Fév 112017
 

Following a post from 2014 about booting Winpe over PXE on a UEFI computer, see below a different way to proceed.

-Disable secureboot (or else you’ll need to use a signed bootloader)
-Retrieve latest version of IPXE for UEFI, ipxe-snponly-x86-64.efi and rename it bootia64.efi
-run the following command against your BCD : bcdedit.exe /store BCD /set {bootmgr} nointegritychecks yes
-Use the below wimboot.ipxe script based on Wimboot
-set Tiny PXE Server as below screenshot

wimboot.ipxe


#!ipxe
set boot-url http://${dhcp-server}
kernel ${boot-url}/wimboot
initrd ${boot-url}/bootmgfw.efi bootmgfw.efi
initrd ${boot-url}/EFI/MICROSOFT/BOOT/BCD BCD
initrd ${boot-url}/BOOT/BOOT.SDI BOOT.SDI
initrd ${boot-url}/SOURCES/BOOT.WIM BOOT.WIM
boot

 Posted by at 15 h 26 min
Août 262014
 

UEFI is more and more common on new computers.

It was time for an update within QuickPE to support UEFI.

quickpe_uefi.exe

Once you have generated your Windows X64 UEFI compliant iso, I suggest using Rufus to burn it to a USB key.
Make sure to select GPT for UEFI as partition type and FAT32 as filesystem or else you’ll be booting in BIOS mode.

Mai 062014
 

This project is based on MistyPE.
It’s been scaled down and developed specifically for digital forensics acquisitions.
Mini-WinFE has been co-developed with Brett Shavers to facilitate a simplified method for building a Windows Forensic Environment (WinFE).

Download/Discuss it here.

How to use it? Easy :
-Launch winbuilder,
-Go to source tab,
-Select your source directory to point to your windows media installation dvd drive (E:\ for me),
-Click play,
-Retrieve your winpe iso in x:\Mini-WinFE\WinFE.Project.Output\.

 Posted by at 20 h 53 min
Mai 062014
 

There are cases where your operating system is not booting anymore but you really need to retrieve important/personal files.

You could boot a WinPE onto a USB key (using QuickPE and Rufus) to work locally on the faulty computer but you could also do it remotely, confortably settled from another O.S.

Here below the steps :

1-Lets make a WINPE out of  windows (7 or 8) iso/dvd (I use QuickPE) .

2-Boot onto this Winpe (I use rufus to « burn » the winpe iso onto USB).

3-Launch DevIO : from the WinPE command line, type devio -r 9000 \\physiscaldrive0 1 .
Note : the -r is for read only and physicaldrive0 1 for disk 0 partition 1.

quickpe2

4-Launch ImDisk : from a remote host command line, type imdisk -a -t proxy -o ip -f xxx.xxx.xxx.xxx -m X:
Note : replace xxx.xxx.xxx.xxx by the ip of your WinPE / faulty computer

recover2

5-At this stage, you should now have a new logical drive letter X: appearing on your remote host.
You can now recover your files remotely !

 Posted by at 12 h 49 min
Mai 042014
 

MistyPE is an excellent WinPE generator based on Winbuilder.

It is minimalist (in a way it is easy and fast to build WinPE) but still very flexible so that one can add many extra softwares in there.

Download/Discuss it here.

How to use it? Easy :
-Launch winbuilder,
-Go to source tab,
-Select your source directory to point to your windows media installation dvd drive (E:\ for me),
-Click play,
-Retrieve your winpe iso in x:\MistyPE\MistyPE.Project.Output\.

 Posted by at 17 h 05 min
Mai 042014
 

If, like me, you often get confused with WinPE versionning, here below a quick summary :

  • WinPE 2.0 – 6.0.6000 – Vista
  • WinPE 2.1 – 6.0.6001 – Vista SP1 and possibly Server 2008
  • WinPE 3.0 – 6.1.7600 – Windows 7 and possibly Server 2008 R2
  • WinPE 3.1 – 6.1.7601 – Windows 7 SP1 and possibly Server 2008 R2 SP1
  • WinPE 4.0 – 6.2.9200 – Windows 8 and possibly Server 2012
  • WinPE 5.0 – 6.3.9600 – Windows 8.1
  • WinPE 5.1 – 6.3.9600 – Windows 8.1 Update 1

Thanks goes to Misty on reboot.pro for making this clear !

 Posted by at 16 h 58 min
Mai 042014
 

Lately I had been testing a lot Windows 8.1 and WinPE generated from Windows 8.x (i.e WinPE 4.0, 5.0, 5.1).

The Windows QEMU I had (lots of versions out there) was giving me a windows error 0x0000005d which means UNSUPPORTED_PROCESSOR .
Indeed, starting with Windows 8, you need a processor that supports NX/PAE/SSE2.
NX is not supported with older windows QEMU versions.
More details from MS here.

Googling around it appeared the solution was to use the -cpu command line parameter with QEMU.
Unfortunately, none of the QEMU versions I had was supported that parameter.

I then found the right (and latest) windows QEMU version (2.0.0) here.
I downloaded this version qemu-w32-setup-20140418.exe.
The command line : start qemu-system-i386.exe -L .-m 512-cdrom D:\WinPE5.1.iso-cpu Nehalem allowed me to boot my latest Windows 8.1 with success ! 🙂

Also, note the use of coreinfo (from sysinternals) to check your processor flags.

qemu_nx2

 Posted by at 16 h 56 min

QuickPE

 

Yet another tool to generate a minimalist winpe iso using the Windows Assessment and Deployment Toolkit (ADK) / Winpe4 or Windows Automated Installation Kit / Winpe3.
The batch also uses wimlib to add extra files within the boot.wim file.

Alternatively, one can also use the Windows Repair Disk or Windows DVD to build a Winpe or a Windows ISO (no need for WAIK or ADK then).
One can also add Winpe packages and/or add Windows drivers and/or customize the Winpe registry

The batch will :
-create a winpe using the copype winpe command from MS ADK or MS WAIK,
-modify boot.wim to add a tinyshell (see screenshot) so that one can launch explorer++cmdtaskmgrpenetwork, or shutdown/reboot,
-create winpe iso (less than 200 MB).

Uncompress to x:\quickpe, stuff your tools (optional) in pe_extra folder, and launch make.cmd.
Get winpe.iso in x:\quickpe\%processor_architecture%.

Future possible evolutions : turn into a GUI, …

Discuss it here
Download it here
Contact me here

Here below a screenshot of a generated WinPE with QuickPE

quickpe

 Posted by at 18 h 22 min
Fév 082014
 

Yet another tool (batch) to generate a minimalist winpe iso using the Windows Assessment and Deployment Toolkit (ADK) or Windows Automated Installation Kit .

Uncompress to x:\quickpe and launch make.cmd.
Get winpe iso in x:\quickpe\%processor_architecture% .

Changelog:

    • 0.2
    • -make4.cmd will generate a winpe4.iso (using MS ADK)
    • -make3.cmd will generate a winpe3.iso (using MS WAIK)
    • 0.3
    • -winre.cmd will generate a winre.iso (using local WINRE)
    • 0.4
    • -any files/folders in \pe_extra will be added in the wim file in the \tools folder
    • -winre.cmd renamed to make_re.cmd to be consistent with make_pe3.cmd and mape_pe4.cmd
    • -added setres to the zip file.
    • 0.5
    • -added make_re_from_iso.cmd which will generate a winpe iso based from a windows 7 or 8 iso.
    • -added make_re_from_dvd.cmd which will generate a winpe iso based from a windows 7 or 8 dvd.
    • -added a dpinst GUI so that one can easily load drivers from a driverspack.
    • 0.6
    • -added : compatibility with x64 hosts for winpe4
    • 0.7
    • -added : add-pack3.sample, add-pack4.sample (rename to cmd to add a winpe package in winpe3 or winpe4)
    • -added : _run_me.cmd as a main menu
    • 0.8
    • -added : x64 tinyshell
    • 0.9
    • -modified : reviewed code so that it all works on x64 platforms
    • -added : add-drivers3.sample, add-drivers4.sample (rename to cmd to add a windows drivers in winpe3 or winpe4)

Download/Discuss it here

The batch menu :

quickpev09

A generated Winpe :

winpe

 Posted by at 22 h 03 min
Jan 252014
 

BOOTICE is a powerful boot-related utility.
It’s desired to manipulate (install, backup, restore) the MBR and PBR of disks (or disk images), to partition and format disks, to edit disk sectors in hexadecimal, to erase all the data on your disk or logical drive (by filling with customizable characters), to edit Grub4DOS boot menu, and to edit BCD file of Windows NT 6.x.

2013.12.10 v1.3.2.1
1. Fixed the bug that compacting VHD doesn’t work on Windows 7.

◆ 2013.12.07 v1.3.2
1. VHD/VHDX supporting. Now you can create, mount or unmount, resize, compact, reset the parent VHD file for VHD/VHDX files.
2. Better partition formatting speed, especially for NTFS.
3. Allow formatting as FAT32 on a partition larger than 32GB.
4. Fixed a bug that cuases wrong total sectors of VHD files.
5. When installing GRUB4DOS/WEE MBR, the choice « Install NT6 MBR to the 2nd sector » was checked initially.

Find it here.

bootice