Sunday, December 07, 2008

Custom Win PE Boot Disk Building: Step One – WAIK up

First Review the prior links in this series.

Now what we have to do is install the Windows Automated Installation Kit so we will have the foundation for all our additional building efforts.

I’ve covered this part before here on GSD so you might want to also review my Windows PE 2.0 Free For Everyone (Almost) post first.  Most of what follows comes directly from it.

Also, this walkthrough will be specifically to create a x86 32-bit based WinPE 2.0 based boot disk.

Step One – Get the WAIK

From Microsoft download either of these two file packages.

I am going to be using the second one as it incorporates Vista SP1 while the first does not.

Step Two – Install the WAIK on your system

It can be installed on any of the following systems: Windows Server 2003 SP1; Windows XP SP2, and Windows Vista.

Note: The installation application says it must be an XP Professional version, but I just installed it and ran it on my Windows XP SP2 Home system just fine with no complaints at all.

Once downloaded, you have an IMG file which you then have two options to use.

1) Burn it to disk using a disk-burning application, or

2) Mount it as a virtual cd/disk image using a virtual disk application like the freeware SlySoft Virtual CloneDrive.  For tips on that try this post: Installing Windows AIK without a Disc is Free and Easy – ITsVISTA blog.

Take your pick.

Run the installer and get it loaded up.

(Note: All my systems are NTFS partition formatted and for this to work, the primary volume/partition that you will be working on should be the same as well.)

Step Three – Create the C:\winpe_x86 system folder

The C:\winpe_x86 folder will be the workhorse of our building work.  So we got to get it right.

I recommend first reading the Toss DOS, Install Vista with Free WinPE at ITsVISTA.

His steps are so easy to follow it’s become the defacto standard to me.

  1. Go to the Start menu and under All Programs find the Microsoft Windows AIK folder and launch Windows PE Tools Command Prompt, or open a command prompt and type cd c:\program files\Windows AIK\Tools\PETools.

  2. Create a local Windows PE build directory by typing the command copype.cmd <arch> <destination>. If you’ll be working with 32-bit machines (the rest of the examples will assume you are), replace <arch> with x86. If you’ll be working with 64-bit machines, replace <arch> with either amd64 or ia64, depending on which chipset your computers have.

  3. You’ll see a list of files copying.

So just follow step one as is.

At step two type in exactly the following command paying mind to the spaces and <enter>:

copype.cmd x86 c:\winpe_x86

The files will copy and when done you will see the cursor again.

Step Four – Validate

If everything went as planned you should now find the following when you look at your C: drive:

Double click “My Computer” or open Windows Explorer.

Open the C: drive.

Browse down and you should now see a folder “winpe_x86”

Double click it.

In there will be two folders “ISO” and “mount” along with two files, one of which is winpe.wim.

Open the ISO folder and there should now be even more folders and files.

Open the “sources” folder and you should find a “boot.wim” file.

Good?

That completes getting the WAIK installed, and creating the foundational c:\winpe_x86 folder.

Extra credit reading

Class dismissed until next lesson!

--Claus

NTFS Formatting an Imation USB Disk

If you read down to near the end of my Security and Forensics Roundup: Heavy Version #2 you will find that yesterday I got daughter-unit Alvis her very own USB disk to use for school.

I had bought a 2 GB USB stick with a write-block switch and it is an Imation brand.

This morning I was setting it up for her.

It did not come with any U3 stuff, so that was good.  Imation also kindly tossed in a partition-encryption program called “Imation Lock”.

Imation Lock

Figured I would play with it a bit to see if it would work better than with adding a TrueCrypt container.

Well, I wasn’t impressed. 

Basically you create a public and an private partition.  The private partition is the encrypted one. You set a password and then by using the software, can unlock and load the encrypted partition.

Sounds nice but it sucks.  Bad.

First I read the whole manual.  Yes.  All 16 large-font pages of it.

The same one that shows the “Effective” date of 25-Sep-2006. 

Oh bother.  Not a good sign.

On our XP system (under a full admin account) the configuration steps went fine. No real problems.

It was when I started actually using it that the problems showed up.

First, on my humble system, I never could get both the secure and public drives to show up at the same time.  One or the other baby, despite the photos in the manual.

Mounting and dismounting was pain and required removal and replugging of the USB drive when I switched between those volumes.

So I decided to reformat the USB drive and stick with my original plan with a TrueCrypt volume.

Format Away!

I used the Imation Lock program to remove the secure volume, then right-clicked the drive in My Computer and selected “format”, only it was formatted as a FAT volume and my only other choice was to format as FAT32. 

I wanted NTFS.

What gives?

More searching and here’s a modified version on how to do it:

To enable NTFS as an available File system option in the pull-down menu, the policies for your USB device must be set to "Optimize for performance".

    1. Insert USB drive into the computer’s USB port.
    2. In My Computer or Windows Explorer, highlight the USB's drive letter.
    3. Right click on the drive and select Properties. The Removable Disk Properties dialogue box will open up.
    4. Select the Hardware tab and then select the correct USB device for the drive.
    5. Click the Properties button near the bottom of the dialogue box. The Device Properties box will open up.
    6. Select the Policies tab in the dialogue box and then select the "Optimize for performance" radio button.
    7. Click the OK button in the Device Properties dialogue box to exit. Click the OK button again in the Removable Disk Properties dialogue box to exit.
    8. The NTFS option will now be an available option to select for the File system format. Follow normal procedures for formatting a drive volume in Windows.

Worked like a charm and the thing NTFS formatted in less than a minute (it’s only 2 GB).

Follow Up

I rounded it out with one of the PortableApps Suites along with some extra games and useful applications from the site as well.

Did you know you can add a 48x48 pixel image to the Portable Apps menu? Kind of like in XP/Vista’s Start menu? I stuck Polka-Dot’s (our family’s hamster) picture there.  Thought Alvis would be impressed.

polkadot   Kawaii! (“cute/adorable” in Japanese).

I added a TrueCrypt container.  Much, much easier to use and manage. 

Even for Alvis.

I copied her icanhascheezburger image collection to it.  What can I say….

Then I showed her how to manually launch the Portable Apps suite (since the autorun.inf file is now a folder) along with mounting/opening her TrueCrypt container.

She was impressed.

--Claus V

Custom Win PE Boot Disk Building Saga: Introduction

This will be the first of a series of posts that I really have wanted to compose so badly I’ve been avoiding it like The Plague.

It’s not that I don’t want to share the information and tips/tricks I have learned by myself and from others.

It’s that I’m still having a very difficult time deciding how to organize the material.  I think I have a sufficiently semi-logical outline developed and will be now starting an extended series of posts.

Hopefully some folks will find the information useful.

Introduction

I’ve been building “LiveCD” boot disks for many years now once I figured out the benefit it could have for our IT team.  D-Man and Mr. No at work paved the way before my joining the crew with some early bat.file DOS boot floppy work.

Not to be outdone and to show these god-like analysts I could bring-it, I soon had put together a CD that had an auto-run menu which would allow technicians (as I was at the time) to pick from various Windows utilities and setup programs.  It was cool and an instant classic.  It did not, however, contain system-boot support.

This was back before USB drives were common place, so to copy user data from a OS-dead system either meant removing the hard-drive and placing it in working system, or booting with a DOS boot disk and copying data to 1.44 MB floppies.  Not cool, even in old-school times.

In the Beginning there was Novell…

Since we were on a Novell network, I began building and implementing with Erwin Veermans NwDsk: NetWare Boot Disk (IP/IPX).  With some fairly easy Cd-Fu building I had quickly created a CD that could be used to boot a system from and connect to a Novell server volume.  Then data could be copied up bypassing the need for floppies.  Meanwhile the autorun menu/utility side still worked if the CD was put in a normally running Windows system.

That worked great.  However there was one little problem.  Most all of the technicians didn’t really know or like working in command-line. 

Give me a break.

DSL Build Period

So from there I gradually moved from the NW boot disk to Damn Small Linux (DSL) as the boot tool.  This provided a more usable GUI interface that I was able to customize while still being small enough for me to keep my Windows auto-play side intact.  I really had a blast learning all the Linux stuff to build and customize a booting ISO file.  Local off-line system files could be FTP’ed to the Novell volumes. Perfect!

That worked even better and was very pretty.  However there was one little problem.  Most all of the technicians didn’t really know or like working in Linux. 

Sigh.

BartPE Build Period

So I then found and started building Win PE 1.0 based Bart’s Preinstalled Environment (BartPE) boot disks.  This was way-cool.  Now I could build boot CD’s with a GUI based on XP.  Still preserving the Windows auto-play menu side.   Perfect right?

Nope. 

We were still a Windows 2000 shop and the Win PE 1.0 licensing requirements are very stringent.  I had to have sufficient XP licenses to cover them, which we only had a handful.  So I could only build and distribute a few. Eventually we upgraded from W2K to XP so I was freed up.  Still had to FTP local files to the servers, but still it was a solution.

Now it was near perfect.  The technicians were happy and I was happy.

The Dawn of a New Era: Win PE 2.0

Then came Win PE 2.0.  It was based on Vista, supported ImageX, and could do tons of really cool things and effectively had none of the onerous licensing that Win PE 1.0 carried.  I saw stars in my eyes and quickly worked out building a custom CD that still let the Windows auto-play menu work on a live system.

Only it was command-line based and again, despite all attempts, no one except D-Man and Mr. No thought it was worthwhile.  It languished and BartsPE ruled.

That was until I found VistaPE.  It is very similar (in theory) to BartPE but provides a wicked cool GUI to the Win PE 2.0 base.  For a sample, check out these GSD posts VistaPE Builder Tutorial - Highly Advanced (and Fun!) and VistaPE WinBuilder 011 - Basic Walkthrough.  Now we are at awesome-cool.

Away I went and everyone was amazed.  Vista LiveCD boot goodness and sophistication along with my now ingrained Window live auto-play utility menu. Happiness.  And not only could technicians still FTP files up to the server if needed, Win 2.0 would flawlessly auto-detect and mount USB storage devices (which had by now become the defacto standard for file-recovery and transfer). FTP became a rare activity.  Just copy/paste. Done.

Storm-clouds on the horizon…

With the OS march from Win95/98 to Win2K/XP, the auto-run menu launcher I had been using on the Windows side of the CD was showing its age.  It was based on 16-bit programming and now took too long to launch under 32-bit OS systems.  It would eventually, but not snappy like it did under Win95/98 when I had started using it.  I tried various replacements and eventually changed over to Pegtop PStart .  So while it wasn’t as nice a GUI for the menu structure I had been using, making updates was a snap and it could do a lot more tricks. It was back to snappy menu loading again.

The real storm came when we began the conversion of our desktop systems to Dell Optiplex systems (745/755/etc).  These models dropped PS2 connector support and were now all USB driven.  The standard keyboards were also USB devices with USB ports on the back.

Suddenly the VistaPE disks showed a serious problem.  Turns out that the VistaPE driver-loading process they use would render the Dell USB keyboards dead when the boot-disk side was used.  Yes, the mouse still worked, but it was of little use.  I hacked a temporary solution of installing and auto-launching On-Screen Keyboard Portable but while this worked, it was not sexy or convenient. 

So I never distributed it and have spent the last many months trying to hack-out a working fix for that Dell 755/745 USB keyboard driver loading problem under VistaPE with little success.

The keyboard would work fine under the plain “original” WinPE 2.0 disk build, it would work fine under a VistaPE (Vista RTM setup disk source) build.  It would not work under the VistaPE (WAIK source) build.

Since the D-man had provided me a legit copy of a Vista RTM setup disk I thought I was in good shape again. The Dell USB drivers would load and the keyboard worked again under that build strategy.

Then the ceiling came down…

Recently a decision was made higher up to deploy PGP whole disk encryption across all our desktop/laptop drives, enterprise-wide.

That is a Very GoodThing™.

Only here’s the new problem.  If the entire drive is encrypted, what use will a Live Boot CD be?  The system and user files were now securely tucked away out of sight!  PGP does provide their own PGP off-line recovery disk but I didn’t care for either the interface or the nature of the tool in general.  No offense to PGP but it wasn’t what I was interested in.

Leave it to clever Claus.  I wasn’t about to abandon all this work and investment, just yet at least.

PGP, PE 2.0, and VistaPE building: Let the migraines begin

Turns out, PGP does provide a way to inject their WDE drivers into a PE 2.0 disk build.

After some initial joy and effort working out frustrating typos in the document, I was successfully able to build a merged PGP/WinPE 2.0 boot disk. 

Hurray!

Then a dead-end as I didn’t want to go back to giving a CLI WinPE 2.0 disk out to the technicians again.  I knew from experience that they would never use it.

See this works for the pure Win PE 1.0 / PE 2.0 disk builds (and some BartPE stuff), but was not at all designed to support VistaPE builds.

Darn!

However I knew the VistaPE was based on WinPE 2.0 so it “should” work, somehow.  More clever hacking and experimenting and I actually worked out a way to inject them into a VistaPE build!

Hurray!

Only (yep) it would only work under the VistaPE WAIK-based builds, which as you will remember has that awful Dell USB keyboard driver killer problem.  No good unless I reverted again to the on-screen keyboard solution which as a non-starter to me.

D-Man tipped me off on a technique to try and while initial efforts looked positive, I eventually had to mostly abandon that path.  I did learn a lot of extra stuff in that process regarding WIM driver injections, off-line registry editing, WIM mounting and manipulation, and VistaPE driver supplementing, and untold other really cool things.  Heady stuff!  But it didn’t get me anywhere...so I thought.

Using the techniques under a VistaPE RTM-Vista disk build rendered a BSOD during the driver-load process due to a driver conflict between something and the PGP encryption system drivers.

Unfortunately I was back to square one.

A New Era Arrives!

Then in the very busy days leading up to the Thanksgiving holidays, somehow in all the ongoing work crossing my desk, I found time to pick at this whole thing from a fresh perspective.

All those disconnected facts and bits must have reached critical-mass.

I managed to re-evaluate all that I knew, what I didn’t know, and make one last attempt at it, shedding all my previous building techniques and taking a fresh approach that would make Victor Frankenstein proud and VistaPE’s NightMan developer cringe from my non-script-based hacking of VistaPE, the WinBuilder platform, Win 2.0, and the WAIK tools.

When I left work for the holidays that Wednesday night, I had on my desk a VistaPE-based boot disk CD, based on a WAIK build, with a custom desktop wallpaper of my own choosing, that worked on Dell Optiplex 755 and 745 (in fact all our desktop/laptop system models as yet tried) with full working keyboard support, Imagex drive capture and reimaging support, and PGP whole drive encryption support to allow decryption of the system drive(s) with the user’s passphrase.

Oh yeah,  I forgot to mention that when the CD is used on a live Windows system, my utility auto-run menu picker still works.

Sweet.

So in the coming weeks I will begin to share specific bits learned from this process and at the conclusion, provide Claus’s Frankenstein-ish method for you to hopefully have the same successes I did.

And if we are lucky, maybe the VistaPE building pros will help us along the way to make it even prettier.

Stay tuned.

--Claus V.

Security and Forensics Roundup: Heavy Version #2

cc image credit: Jeremy Botter, flickr

Standing guard so you can remain alert.

So many, many very good security and forensics related links, my head is spinning from trying to organize them all into a single and coherent post.

To help achieve that, commentary will be kept to a minimum.

Must Reads

  • (IN)SECURE Magazine – Volume 19 was released this week in PDF format.  Always an engaging mix of technical discussions, security concepts, and hidden tools and tricks. Highlight articles (to me) include:

    • The future of AV: looking for the good while stopping the bad
    • Eight holes in Windows login controls
    • Web filtering in a Web 2.0 world
    • The role of password management in compliance with the data protection act,
    • 5 strategies for proactively embracing failure
    • Navigating a sea of fake codecs,
    • Role Based Access Control, and
    • How to build a security strategy to grow your career, success, and results.

  • Secret Geek A-Team Hacks Back, Defends Worldwide Web – Amazing Wired Magazine article covering the incredible discovery by Dan Kaminsky on a critical DNS flaw, and the ensuing damage control.  If you haven’t read this yet, stop and read it now.  There have been lots of follow-on discussions on the web regarding this issue, but this is a foundational read.  Great writing on technical security subject by Joshua Davis.

Password?

  • NirBlog: Saved Password Locations – NirBlog post that provides awesome background information on the locations in the Registry or file system for popular password storage.

Good information for sysadmins and auditors.

All signs point to caution when installing Firefox Add-ons.  Don’t get caught.

Score: ElcomSoft 1 : Adobe 0

Password: Stop the Leak

Fresh on the heels of SynJunkie’s excellent wireless pen-attack story comes a new series on an insider attack and investigation.

Kick back and enjoy…depending on your perspective…

Tools and Tips for Forensic Examiners

  • Basic eBlaster forensic analysis – CFMADI blog.  Great breakdown on eBlaster computer monitoring software detection.

  • Cisco Router Forensics - SANS Computer Forensics, Investigation, and Response.   For a higher audience then the desktop level work I deal with but it was good stuff anyway.

  • Perl and Forensics - SANS Computer Forensics, Investigation, and Response. I’m quickly realizing that it might be a good thing to add “Learn Perl” to my “to-do” list.

Speaking of Forensic Examiners: R U A π?

While new legislative requirements within states for forensics professionals to hold private investigators credentials are not a new subject, they seem to again be popping up and causing some degree of confusion and concern in security circles.

I even recall concern for syadmins and pc-repair tech shops believing that new legislation in Texas would lead them to shut-down until they got proper PI accreditation. (Probably not…yet.)

Thus behind that backdrop, comes even more movement on the PI (get it now? PI, pi, π) certification front in forensics.

On the surface it seems like a very good idea.  I’m all for professional accreditation where it will provide valuable and critical training/knowledge to work done in the field.  If however it provides nothing but a piece of paper on the wall and no true relevant test of demonstrated skill in the forensics field, well, even I can let you show me where a horse has been stabled and I will find evidence of what he ate and call it proof for you.

For a perfect and crystal-clear example of just why real and certifiably proven professional forensics experts are needed (and not just those who are clearly “certifiable”) look no further than this case:

Alex Eckelberry and a team of real-world experts took a look at the official court record of evidence along with a Ghost copy of the hard-drive.

I’ve read the PDF they’ve provided based on their own professional analysis and it is simply frightening.  I don’t know where to begin.  Reading it certainly clears up a number of misconceptions I had.  And it helps me understand the whole problem much more clearly.

It should be a must-read for all forensic folks as well as system administrators/security wonks.  I almost put it in at the top.

I’m wondering if the PI accreditation requirements would have helped changed the prosecution’s "forensic” experts’ evaluation and conclusions.  Somehow I suspect not.

Which comes back to my take. Experience has taught me the following wisdom; experience doesn’t necessarily make you an “expert”, nor does any degree, honor, or accreditation. In the end it is what you do personally with any and none of those things that truly will define if you are an expert in the eyes of the public and your peers.  Enough said.

I see…malware in your future

In high-school I went through a very brief fascination with the Tarot cards.  That lasted until the reading I took regarding a hook-up with a very particular pretty girl in my class fell through.  I decided then and there it was bunk.

However, the dark-arts are alive and well in the world of malware.  And that is a prediction I would put money on to remain true.

  • Malware constructor – Sunbelt Blog highlights a new malware building tool for the masses.  Looks pretty cute and harmless until you come to find out from other links that it also seems to contain a trojan.  No honor among thieves I guess…

  • VirusTotal += Comodo – Yep. Comodo’s earned a major recognition upgrade here by getting its AV scanning engine included in the VirusTotal arsenal.

  • CBS.COM was compromised – Finjan MCRC Blog – Darn it.  And all I wanted to do was get tickets for “The Price is Right”….

  • Microsoft adds malware detection to its Webmaster tools - heise Security UK.  I’ve already signed up and have this blog being monitored by Webmaster Center.  So far so good.  Still need to enroll in Google’s Webmaster Tools which has similar features.  It was very simple and pretty easy to enroll and configure. No pain.

  • Merry Malware - You’d better watch out, you’d better think twice… and O Come All Ye Malware– Microsoft Malware Protection Center blog.  More fun and holiday cheer than a bad company holiday party coupled with rancid eggnog.  Yeah.  That good.

  • VLC Exploit In The Wild – Infosecurity.us – I’ve used and loved a portable version of VLC for quite a while, but Secunia’s PSI tool never has been happy with VLC for some reason. No matter how hard I patch it, it never seems like it was enough.  Now it seems that there are even more problems with it from a vulnerability standpoint.  I only use it with trusted media files, and it has not been set as an associated application. I’m not giving up yet. But you better be careful all the same and stick to trusted media files, from trusted sources.

Rootkits?

Here we go again with software vendors dropping rootkit like stuff into their products.  So it appears folks have already forgotten Sony’s failed foray into this arena?

The Ghost of USB/AutoRun malware past

As I responded at Harlan Carvey’s post in the comments:

Daughter unit (Alvis) needed a USB stick to take to her high school to save work from a computer-lab if her assignment work wasn't completed. She had responsibly asked me a few days in advance and I promptly forgot. We got in the car a few days later and I remembered again and asked her about it. She had the forethought to grab one of our old/small USB sticks (32MB?) and had it with her.

I had to confiscate it with regret.

  1. I didn't know what of our data was still on it and needed to "audit" it and remove anything of importance in case of loss/theft at the school. (update for the curious: Turns out it had two archived KeePass databases from early 2007 (!), numerous jr.high project documents, probably every picture from icanhascheezburger, some Zoo Tycoon save files, mid-2008 dated JSON and OMPL backup files from my Firefox profile, and a PE disk building tutorial from work.  Would have been “ok” but I’ve gone back and (securely) cleaned all the old stuff off anyway.)

  2. I needed to make sure it was "clean" of any thing that might get her into trouble at school for "possessing" (forbidden utilities perhaps such as pentesting tools and other PUPS, etc.).

  3. I have NO idea the condition of the lab-pc's she will be using at school. Don't know how their IT department maintains them, what AV/AM software is used, how often they are scanned/checked for rootkits and other baddies, etc. So cross-infection of our systems could be a real possibility.

  4. Need to figure out a "reasonable" way for daughter-unit to use a USB drive between school/friends houses/systems and our own but that will minimize chance of infecting our own. Going to have to spend time looking at my new AV/AM software to check out automatic detection and scanning/access settings for removable (USB) devices.  (update: from the comments, Steve suggested looking at Didier Stevens’ USBVirusScan which can be configured to launch an AV application when a USB stick gets inserted.  Awesome tip and now added to my Sunday “to do” list! Thanks Steve!)

(Sigh)

It's hard being an IT dude AND a dad these days. Oh to be blissfully unaware....

Harlan encouraged me to start applying the MS patch and registry fix. I’m working my way through our systems this weekend.

Hogfly also chimed in with tips

There are ways to mitigate risk on a usb stick.

1) Buy one with a write block switch. Kanguru sells these.

2) Create a directory(yes a directory) named Autorun.inf. This is known to help mitigate the ability of the malware to write to the drive.

3) Disable Autorun using group policy on your computers and force the following registry change:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

These steps work.

So today I bought a 2 GB USB stick with a write-block switch for Alvis and will be keeping an eye on it as well as its contents.  I will also be removing all the U3 preloaded stuff, doing some more of Hogfly’s tips as well as adding a TrueCrypt container and showing her how to use everything. I might even round it out with one of the PortableApps Suites along with some extra apps as well.

Alvis even liked the carabiner clip it came with.  It passed the cool factor.

What a dad.

Software and Tip Roundup

Get along little doggies!

  • FileAlyzer shows you detailed info for any Windows file - Download Squad.  Been using this tool for years.  Easy to use and free.  Great starting point for looking into file specifics when mashing malware. FileAlyzer is developed by the makers of Spybot Search and Destroy malware scanner.  A new 2.0.0.10 version now supports multiple file handling.  By that I mean you can open more than one file and cascade/tile them in the main window (a la Windows Office files) for rapid comparison work.  It performed fast and great in my testing of the newest beta version.

  • PowerShell - Finding New User Accounts – SynJunkie blog. Script to locate all accounts created between two specified dates.

  • Patching offline virtual machines – Security4all. I think I remember forgetting I could do this. Now I am sure to do it.

  • Update: Restoring Safe Mode with a .REG file, and a Live CD - Didier Stevens shows us how to restore Safe Mode’s “SafeBoot” keys to the Registry via a LiveCD when they have been removed by malware attack. Got to add these to my own custom PE 2.0 build disk.

  • Privacy Alert - ISPs putting ad service boxes in the clickstream is bad - Scott Wright’s Security Views. At the risk of veering completely off target, indications are that a new partnership between Phorm and ISP’s could mean a major change in the way ads and your data is parsed through your ISP.  Tinfoil-hat stuff or true security risk?  Minority Report ad-service coming true?

  • Building a Security Tool Chest – InfoSec blog. Stumbled on this series of posts.  The first list is pretty short. The rest build in number of tools and usefulness. They might be a good starting point.  I like scanning these lists to see if I might come across a new tool or two. Your mileage here may vary.

Keep it safe!

--Claus V.

Saturday, December 06, 2008

Windows Vista and Slipstreaming: A Primer

I’ve been slipstreaming XP setup disks since SP1 was released.

There are a lot of third-party tools to help make the process painless, but in the end, I always come back to the basic method outlined by Paul Thurrott in his Slipstreaming Windows XP with Service Pack 3 (SP3) guide (and previous version as well).  It’s easy, fairly fast, and once you’ve done a few, you can make XP Slipstream disks with your eyes closed.

I’ve got a number of what I consider the best links and guides for XP slipstreaming collected and have been sitting on them for months.  Eventually I will get around to posting that roundup.

However with Vista, the whole slipstreaming thing appears to have become derailed.

Why Concern Now?

After Vista was released the masses moaned to Microsoft about numerous performance issues and bugs.  Eventually MS released Vista SP1 and all was heavenly.  I (and most others) noticed immediate performance improvements and program stability.  Golden.

I imagine most folks just followed what I did and allowed Windows Updates to offer the SP1 install and apply it.  Part of that was due to a pre-update update that checked for necessary conditions prior to allowing SP1 on the system.  Seemed like a good idea.  As our Gateway laptop didn’t come with a traditional/pure Vista setup DVD, rather a OEM “restore” disk/partition, I didn’t have any source material to use for a Vista slipstream attempt anyway. With only one Vista system, I didn’t really care, to be honest.

Now Vista SP2 is on the way and thanks to the D-Man, I have a full and legit Vista SP1 setup DVD to use for testing and PE 2.0 building.

Suddenly I found myself waking up to a possible need for a Vista slipstreamed disk and as all the above links point out, a beta version was out ripe for testing.

Only a comment by joshf in the Techblog post left me suddenly wondering what crazy world I was waking up to!

They didn't include a slipstream feature in SP1 and said they'd do it in the next service pack, has anyone heard anything about it?

But if it is anything like Office 2007's so-called "slipstream" then I don't want it (placing the service pack setup in some "update" folder and AFTER the OS is installed spend another hour or so waiting for the service pack to install).

Turns out I had missed a lot of key developments in Windows slipstreaming devolution while I was asleep.

joshf had just delivered my wakeup call.

Vista Slipstreaming Primer

As stated, while I am getting very advanced with PE 2.0 WIM building and manipulations, I’m still taking in the background for Vista slipstreaming.  I have no doubt if I inadvertently make any mis-statements, I will quickly be corrected in the comments!  Please help educate me!

Vista setup is build on many processes wrapped in a WIM (Windows IMaging file). WIM files are wicked cool for image deployments, especially in that they can be “off-line” mounted and updated, include multiply “stacked” image versions in a single WIM, as well as have drivers and hot-fix updates (in some circumstances) injected into them.  Oh the tricks that one can do!  But that is for prior reading and future posts….

In a post earlier this year, Paul Thurrott outlines some key information that is a wakeup call for some of us XP slipstreaming pros: Microsoft speaks on slipstreaming Windows Vista with SP1 - SuperSite Blog

Way back when, one of the touted benefits of Windows Vista was that then-future updates, including service packs and hot-fixes, could be very easily "slipstreamed," or integrated, into the Vista install image, create an always up-to-date install image that would be used going forward. How easy was it supposed to be? Microsoft placed a convenient UPDATE folder right in the root of the Vista install image and claimed that any fixes you wanted to integrate simply needed to be copied into that folder. Voila! An integrated, slipstreamed Vista install image.

…however, this technical nirvana remains but a dream. Because of "some unexpected issues with the servicing stack," as Microsoft put it, this drag-and-drop form of slipstreaming never happened for SP1. I was told at the time that Microsoft was hoping to make it available for SP2, but no promises. (emphasis mine)

But what about SP1? During the same meeting that led to Inside Windows Vista Service Pack 1, Microsoft told me that customers interested in slipstreaming SP1 with Vista could still use the old -integrate method of slipstreaming (which I document in my XP SP2 slipstreaming guide). Fair enough: This process is well known and has had years of success. But then, that's true of the pre-WIM world. Vista, you see, uses a different servicing model than XP and previous NT-based versions of Windows. So things are a bit more complicated.

Make note of that part I’ve emphasized.

Now let’s go directly to the heart of the problem why slipstreaming of Vista RTM to Vista SP1 isn’t “officially” possible.

Full of I.T. : I can’t do WHAT?! Why can’t I create my own slipstreamed installation of Windows Vista SP1? – Kevin Remde’s IT Pro Weblog.

This seems to be THE definitive source pointed to across the Net on why one just can’t do it like XP/Windows 2000 builds. What Kevin says in that post is this:

Okay.  So here's the deal**.  And those of you who have experienced the SP1 installation have experienced this as well.   When you do the SP1 installation, even if it's from Windows Update (when available), you're going to see your machine shutdown and restart on it's own several times.  That's to be expected.

See, there's this important part of the OS known as the "servicing layer" in Windows Vista and Windows Server 2008.  This is the part of the OS that allows for easy update installation with minimal disruptions, allows for an update to be applied to an offline captured image that's within a .wim file, among other things.

Well.. let's say that that servicing layer ALSO needed to be updated?  What then?

"Oh.. I get it.  You can't update the thing that makes the updates happen smoothly, because the thing that makes updates go smoothly is itself being updated!"

Bingo.  You got it.  So hopefully the news that you can't just do an offline upgrade to an image .WIM file won't be too tragic.

"So.. what do I do instead?"

You are going to have to install your image to a machine.  Install the Service Pack.  Then re-capture the image.

"Simple!"

Not so simple.  There are additional steps that involve some cleanup once you've sysprepped your newly updated SP1 machine.  Detailed steps are available in the new WAIK documentation.

Make sense?

OK.

However, that seems to apply specifically just to the jump from Vista RTM to Vista SP1 as the key issue here was the critical update to the Windows Updater’s Servicing layer.

So the official method for “slipstreaming” was to (basically) install the base Vista setup to a system, update it with the new SP1, Sysprep it with the updated Sysprepper, and recapture the WIM. Only see the Vista RTM contains multiple versions and you have to make a fresh capture for each version you want to “slipstream”.  Ugly and a whole lot more work that XP/2000 setup media slipstreaming.

Leave it to the Younglings: Slipstreaming Vista RTM and SP1

Of course, just because Microsoft said something wasn’t supported, or the “official” way was the only way, didn’t mean gifted enthusiasts listened.  Nope.

They seem to have hammered out two basic alternatives.

The first and semi-official means is to “reverse integrate” by installing the Vista image to a host-system, install the Vista SP, then recapture.

This then led to a remarkable number of attempts to refine the process quite a lot more. Leading at the culmination to a editor’s nightmare of a post (although it remains a fascinating read).

You just have to love and feel for poor Arneh who stuck with it until the 12th update!

Rise of the Jedi: Third-party Vista SP1 slipstreaming tools

During this stage, Slipstreaming Jedi masters finally merged with the Vista force and developed two competing unofficial and unsupported Vista slipstreaming tools.

The first method is based on a German Vista Update Integrator .NET tool crafted by AlbertS2.

Looks awesome wicked-cool and brings out the German pride in me.

However, let’s not say everyone else is sleeping.

This long in development and refinement utility is very, very polished and, in fact, does support the ability to Slipstream Vista Service Pack.  Although it doesn’t specifically (yet) address how SP2 will be handled. I’m sure the gang is hard at work on it as we wait.

For a great and clear guide on how to use it, I found two almost identical guides on the net.  I would say one was ripped from the other.  Looking at dates in the comments and posting dates, I have ordered them in what I think is the original and ripped attribution.  I could be wrong and will be happy to correct any attribution errors.

The first one is complete, though the numbering is off with a “missing” digit. Seems that the author forgot to catch he should have used a “3” instead of “4”.  The second one corrects that mistake but is posted many months later than the first comment date from the first post by Amit Agarwal.

You be the judge.

I also recommend dropping by the vLite forum and in particular the following thread

[Tutorial] Build Windows Vista SP1 x86 DVD using vLite

Alright. Now on to Vista SP2 matters.

A New Hope: Vista SP2?

Are we now on the verge of finally realizing “true” slipstreaming under Vista SP2 release?

All the old signs say: Maybe.

In his Inside Windows Vista Service Pack 1 post, Paul Thurrott had posted direct word from Microsoft that “off-line updating” while stripped from SP1 would return to Vista, possibly in SP2.

Deploying Windows Vista SP1

Since we're on the topic of confusing issues surrounding Windows Vista Service Pack 1, this might be a good time to address another bit of confusion surrounding this release. Way back in May 2003, I wrote up a Vista Setup and Deployment showcase that was based on a Microsoft presentation at WinHEC 2003 described Microsoft's plans for Vista deployment. The biggest advance, of course, was Vista's componentized architecture, which provides the foundation for a number of capabilities. One of these was what Microsoft calls offline updating, which is the ability to slipstream service packs and other hot-fixes into a Windows install image. Businesses use these images to blast new Windows installed down to network-attached PCs. And enthusiasts use them to create new versions of the Windows Setup CD/DVD, so they can perform clean installs with the latest bits pre-configured. This process, called slipstreaming, is horribly difficult under Windows XP. (See my XP SP2 slipstreaming guide for details.) But Microsoft promised to make slipstreaming almost laughably simple in Vista: I was told that users would be able to copy service packs and other hot-fixes into an UPDATE folder in the root of a Vista DVD or install image and just install the system, and all those updates would be automatically applied. It sounded fantastic, as it would to anyone whose suffered through the XP slipstreaming process countless times, and I was looking forward to testing this with Vista SP1.

Something funny happened on the way to SP1, however. First, Microsoft was curiously silent in public about this update between the end of 2006 and the middle of 2007, no doubt in part to convince its enterprise customers not to wait on the release before upgrading. And when Microsoft finally did break its silence at the end of summer 2007, it released a whitepaper describing the various ways in which users and admins could deploy SP1. And the only slipstreaming option that was mentioned was one in which Microsoft slipstreamed it for you and then supplied you with a new install DVD. Huh?

The fear, of course, was that Microsoft had given up on the drag and drop slipstreaming method, thereby erasing one of the key benefits of the new system. And this fear was only exacerbated by Microsoft continued silence on the topic.

So it with a sense of relief that I can now report that drag and drop slipstreaming--excuse me, offline updating--is still happening. It's just not happening in Vista SP1. "Vista Service Pack 1 will not be able to be applied as an offline update to prestaged install images," Zipkin told me. "But this will work as planned with future update, post-SP1 updates. We ran into some unexpected issues with the servicing stack, so we can't do it for SP1. But we're planning to add this capability for SP2, though we can't make any promises. This will be a bigger issue around SP2 than it is now. We think this is a one time thing. But you can still make your own slipstream DVD using the old '-integrate' method as with XP if you want to."

And in the release notes FAQ for Vista SP2 I found a curious tease regarding possible Vista "slipstreaming/integration" of service packs.

Frequently Asked Questions: Windows Server 2008 Service Pack 2 Beta and Windows Vista Service Pack 2 Beta Updated: December 2, 2008

"What is a standalone vs. an integrated SP2 DVD?

An integrated installation (also known as "slipstream installation") means that the service pack is integrated into the operating system, and therefore the operating system and service pack are installed simultaneously. You can use the integrated installation to upgrade computers running Windows XP and to perform clean installations on computers that do not have an operating system. A standalone SP2 DVD, also known as a 'Patch DVD', you use the stand-alone pack to upgrade computers that already are running the Windows Vista operating system with Service Pack 1 level installation. The download size of the stand-alone package is larger than the package applied with Windows Update. This method is recommended for: 1) Applying Windows Vista SP2 to computers without (or with limited) Internet connectivity 2) Applying the service pack to more than one computer using deployment tools such as Systems Management Server 2003 (SMS) or System Center Configuration Manager 2007 (SCCM).

Will Microsoft provide an integrated Vista SP2 DVD?

The ability to create an integrated DVD is available for customers, and Microsoft is still determining the demand to provide an integrated DVD. For more information

For more information, what? That second answer just ends hanging.  Where do I go for more information?  What is the information?  Does it relate to “the ability to create an integrated DVD” by all customers or the less enticing “to provide an integrated DVD” clause?

Has the UPDATE folder on the Vista root finally been armed to accept SP2 and higher for integration?  (I am assuming logically that due the issues related to Vista RTM and SP1 that IF so, it would only work with original Vista SP1 RTM disks as they would have thus bypassed the original “updating the updater service” barrier that caused the problems in the first place.

Fact is, I just don’t know!

What does that cryptic dangling statement really mean?

What is this ability and do I have to come from Krypton to have it?

I’ve spent a lot of time searching and trying to follow up on those statements by Paul Thurrott and Windows Client product manager Dave Zipkin about still making “…your own slipstream DVD using the old '-integrate' method as with XP if you want to."

But darned if I can find any hard (TechNet quality) information on how or where this is possible with Vista.

And none of the official Vista SP2 beta feature details make mention of the re-addition of Vista slipstreaming.

Plea for Clarification from the Pros

If any of my various technical Windows readers or enthusiasts have a way to clarify if "true" slipstreaming/integration is now possible and back in under Vista SP2 I would really appreciate you sharing details in the post comments.

I’d also be grateful for tips/leads on those just do your Vista slipstreaming the old way like XP with the “-integrate” method if they exist.

If not, what exactly is Microsoft talking about? Is it back to the old base "install Vista, update, recapture WIM" method?

If so, that's still not the holy-grail of "true and off-line" slipstreaming as I would see it (like in XP/2000), but plain-Jane OS deployment and image recapture.

Just wondering and wishing….and waiting to see if this feature will be delivered in Vista SP2

--Claus V.

 

PE 2.0 and WAIK Post Script:

While doing the research on this post, I came across periodic mention in a few forums of a WAIK (Windows Automated Installation Kit) command-line tool I hadn’t heard about: PostReflect.exe along with the VSP1CLN.exe file.

PostReflect Command-Line Options - TechNet

The boot critical driver projection tool, PostReflect.exe, is used to reflect all boot critical device drivers out of the driver store in an offline image.

Driver reflection is the process of installing a driver on a computer that might or might not have a device for that driver. Typically, this involves copying the driver files to the destination location so that the driver can be loaded by the operating system during the boot process. If all of the boot critical drivers are reflected in the image, it can be deployed to various hardware configurations.

After Windows Vista Service Pack 1 (SP1) is applied online, this tool must be run on the offline Windows image because SP1 contains boot critical drivers for the hardware abstraction layer (HAL) and matching changes to the kernel. If the changed versions of boot-critical drivers for the HAL and the kernel are not correctly installed on the computer that you are deploying to, the operating system will not boot, nor will the image boot on any computer that has a different CPU or hardware configuration.

Also related a kindred soul’s post:

VSP1CLN Command-Line Options – TechNet

The Windows Vista Service Pack 1 (SP1) Files Removal Tool (VSP1CLN.exe) can be used to remove the files that are archived after Windows Vista SP1 is applied. Running this tool is optional.

Installing Windows Vista SP1 increases the amount of disk space that is used by the operating system. This space is used to archive files so that SP1 can be uninstalled. Typically, you should run VSP1CLN.exe if you want to reclaim this disk space after applying SP1 and if you will not need to uninstall SP1.

This tool works in conjunction with SP1 only and can be used online or offline.

Don’t know if these will be helpful to anyone else, but I’m making note of them here for my own personal study and application down the road.

That is all.

Software Goodies

Been quite a while since I have posted a roundup of new/improved software finds.

Here you go from the previous weeks’ culling.

  • CompuSec - (freeware) – German proprietary whole disk encryption solution I just discovered this week.  The free version has no limitations and is open to both professional (business/commercial) as well as personal users.  On-line support is available and supports all Windows versions as well as Linux.  Lots of handbooks available and is provided in both German and English flavors. Discussed and reviewed in depth by Leo Laporte and Steve Gibson in a CRC Security Now! podcast session. 

  • TrueCrypt - (freeware) - Free Open-Source On-The-Fly Disk Encryption Software for Windows Vista/XP, Mac OS X and Linux.  Simply the best (IMHO) solution for home users and consumers looking for a fast, efficient, and rock-solid solution to encrypting their laptop/desktop system’s hard-drives to prevent unauthorized data-loss in event of theft of general maliciousness.  Now at version 6.1a.  Anyone who doesn’t use some form of whole-disk encryption with a laptop is probably just asking for eventual trouble, especially if used in a business/enterprise setting.  Desktops are just as vulnerable so don’t forget them as well.

  • PGP Corporation - ($-$$$) Enterprise grade whole-disk encryption software.  Not the only vendor of such out there but one of the leaders in the market.

  • Foxit Reader 3.0 - (freeware) – This major version update brings a larger file size to the previously light alternative PDF reader.  While still “small” in comparison to Adobe Reader, it has gotten a bit more chunky than previous upgrades. It’s still one of the best Free PDF Readers (and then some) in an otherwise large crowd.   I don’t feel like repeating a big list of What's New in 3.0 so hop that link, then grab the updated version.  I don’t think you will be disappointed.

  • CurrPorts - (freeware) – Nirsoft app for viewing/monitoring open TCP/IP ports and connections on Windows now provides information on the total number of remote connections in the program’s status bar as well as port information in the tray-icon tooltip.

  • ShellExView - (freeware) – Nirsoft app for working with shell extensions for Windows now gets a critical feature; support for use with external drives via a command-line option.

  • NK2View - (freeware) – Nirsoft app for working with Outlook’s NK2 file got an update to delete selected items and add items from address bar to the menu system as well as more “accelerator” keys.  Definitely a must have for any sysadmin who supports Outlook users.

  • LSASecretsView- (freeware) – Nirsoft app for viewing LSA (local security authority service) secrets stored on your computer. This version now supports pulling LSA data from a off-line version of Windows 2000/XP/2003. Related: Nir’s LSASecretsDump utility.

  • Secunia Personal Software Inspector (PSI) 1.0 – Now out and polished up.  Previously reviewed RC1 version was great and highly recommended by me. Secunia Personal Software Inspector RC-1: Wowzers!  This new “final” build has experienced some major tweaks and got  some important changes since I last wrote about it in the RC-march up to the final version. 

    • Fix for Windows Vista UAC bug - The Secunia PSI will now start up correctly after a system reboot in Windows Vista
    • Added green icon download icon - The green download icon will indicate that a patch link has been clicked, making it obvious which patches have been requested when applying multiple patches at a time
    • New user interface concept - The user interface has been split into two, a "Simple" and an "Advanced" mode
    • Improved Easy-to-Patch functionality - The Easy-to-Patch has been improved significantly
    • Criticality indication for all programs - The Secunia Advisory criticality rating is now listed for each insecure program found
    • Generally more focus on the security threats each program expose your PC to Secunia Profile recovery - It is possible to recover your Secunia Profile and register the same Secunia Profile on multiple PCs

  • Zoundry Raven for Windows - (freeware) – Looks like this eager bird is about ready to take to wing.  All the standard items and platform support with a nice interface.  Worth checking out.  Also nice is the Portable Application install option. Reviewed by Paul Thurrott in Potential Windows Live Writer competitor at his SuperSite Blog as well as at CyberNet News

  • JavaFX 1.0 Released – As if we didn’t have enough “rich content” applications between Java, Flash, Shockwave, AIR, Silverlight, etc., etc. etc.  Now we are getting JavaFX.  Follow the links to be dully amazed/bored/disinterested depending on your take.

  • PCLinuxOS 2009 is coming soon for release.  I really love this particular Distro and while 2007 has been strong, 2009 should be even more refined.  Hop over to the site to get all the news.

  • KLS Mail Backup - (freeware) – Provides simple backups of Windows mail, Outlook Express, Windows Live applications, Address book,  IE favorites and accounts, as well as various Mozilla programs including Thunderbird and Firefox. Spotted in a KLS Mail Backup makes email, browser backups a snap - Download Squad post.

There you go.

--Claus V.

Windows 7 News Roundup #4

Yep. The road to W7 is littered with news.

Release date for W7 Beta 1 looks to be sometime around January according to various sources and Ed Bott is picking January 13th for his W7 roulette stake.

However, if you attend an upcoming MSDN Developer Conference and pony up $99 registration fee, you will (eventually) get (by mail) a copy of the Windows 7 Beta DVD when available.  Just how hard-core an early adopter are you?  Windows 7 Beta for MDC Attendees – Bob’s blog.

          Date            City

I’m afraid I’m booked up already for the Houston date, so will have to continue waiting for a TechNet preview release of W7 (if ever offered there) down the road.  I’m not feeling up to Torrenting a version right now.

These are some great technical posts how how W7 error recovery “works” at least in early releases.  Reading through them it seems to me that they are successful but are curiously clunky in the recovery process.  I can’t image them staying in this format for the final release.  Vista’s is much more refined.  Although no Windows recovery process has ever seemed easy to understand for non-technical users, Vista and XP to a lesser degree are serviceable. This W7 stuff seems sure to frighten!

I just loved this technical look by Rafael inside W7’s boot-progress architecture.  It is surprisingly complicated, yet simple as well.  Here is the golden-part that sent chills down my WIM hacking spine:

In Windows 7, the boot screen is simplified in many ways. It comprises of a single bitmap, loaded from a small Windows Imaging (WIM) file at runtime, and some text rendered on-the-fly. The approach of stuffing a small bitmap inside a WIM may seem a little overkill right now but this was likely done to future-proof boot reporting. I won’t be surprised if we see other boot-related resources (e.g. sounds) housed within the WIM in the near future…

Some great initial info on how W7 may support the mobile broadband platform.  This will allow simplified connection to the Net through a cellular modem so you don’t have to get tied up with the connection manager.

A great Google article, the difference between ‘easy’ and ‘simple’; and why this is a problem for Windows 7 - SuperSite Blog

Paul Thurrott opines on how Microsoft is still overreaching on OS design models and why W7 might still fail to please everyone.

But what about Windows 7? As I and others have written, Windows 7 is all about a complete reexamination of the Windows OS. Microsoft has probed into every visible and invisible corner of the system and tweaked virtually everything. The result is, condescendingly, “Vista done right” or, in my mind, simply a very finely tuned tool. As a friend noted via IM the other day, [I’m paraphrasing here], it’s pretty clear that what we’ve seen so far in Windows 7 is it. There’s nothing more coming. And I don’t know whether to be excited by that or freaked.

The problem with Windows 7 is that Microsoft is copying the Mac, again. No, they’ll never really make Windows as simple as Mac OS X, though by God they’re going to try. And the reason they won’t is because you can’t simply erase decades of piling on functionality on top of functionality. Windows will always be a Swiss Army knife. You can’t escape your heritage.

Gotta say, as a long-time Windows user and support person, I think Paul has some very good points and Microsoft is in a lot of danger of digging into a deeper hole that they started in Vista.

Will W7 be good, better, and more refined than previous versions? Sure.

Will that be enough to technically distance itself from Vista in the fickle minds of consumers and enterprise operations? Jury’s still out, but I’m doubtful it will, with Vista still so fresh out of the can.

I’m thinking only the hard-core Windows enthusiasts and fan-boys/girls will be salivating for W7 for the foreseeable future (pre/post final release).

Meanwhile folks in Cupertino orchard are leaning back in their chairs and smiling….

--Claus V.