gradually improve your XP registry of portable Universal XP to be more compatible with various computers.

[was_jaclaz]

In this way you can gradually improve your XP registry of portable Universal XP to be more compatible with various computers.

...and gradually get very far from the idea of a portable XP, what you describe seems more like a set of pre-made exchangeable "blocks" (that need a pre-boot to be exchanged).

Or am I getting it wrong?

And the "update" (which is the part I don't understand ) means adding partial info to the Registry (and make at each step a bigger Registry)?

Till now I thought that the idea was to create a "neutral" XP capable of self-adapting to the machine on which it was booted....



jaclaz

[wimb]

The full XP RAMBOOT Image is bootable on new machine, but some drivers can be missing.

The Info on New Hardware can be added to existing image in the way described above.

It is a learning process where the Image after some time is becoming Universal XP,
which will boot on a lot of machines very fast without the need to Install New Hardware.

Booting in about 1 min when Image loaded from HD
and about 3 min when loaded from USB-stick on computer having USB 2.0 boot speed.

The described learning process procedure is useful.
The increase in size of the registry files is limited and no problem.

[was_jaclaz]

The described learning process procedure is useful.

Yes , but NO , still it isn't.

I mean,

• when you start with the first "pseudo-universal" image, it knows nothing but the drivers for the system where it was originally built/installed.
  
• when you get a new machine (that needs different drivers) you have to go through the "install new hardware" and the image "learns" with your method.
  
• every new machine needing different drivers you have to loop to 2.
  
• after several iterations you have a "learned" image
  
• we don't know however if accumulating data will lead to conflicts at a given point or if the image with added data and drivers will at a certain point become "unpractical"

Every time the image "update" needs to be "freezed" by re-mounting the image and changing the Registry files.

Now the mechanism I would like (you know how I am an optimist at heart, and hoping costs nothing), would be that once "your" image has learnt about a given hardware, this info can be "shared", so that "my" image (or member xy's one ) can learn from it.

To this there are two approaches (as I see it):

• creating a package with a "diff" Registry file and the needed drivers for each "new machine" (and share the package), then find a way to add this info selectively
  
• finding a way to replicate what the new hardware does on a given machine and be able to do it while booting

...a man can dream....



jaclaz

[wimb]

Life is tough, but this may help to make things easier ....

After booting with full XP RAMBOOT Image you can Install ImDisk,
which is interesting as a means to direct update the RAMBOOT Image from which you just booted.
Then TotalCommander can be used with Asymmetric Synchronizing of directories to Update your RAMBOOT Image file.

The procedure is then as follows:

• Boot with full XP FiraDisk RAMBOOT Image e.g. XPRT.img
  
• Install Imdisk if not done already
  
• Install Drivers with DriverForge
  
• Take care on Intel machine to set intelppm Service to Manual using regedit
  In registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\intelppm make value Start = 3
  
• Run ERUNT.exe to collect Registry files SYSTEM SOFTWARE SECURITY and SAM
  
• Mount XPRT.img with ImDisk using R-mouse menu
  
• Upate in mounted XPRT \WINDOWS\system32\config the 4 registry files SYSTEM SOFTWARE SECURITY and SAM from C:\WINDOWS\ERDNT folder
  
• Update in mounted XPRT \WINDOWS\system32\drivers and \WINDOWS\inf folders with driver files
  using portable TotalCommander and Asymmetric Synchronizing of directories excluding unwanted files like e.g. *.PNF
  Update also folders C:\WINDOWS\system32\CatRoot and C:\WINDOWS\system32\CatRoot2 and C:\WINDOWS\system32 and root files in C:\WINDOWS
  
• Close TotalCommander and Open Windows Explorer to UnMount XPRT.img with R-mouse menu

Reboot with Updated full XP FiraDisk RAMBOOT Image works perfect without the need to update any drivers.
It is working now with the same FiraDisk RAMBOOT Image on 3 computers with quite different architecture:
Intel and AMD64 MultiProcessor Desktop and Pentium Dual-Core Laptop.

[was_jaclaz]

Well, again, near , but not really.

Why using Total Commander (which is a Shareware/Commercial App)?

Since we use IMDISK, I guess we can use strarc as well:
http://www.ltr-data.se/opencode.html
http://www.ltr-data....iles/strarc.txt
http://www.ltr-data....iles/strarc.zip

...and probably someone could write a batch or an Auto-it script to completely automate the procedure....



jaclaz

[wimb]

...and probably someone could write a batch or an Auto-it script to completely automate the procedure....

Thanks jaclaz for the link to strarc
It can be very useful in further automating the RAMBOOT Image Update process .....

[joakim]

About the usb vs non-usb bootable systems;

Is it correct that standard usb-bootable xp can also boot in non-usb environment, but not the other way around?


Joakim

[wimb]

At the moment I am busy in writing GUI programs with AutoIt3 that can be used to Create and Update full XP FiraDisk RAMBOOT Image files.

In Updating the Image file with strarc (thanks jaclaz for mentioning this handy program)
I have the problem that some files cannot be copied e.g. the 6 User Registry files of name NTUSER.DAT and UsrClass.dat.

In AutoIt3 I have not found an easy way for DriveLock that would allow me to copy also those files.

Has anyone AutoIt3 code that allows to do DriveLock and Copy the NTUSER.DAT and UsrClass.dat files ?

[karyonix]

I have the problem that some files cannot be copied e.g. the 6 User Registry files of name NTUSER.DAT and UsrClass.dat.

You might have to look in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist to find their key name.
And use "reg save" command instead of copying hive files.

Is volume shadow copy service available in XP ?

[wimb]

You might have to look in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist to find their key name.
And use "reg save" command instead of copying hive files.

Is volume shadow copy service available in XP ?

I can use ERUNT.exe to Copy the Registry Files, but I was looking for a way that would not block normal FileCopy.

I have no idea if and how I can use volume shadow copy service in XP.

[joakim]

Hmm. System priviliges does not work either. I remember pwdump7 had such functionality (could copy any file), but your antivir would not like that file very much. I believe shadow copies can do it, but is a little bit of an overkill for copying a handful of files.

Joakim

[karyonix]

I think "dd" can save the whole drive to image file.
It would be better if we can boot directly from image and make small change.

[wimb]

It would be better if we can boot directly from image and make small change.

After booting with full XP RAMBOOT Image and Updating Drivers with DriverForge,
I can run IMG_XP_Update.exe which mounts the XPRAM_1.img file with ImDisk,
and then Updates this file in 5 seconds with drivers using strarc.exe and the 4 HKLM Registry files in config using ERUNT.exe
It works very fast and convenient and after doing this on a few machines with different architecture you have Universal XP.

But now when you Install in XP running in RAMDISK some extra programs,
then I can do Total Update in about 1 min using strarc.exe comparing the drives,
but then the 6 files of NTUSER.DAT and UsrClass.dat are not updated,
and some files like C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb and edb.log and tmp.edb are blocked for filecopy ....

Anyway it is working already quite well, e.g. installed programs are added to the Start Menu, and may be it is not such a problem.

Additionally I have made IMG_XP_Create.exe to Create full XP RAMBOOT Image file and IMG_XP_Restore.exe to Restore such file on a HDD Drive.

[maanu]

Additionally I have made IMG_XP_Create.exe to Create full XP RAMBOOT Image file and IMG_XP_Restore.exe to Restore such file on a HDD Drive.

Great News .

any chance in future for a tutorial and sharing your creation ?

[wimb]

Great News .

any chance in future for a tutorial and sharing your creation ?

Sure, I will share it soon, but I would like to make some improvements and do some more testing.

[was_jaclaz]

@wimb

http://www.ltr-data....iles/strarc.txt

-r Backup loaded registry database of the running system.

Creates temporary snapshot files of loaded registry database files and
stores them in the backup archive. This is recommended when creating a
complete backup of the system drive on a running system. When the backup
archive is restored to a new drive, the backed up snapshots will be
extracted to the locations where Windows expects the registry database
files. See section 3.6 for more information.

3.6 How to backup a complete running Windows system.

Complete running Windows systems may be backed up in the ways described in the
3.4 section. Special care must however be taken when it comes to files that may
be open while the backup is running. This is always the case of the registry
database files in the %SystemRoot%\System32\config directory and the profile
directories of logged on users. This means that strarc cannot backup the
registry database files the way normal files are backed up while the system is
running.

With release 0.1.3 of strarc it is now possible to backup snapshots of the
registry database files using the -r switch to strarc.

The snapshot files are extracted from the registry keys of the running system
before the actual backup routine of strarc begins and will therefore be a
momentary copy of the contents of the registry when strarc starts. The snapshot
files are temporary files created with the same name as the loaded registry
files with the special extension '.$sards', "Stream Archiver Registry Database
Snapshot". When the backup routine later in the strarc backup run finds the
snapshot files they are stored in the backup archive with the name of the actual
loaded registry file, not the name of the temporary snapshot file. This way a
later restore of the backup archive will recreate the snapshots with the name
and path of registry database files Windows expects to find.

The temporary snapshot files with the special extension '.$sards' are deleted
automatically by the backup routine after they have been stored in the backup
archive. However, if the backup operation is cancelled before the snapshot files
are backed up or if a directory with some of the snapshots are not included in
the backup run, the snapshot files will be left on the disk. You can safely
delete them after a strarc backup operation is complete.

WHICH options are you using?

jaclaz

[wimb]

WHICH options are you using?

I remember I did some experiments with strarc option -r to backup the registry, but was not happy with it.
I don't remember why (I think ERUNT was doing it much faster), so I will redo tests with this option,
as it might be useful for the Total Update including the User Registry.

At the moment I am using for driver Update as piece of AutoIt3 code:

RunWait(@ComSpec & " /c makebt\strarc.exe -cd:C:\WINDOWS\system32\drivers | makebt\strarc.exe -xl -s:c -o:n -d:" & $tmpdrive & "\WINDOWS\system32\drivers", @ScriptDir, @SW_HIDE)

RunWait(@ComSpec & " /c makebt\strarc.exe -e:.PNF -cd:C:\WINDOWS\inf | makebt\strarc.exe -xl -s:c -o:n -d:" & $tmpdrive & "\WINDOWS\inf", @ScriptDir, @SW_HIDE)



RunWait(@ComSpec & " /c makebt\strarc.exe -e:\ -i:.exe,.dll -cd:C:\WINDOWS | makebt\strarc.exe -xl -s:c -o:n -d:" & $tmpdrive & "\WINDOWS", @ScriptDir, @SW_HIDE)



RunWait(@ComSpec & " /c makebt\strarc.exe -cd:C:\WINDOWS\system32\CatRoot | makebt\strarc.exe -xl -s:c -o:n -d:" & $tmpdrive & "\WINDOWS\system32\CatRoot", @ScriptDir, @SW_HIDE)

RunWait(@ComSpec & " /c makebt\strarc.exe -cd:C:\WINDOWS\system32\CatRoot2 | makebt\strarc.exe -xl -s:c -o:n -d:" & $tmpdrive & "\WINDOWS\system32\CatRoot2", @ScriptDir, @SW_HIDE)

and for Total update:

RunWait(@ComSpec & " /c makebt\strarc.exe -cd:C:\ | makebt\strarc.exe -xl -s:c -o:n -d:" & $tmpdrive & "\", @ScriptDir, @SW_HIDE)

and for Registry Update using the previously by ERUNT saved registry in folder SYSREG

FileCopy(@WindowsDir & "\ERDNT\SYSREG\SAM", $tmpdrive & "\WINDOWS\system32\config\", 9)

FileCopy(@WindowsDir & "\ERDNT\SYSREG\SECURITY", $tmpdrive & "\WINDOWS\system32\config\", 9)

FileCopy(@WindowsDir & "\ERDNT\SYSREG\software", $tmpdrive & "\WINDOWS\system32\config\", 9)

FileCopy(@WindowsDir & "\ERDNT\SYSREG\system", $tmpdrive & "\WINDOWS\system32\config\", 9)

[was_jaclaz]

Semi-random ideas:
Hobocopy (uses VSS, but is .NET based )
http://www.howtogeek...ked-in-windows/
http://sourceforge.n...wangdera/files/

Ask Olof if he can "connect" strarc to VSS.

I'll see if I can find anything about using VSS on XP, after all Driveimage supposedly uses it.....



jaclaz

[wimb]

I just found an easy way to copy the 6 files of NTUSER.DAT and UsrClass.dat from RAMDISK to Image File.
Let ERDNT.exe do the work by simply replacing temporarily in ERDNT.INF the destination drive from C:\ to $tmpdrive (the virtual drive of mounted Image)

HexReplace(@WindowsDir & "\ERDNT\SYSREG\ERDNT.INF", "C:\", $tmpdrive & "\", 0, 16, 0)



RunWait(@ComSpec & " /c " & '"' & @WindowsDir & "\ERDNT\SYSREG\ERDNT.EXE" & '"' & " silent sysreg curuser otherusers /mode:nt", @ScriptDir, @SW_HIDE)



HexReplace(@WindowsDir & "\ERDNT\SYSREG\ERDNT.INF", $tmpdrive & "\", "C:\", 0, 16, 0)

This works fast and is a simple solution.
Now all registry files will be updated in the full XP RAMBOOT Image file.

[was_jaclaz]

jaclaz