oscdimg

[Dietmar]

Hi Slobodan,
what do You think about

oscdimg.exe -h -n -bc:\boot.bin c:\winxp\ c:\winxp.iso

hihi, seems to work

Dietmar

[Slobodan Brcin (eMVP)]

Post by Dietmar
what do You think about
oscdimg.exe -h -n -bc:\boot.bin c:\winxp\ c:\winxp.iso
hihi, seems to work

I'm not sure what do you expect me to say?
Of course that it works it is meant to work.

Regards,
Slobodan

[Dietmar]

Hi all,
for large bootable images with NOEMULATION in ELTORITO specification You
must use the switch -m too.

oscdimg.exe -h -m -n -bc:\boot.bin c:\winxp\ c:\winxp.iso

Dietmar

PS: Burning DVD with XPPRO image, will see.

[Dietmar]

Hi Slobodan,
I receive the message NTLDR (booting from DVD with NOEMULATION build with
oscdimg) not found.
Does this mean, that the ARCpath isnt found?
I set in boot.ini on BOOTDVD with NOEMULATION

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
Professional" /fastdetect
This seems to be wrong or, because
for example:
Booting WinPE from CD than Winobj shows me no arcpath, but it starts on
commandline with H:\ and in registry there is SystemBootDevice Reg_SZ
multi(0)disk(0)cdrom(159) which belongs to \device\CdRom0 where the
WinPE BOOTCD is in.

My Question is now: The ntldr may be also the wrong one, because he
isnt(?) able to read on CDFS. You told me, that You have one which can do
this.
Would be in that case also the message "NTLDR not found" arrive? Another
problem is the arcpath.
Do You know why there stands cdrom(159) ???
Any idea what I must do to overcome this problems? Does the ntldr which
can read from CDFS
needs a boot.ini?
I think, that XPE and(?)can than boot from Cd (DVD) with NOEMULATION and
EWF enabled.

Dietmar

PS: Can I use the ntldr from WinPe,which needs no boot.ini when I set
,folder
i386 instead of Windows, but than I have also to change ntoskernel.exe and
so on or?

[Slobodan Brcin (eMVP)]

Dietmar,

I though that by now you know what is loaded and how, including who load the
loader.
bios load bootsector (2048 bytes) from CD
bootsector load ntldr. (it should be differently named on CD boot).
ntldr load boot.ini
ntldr load ntdetect.com
ntldr load registry hives.
ntldr load al drivers and files specified in registry that need to be loaded
by ntldr.
ntldr start kernel.
kernel initializes drivers
drivers load enum and load other drivers.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I receive the message NTLDR (booting from DVD with NOEMULATION build with
oscdimg) not found.
Does this mean, that the ARCpath isnt found?
I set in boot.ini on BOOTDVD with NOEMULATION
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP
Professional" /fastdetect
This seems to be wrong or, because
Booting WinPE from CD than Winobj shows me no arcpath, but it starts on
commandline with H:\ and in registry there is SystemBootDevice Reg_SZ
multi(0)disk(0)cdrom(159) which belongs to \device\CdRom0 where the
WinPE BOOTCD is in.
My Question is now: The ntldr may be also the wrong one, because he
isnt(?) able to read on CDFS. You told me, that You have one which can do
this.
Would be in that case also the message "NTLDR not found" arrive? Another
problem is the arcpath.
Do You know why there stands cdrom(159) ???
Any idea what I must do to overcome this problems? Does the ntldr which
can read from CDFS
needs a boot.ini?
I think, that XPE and(?)can than boot from Cd (DVD) with NOEMULATION and
EWF enabled.
Dietmar
PS: Can I use the ntldr from WinPe,which needs no boot.ini when I set
,folder
i386 instead of Windows, but than I have also to change ntoskernel.exe and
so on or?

[Dietmar]

Hi Slobodan,
thanks for this answer.
But why is NTLDR not loaded? WHERE looks the Bios for NTLDR when loaded
those 2048 bytes?
You said, that you have 2048 byte which work together with an special
NTLDR which can read from CD filesystem. Without that I dont know where is
my error, and what to do next.
I have VMware, with witch I can test on an virtuell CD device, whitch
bootsector with whitch ntldr works for CD BOOT with no emulation. But I
havnt enough time for that. Is there a reason, that you dont say to me
where I can get those 2048 bytes and the ntdlr belonging to that
bootsector whitch can read on CDFS?
I am thinking that all will work, if I can get them.

Dietmar

[Dietmar]

Hi all,
I found my error.
NTLDR is searched as \i386\setupldr.bin where it isnt is. So a little
mistake, but now I am nearly ready. Seems, I must help myself.

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

Can you dump us here content of following command: ">oscdimg.exe /?"
I really have no idea what you are talking about :-(

What is -m switch I do not have it?
What is boot.bin file that you provide?

Post by Dietmar
But why is NTLDR not loaded? WHERE looks the Bios for NTLDR when loaded
those 2048 bytes?
You said, that you have 2048 byte which work together with an special
NTLDR which can read from CD filesystem. Without that I dont know where is
my error, and what to do next.

"Special ntldr." is already on your WinPE CD and is called "setupldr.bin"

Post by Dietmar
I have VMware, with witch I can test on an virtuell CD device, whitch
bootsector with whitch ntldr works for CD BOOT with no emulation. But I
havnt enough time for that.
Is there a reason, that you dont say to me
where I can get those 2048 bytes and the ntdlr belonging to that
bootsector whitch can read on CDFS?

Reason is very simple you started this thread by saying us that you know how
to use oscdimg and that it work.
Second thing is that this program has nothing to do with focus of this
particular News Group.
WinPE is supported probably in some other setup related NG.
Beside that you have an some terible help that came with OPK. But it is
enough to do make bootable CD.

Regards,
Slobodan

[Dietmar]

Hi Slobodan,
the -m key overcomes the limitation, that oscdimg can only write
discimages < 700MB.
It is an undocumented funktion and is also not shown in my help.
I just wrote a *.iso file with nearly 2 GB. All oscdimg.exe, that I have
(about 10 ) are identic whitch I tested with hexeditor.
As boot.bin I extracted the bootsector from the WinPE CD. This works, but
there is a problem to me to rename all the files and folders. Does the
ntldr from WinPe work with ntoskernel? Or is it with this ntldr only able
to boot with /minint key in boot.ini? Looks this ntldr in boot.ini or
overrides it? When this ntldr not works with ntoskernel but only with
NTKRNLMP.EXE(or is it only another name like setupldr.bin)do You know
another whitch can also read CDFS?
There are a lot of questions but now I am shure:
I will suceed booting with NOEMULATION to something...hihi. But I have so
little time left.

Dietmar

PS: oscdimg makes something with BOOTCD I dont understand that all the
other Burning programs can not do. This statement is from Microsoft. So I
think it is the right program to do this.

[Slobodan Brcin (eMVP)]

NTKRNLMP.EXE (or is it only another name like setupldr.bin) it is original
name for one of few different kernels available.

You have ACPI and non ACPI kernels.
Multiprocessor and single processor kernels.
XPe just rename these files from original name to ntoskrnl during the
build.


You can find this file in XPe repositories.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
the -m key overcomes the limitation, that oscdimg can only write
discimages < 700MB.
It is an undocumented funktion and is also not shown in my help.
I just wrote a *.iso file with nearly 2 GB. All oscdimg.exe, that I have
(about 10 ) are identic whitch I tested with hexeditor.
As boot.bin I extracted the bootsector from the WinPE CD. This works, but
there is a problem to me to rename all the files and folders. Does the
ntldr from WinPe work with ntoskernel? Or is it with this ntldr only able
to boot with /minint key in boot.ini? Looks this ntldr in boot.ini or
overrides it? When this ntldr not works with ntoskernel but only with
NTKRNLMP.EXE(or is it only another name like setupldr.bin)do You know
another whitch can also read CDFS?
I will suceed booting with NOEMULATION to something...hihi. But I have so
little time left.
Dietmar
PS: oscdimg makes something with BOOTCD I dont understand that all the
other Burning programs can not do. This statement is from Microsoft. So I
think it is the right program to do this.

[Dietmar]

Hi Slobodan,
I installed VMwareBeta5R3, and now I can work nearly professional.

I have 2 questions:
Do You know an external Registry Viewer, with which You can make CHANGES
in that Registry from outside?

And the second: There is no external Registry with name "System" in WinPe.
If You run WinPe and type regedit there appears a registry nearly the same
as in XP(E). But where is it stored?

Thanks
Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

1. You can use regedit.exe Load Hive/Unload hive options for accessing
offline registry.
2. It is probably called setupreg.hiv

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I installed VMwareBeta5R3, and now I can work nearly professional.
Do You know an external Registry Viewer, with which You can make CHANGES
in that Registry from outside?
And the second: There is no external Registry with name "System" in WinPe.
If You run WinPe and type regedit there appears a registry nearly the same
as in XP(E). But where is it stored?
Thanks
Dietmar

[Dietmar]

Hi Slobodan,

Post by Slobodan Brcin (eMVP)
It is probably called setupreg.hiv

thats right, thank You very much,

Dietmar

[Dietmar]

Hi Slobodan,
on WinPe bootable virtuell CD.iso I changed carefully ALL setupldr.bin to
ntldr looking that after all remain at the right place on CD, ALL i386
with backslash(es) to minint with backslash(es), all with hexeditor and I
controlled the results that all take right place. I installed a boot.ini
in root with

[boot loader]
timeout=30
default=multi(0)disk(0)cdrom(159)
[operating systems]
multi(0)disk(0)disk(0)cdrom(159)="Microsoft Windows XP Professional"
/fastdetect /minint
(this root cdrom(159) is from realbootcd with winobj)

and copied ntldr and ntdetect.com to the root.
When I boot this *.iso virtuell CD in VMware I get the message "Cannot
boot from CD-code:5" .
The ntldr is correct detected.
Any idea what this could mean?

Thanks
Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

You have entered the waters uncharted by me.

I have no clue why do you get this error. Also can you tell us again what do
you try to accomplish and why?

One more question have you determined for sure that your boot.ini is loaded?

Put two entries in boot.ini and see if you get multi OS choice menu for two
seconds.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
on WinPe bootable virtuell CD.iso I changed carefully ALL setupldr.bin to
ntldr looking that after all remain at the right place on CD, ALL i386
with backslash(es) to minint with backslash(es), all with hexeditor and I
controlled the results that all take right place. I installed a boot.ini
in root with
[boot loader]
timeout=30
default=multi(0)disk(0)cdrom(159)
[operating systems]
multi(0)disk(0)disk(0)cdrom(159)="Microsoft Windows XP Professional"
/fastdetect /minint
(this root cdrom(159) is from realbootcd with winobj)
and copied ntldr and ntdetect.com to the root.
When I boot this *.iso virtuell CD in VMware I get the message "Cannot
boot from CD-code:5" .
The ntldr is correct detected.
Any idea what this could mean?
Thanks
Dietmar

[Dietmar]

Hi Slobodan,
I tested some boot.ini with two entries and I know that the boot.ini is
NOT loaded. The same error arrives without any boot.ini .
The message "cannot boot from CD code: 5" is NOT
on the WinPE CD! (But from where, Bios?) I think that was Microsoft
knowledge base said, Code 5 is an error arriving when there is an attempt
to load a driver which windows does not know to handle. It is so simple
what I try: Starting from an booting WinPE *.iso in VMware I changed
folder and filenames with hexeditor as long as it still boots. I changed
the kernel to the german version of my XPPRO and all WORKS. But if I
rename setupldr.bin to ntldr and copied it to the rootfolder this error
arrives at boot from CD.
I think, setupldr.bin does not (even not knows any about)need a boot.ini .
If You rename it and copy it to the folder there is a chance for a boot.ini
or? My dream is still a XP(E) which boots with NOEMULATION from CD (DVD). I
think this may reduce also the boottime. I believe that this can be
successfull, because WinPE boots from CD with the normal Kernel from
XPPRO!

I am also quiet shure, that EWF works on BOOTCD if the folders and files
are renamed as in XP(E)on harddisk before they went back to CD.

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

1. You want to make XPe that will boot same as WinPE, right?
2. Also you want to install EWF that will work on that (WinPE like) image,
right?

IMHO it is pure waste of time attempting to do this based on what I know how
things work. (I reserve rights to be wrong of course, and you can prove that
I'm wrong very easily)

Bullet 1 can be done, but what would be the purpose of that?
Bullet 2 can be easily tested on WinPE image. Please indulge me and prove
that this can be done, if you can do that then everything can be done.


So for bullet 2.
Use regedit and preinstall Reg RAM configured EWF on WinPE image that boot
from CD.

Let me know what ewfmgr.exe used on CD vol letter tell you. (Please copy all
text from console)
I'm interested in two things:
- Whether you were able to enable EWF at all.
- Overlay memory usage.


Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I tested some boot.ini with two entries and I know that the boot.ini is
NOT loaded. The same error arrives without any boot.ini .
The message "cannot boot from CD code: 5" is NOT
on the WinPE CD! (But from where, Bios?) I think that was Microsoft
knowledge base said, Code 5 is an error arriving when there is an attempt
to load a driver which windows does not know to handle. It is so simple
what I try: Starting from an booting WinPE *.iso in VMware I changed
folder and filenames with hexeditor as long as it still boots. I changed
the kernel to the german version of my XPPRO and all WORKS. But if I
rename setupldr.bin to ntldr and copied it to the rootfolder this error
arrives at boot from CD.
I think, setupldr.bin does not (even not knows any about)need a boot.ini .
If You rename it and copy it to the folder there is a chance for a boot.ini
or? My dream is still a XP(E) which boots with NOEMULATION from CD (DVD). I
think this may reduce also the boottime. I believe that this can be
successfull, because WinPE boots from CD with the normal Kernel from
XPPRO!
I am also quiet shure, that EWF works on BOOTCD if the folders and files
are renamed as in XP(E)on harddisk before they went back to CD.
Dietmar

[Dietmar]

Hiho Slobodan,

I found the RIGHT Arcpath

[boot loader]
timeout=30
default=multi(0)disk(0)cdrom(159)\I386
[operating systems]
multi(0)disk(0)cdrom(159)\I386="Microsoft CDBOOT"
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft 2" /fastdetect


The second entry is only for to see, whether boot.ini is recogniced. It
is. Than, and that was my best idea, I renamed in folder I386 setupldr.bin
against setupldr.bak and put THERE EWFNTLDR and renamed THAT to
setupldr.bin.
Than boot.ini was left right and there stand message ntoskrnl.exe not
found, so I renamed the kernel as wished.
Now I am changing the other files in folder system32, but still the CD
boots, and I can put(hope) EWF there.

Dietmar

[Dietmar]

Hi Slobodan,
I copied the hole folder system32 from another XPPro partion in the ISO
image of WinPe. Now I saw the white line starting, now it wants
biosinfo.inf in the folder i386\inf and I think it WILL work...hihi.

Dietmar

[Slobodan Brcin (eMVP)]

Hi Dietmar,

Do you keep records of all the steps that you did so far in case that some
new form of AI is born from all of this :-)

Seriously IIRC your main goal was to make easier procedure for XPe boot from
CD that will always work, right?
By each passing hour I see you drifting away from that goal :-(

Regards,
Slobodan

I'm just wondering what Konstantin think about all this endeavor, he has
been very quiet about giving opinions on this topic.

Post by Dietmar
Hi Slobodan,
I copied the hole folder system32 from another XPPro partion in the ISO
image of WinPe. Now I saw the white line starting, now it wants
biosinfo.inf in the folder i386\inf and I think it WILL work...hihi.
Dietmar

[Dietmar]

Hi Slobodan,
I think that Konstantin thinks it may work.
And that is perhaps a problem for Microsoft.
But I dont want to sell anything, its just for FUN. Now I understand, why
all this terrible renaming is made. Only to forbid CD Boot with XPPRO, I
am quiet shure.
Dietmar

[KM]

Slobodan,

I'm just wondering what Konstantin think about all this endeavor, he has been very quiet about giving opinions on this topic.

You are right. I've decided not to interfere in this thread. The main reason is that I do not understand the goal of Dietmar's
attempts.
Just reading through the thread I can see a mixed variety of OSes - XPe, PE, XP Pro, VxWorks. I got lost what was the aim, though.

Anyway, Dietmar seems to be a hard-working man and I am sure he will get to what he's trying to get.
I may only ask him to follow more engineer-like style of writting. Specifically, always show the steps he did or he is planning to
do. Then, I am sure, other readers in this NG will benefit very much from this thread.

Regards,
Konstantin

PS. Dietmar, do you really like using the web post client from www.talkaboutsoftware.com? Did you try OE? It may appear to be more
convinent for your use since you are doing a lot of posting now.

Post by Dietmar
Hi Slobodan,
I copied the hole folder system32 from another XPPro partion in the ISO
image of WinPe. Now I saw the white line starting, now it wants
biosinfo.inf in the folder i386\inf and I think it WILL work...hihi.
Dietmar

[Slobodan Brcin (eMVP)]

Hi Dietmar,

You managed to do all this, WOW (I lost track of your transactions) ;-)
Could you please tell us: what do you think that is the function of ewfntldr
in your opinion and your own words?

Regards,
Slobodan

Post by Dietmar
Hiho Slobodan,
I found the RIGHT Arcpath
[boot loader]
timeout=30
default=multi(0)disk(0)cdrom(159)\I386
[operating systems]
multi(0)disk(0)cdrom(159)\I386="Microsoft CDBOOT"
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft 2" /fastdetect
The second entry is only for to see, whether boot.ini is recogniced. It
is. Than, and that was my best idea, I renamed in folder I386 setupldr.bin
against setupldr.bak and put THERE EWFNTLDR and renamed THAT to
setupldr.bin.
Than boot.ini was left right and there stand message ntoskrnl.exe not
found, so I renamed the kernel as wished.
Now I am changing the other files in folder system32, but still the CD
boots, and I can put(hope) EWF there.
Dietmar

[Dietmar]

Hi Slobodan,
I cant say anything about EWFNTLDR only that one, that EWF is not working
when You use normal NTLDR.
I saw the Windows Professional Screen (booted from WinPe virtuell CD, and
than came blue screen with System_License_Violation (Microsoft seems not
do want that somebody is doing this...hihi)
and Stop 0x0000009A,0xC0000034,0x00000000,0x00000000

Any idea?

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

I asked if you know what EWFNTLDR does because it has no relevance what so
ever to Reg Configured RAM EWF.
You must use Reg Conf RAM EWF so ewfntldr has nothing to offer regarding the
EWF driver and functionality.

Your BSOD problems is not EWF related.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I cant say anything about EWFNTLDR only that one, that EWF is not working
when You use normal NTLDR.
I saw the Windows Professional Screen (booted from WinPe virtuell CD, and
than came blue screen with System_License_Violation (Microsoft seems not
do want that somebody is doing this...hihi)
and Stop 0x0000009A,0xC0000034,0x00000000,0x00000000
Any idea?
Dietmar

[Dietmar]

Hi Slobodan,
I copied ewfmgr.exe to system32 folder and ewf.sys to system32\drivers
(both from XPE SP2)from outside to WinPE partion.
Then I make a try with WinPE on first harddiskpartion to overcome
arcproblems. I imported with regedit the ewf.reg from SFiorito in running
WinPE on harddisk.
This ewf.reg is

Windows Registry Editor Version 5.00



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]

"Enable"="N"



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]

"EnableAutoLayout"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]

"NtfsDisableLastAccessUpdate"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management\PrefetchParameters]

"EnablePrefetcher"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

BootExecute=""



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF]

"NextInstance"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000]

"Service"="EWF"

"Legacy"=dword:00000001

"ConfigFlags"=dword:00000020

"Class"="LegacyDriver"

"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"

"DeviceDesc"="EWF"

"Capabilities"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control]

"ActiveService"="EWF"



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]

"ErrorControl"=dword:00000001

"Group"="System Bus Extender"

"Start"=dword:00000000

"Type"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

"UpperFilters"="Ewf"



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]

"Type"=dword:00000001

"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"


Then I noticed, that nothing in THAT registry is stored after reboot. Do
YOU know a trick, with whitch writes to registry are permanent stored in
WinPE? I exportet from running WinPE SAM, SECURITY, SOFTWARE, SYSTEM
under HKLM as hive to another harddrive. Then from XPPRO I put them back
to there original folder config, and rename
SYSTEM to SETUPREG.HIV and copied it to the system32 folder of WinPE. I
think, that this is all ok. When I start WinPE, it comes to full boot
but then appears a message: The system is not fully installed. Please run
setup again.

How should I do this in WinPE??? I think, with the ewf.reg from SFiorito
is something called in WinPE that isnt there. Do You have an idea what
this can be? There is a file called DEFAULT in config folder of WinPE
which may also be related to registry in WinPE but I dont know how.

Thanks,
Dietmar

PS:I am shure that it will work. The message is on real CD
cdrom(159)exactly the same, meaning all works correct but something is
missed or called in EWF.reg which is not there.

[Dietmar]

Hi all,
I solved this with:"

To work around this issue, you can use the Parallel Install Recovery
option to install a parallel installation of Windows XP or Windows 2000 in
a different partition and then use Registry Editor to change the data value
of the SystemSetupInProgress value from 1 to 0. 1. Start Registry Editor
(Regedt32.exe).
2. On the Windows menu, click the HKEY_LOCAL_MACHINE node.
3. On the Registry menu, click Load Hive.
4. Click the %SystemRoot%\System32\Config\System file, and then click
Open.
5. Type a name for the key, and then click OK.
6. Double-click the key name from the previous step.
7. Double-click the Setup key.
8. Double-click the SystemSetupInProgress value in the right pane.
9. Change the data value from 1 to 0, and then click OK.
10. Click the key name, and then click Unload Hive on the Registry menu.
11. Close Registry Editor, and then restart the computer. "

WAOW it boots with EFW enabled under WinPE from real CD!!!

But now WinPe wants a password, username Administrator, password???
But there is no error any more,

Dietmar

[Dietmar]

It worked,
the message which now appears is: There is no paging file..." hihi, I
think because EWF is enabled on that CD but also it is still in minint
mode thats makes all a little complicate.

But I say, EWF works on that WinPE CD.

Dietmar

[Slobodan Brcin (eMVP)]

WOW Diemtar,

I just gave you a 100% reason why it can work in this thread, heck I guess
that you prove me wrong and I would like to understand why it work.

1. What ARC path did you used?
2. Have you removed HDDs from your computer?
3. Is C: only volume that you see?
4. Please give us complete dump of screen ewfmgr C:

Thanks,
Slobodan

Post by Dietmar
It worked,
the message which now appears is: There is no paging file..." hihi, I
think because EWF is enabled on that CD but also it is still in minint
mode thats makes all a little complicate.
But I say, EWF works on that WinPE CD.
Dietmar

[Slobodan Brcin (eMVP)]

Hi Dietmar,

1. Use regedit to edit offline registry and change registry values that
belong to WinPE, this is the only way.
2. ARC path is the least of the problems. You don't have to use it is SP2
since you should be able to use driver ID. You problem (was, is and will be)
cdrom.sys which is used instead of disk.sys and driver stack above them.

I'm impressed with your stubbornness to mess with things that you know
little or nothing about and not even want to pursue the enough knowledge to
understand how things work

To solve or give up on this problem you must:
1. Install remote Windows Debugger and learn how to use it, so that you can
see loaded drivers and learn about them.
2. Install DDK and analyze documentation and sources about cdrom.sys and
disk.sys drivers and what drivers lie above them and how.
3. From DDK doc learn about filter drivers, especially UpperFilter class
drivers. This will allow you to know what ewf.sys do how it does it and why
it does that.
4. Learn all that you can find on net about CDFS.sys driver.
5. Based on above choose where to install ewf.sys driver (above which driver
if possible that is)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]for UpperFilter driver is probably the wrong key for CD device.To save you some time based on my humble experience with drivers and XP.1. WinPE boot by using cdfs.sys driver and you want that functionality.2. cdfs.sys driver is simple File System driver that give you access tofiles stored on CD.3. cdfs.sys driver being the simple driver do not have write operationsimplemented.4. EWF.sys can't be installed above FS driver.5. Installing EWF anywhere else that above FS driver would not make anysense since no write requests would reach it. (Like I said cdfs.sys havefile read only support.)Please Dietmar tell me which of my assumptions in bullets are wrong? Sinceif they are all true there is no way for you to use EWF as you want to useit.You see this is type of discussion that you should have chosen from day one.You have many people here including Konstantin and me that can help you withunderstanding this. If you have some info or idea that we did not though ofwe would like to know it and help you with it.But blindly playing with registry and drivers approach can't work in thiscase. There is no MS conspiracy involved in why XPP do not boot from CD orother similar things, this is just how drivers that XPP/XPe/WinPE use aredesigned. Nothing more nothing less.So beliefs that something will or not work on XP that you so often mentionare wrong way to do. Hunches based on how things are implemented andstretching the implementation to limits are the right way to go, althoughthey also can be dead-ends because of many reasons that are beyond ourcontrol and that we could not foreseen up-front.So again what is your expectation in regards to driver load order and theirmutual interaction? This is very important and answering this will tell youwhy it will or won't work.Regards,Slobodan"Dietmar" <***@t-online.de> wrote in messagenews:***@localhost.talkaboutsoftware.com...> Hi Slobodan,> I copied ewfmgr.exe to system32 folder and ewf.sys to system32\drivers> (both from XPE SP2)from outside to WinPE partion.> Then I make a try with WinPE on first harddiskpartion to overcome> arcproblems. I imported with regedit the ewf.reg from SFiorito in running> WinPE on harddisk.> This ewf.reg is>> Windows Registry Editor Version 5.00>>>> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]>> "Enable"="N">>>>[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]>> "EnableAutoLayout"=dword:00000000>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]>> "NtfsDisableLastAccessUpdate"=dword:00000001>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session> Manager\Memory Management\PrefetchParameters]>> "EnablePrefetcher"=dword:00000000>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]>> BootExecute="">>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF]>> "NextInstance"=dword:00000001>>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000]>> "Service"="EWF">> "Legacy"=dword:00000001>> "ConfigFlags"=dword:00000020>> "Class"="LegacyDriver">> "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}">> "DeviceDesc"="EWF">> "Capabilities"=dword:00000000>>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control]>> "ActiveService"="EWF">>>> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]>> "ErrorControl"=dword:00000001>> "Group"="System Bus Extender">> "Start"=dword:00000000>> "Type"=dword:00000001>>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]>> "UpperFilters"="Ewf">>>>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]>> "Type"=dword:00000001>> "ArcName"="multi(0)disk(0)rdisk(0)partition(1)">>> Then I noticed, that nothing in THAT registry is stored after reboot. Do> YOU know a trick, with whitch writes to registry are permanent stored in> WinPE? I exportet from running WinPE SAM, SECURITY, SOFTWARE, SYSTEM> under HKLM as hive to another harddrive. Then from XPPRO I put them back> to there original folder config, and rename> SYSTEM to SETUPREG.HIV and copied it to the system32 folder of WinPE. I> think, that this is all ok. When I start WinPE, it comes to full boot> but then appears a message: The system is not fully installed. Please run> setup again.>> How should I do this in WinPE??? I think, with the ewf.reg from SFiorito> is something called in WinPE that isnt there. Do You have an idea what> this can be? There is a file called DEFAULT in config folder of WinPE> which may also be related to registry in WinPE but I dont know how.>> Thanks,> Dietmar>> PS:I am shure that it will work. The message is on real CD> cdrom(159)exactly the same, meaning all works correct but something is> missed or called in EWF.reg which is not there.>>>>>

[Slobodan Brcin (eMVP)]

Dietmer,

Heck what hapened here, my outlook went crazy :-(
I reformatted text again hope this time it will be ok.

Hi Dietmar,

1. Use regedit to edit offline registry and change registry values that
belong to WinPE, this is the only way.
2. ARC path is the least of the problems. You don't have to use it is SP2
since you should be able to use driver ID. You problem (was, is and will be)
cdrom.sys which is used instead of disk.sys and driver stack above them.

I'm impressed with your stubbornness to mess with things that you know
little or nothing about and not even want to pursue the enough knowledge to
understand how things work

To solve or give up on this problem you must:
1. Install remote Windows Debugger and learn how to use it, so that you can
see loaded drivers and learn about them.
2. Install DDK and analyze documentation and sources about cdrom.sys and
disk.sys drivers and what drivers lie above them and how.
3. From DDK doc learn about filter drivers, especially UpperFilter class
drivers. This will allow you to know what ewf.sys do how it does it and why
it does that.
4. Learn all that you can find on net about CDFS.sys driver.
5. Based on above choose where to install ewf.sys driver (above which driver
if possible that is)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]for UpperFilter driver is probably the wrong key for CD device.To save you some time based on my humble experience with drivers and XP.1. WinPE boot by using cdfs.sys driver and you want that functionality.2. cdfs.sys driver is simple File System driver that give you access tofiles stored on CD.3. cdfs.sys driver being the simple driver do not have writeoperationsimplemented.4. EWF.sys can't be installed above FS driver.5. Installing EWF anywhere else that above FS driver would not make anysensesince no write requests would reach it. (Like I said cdfs.sys havefile readonly support.)Please Dietmar tell me which of my assumptions in bullets are wrong?Since if they are all true there is no way for you to use EWF as you want touseit.You see this is type of discussion that you should have chosen from day one.You have many people here including Konstantin and me that can help you withunderstanding this.If you have some info or idea that we did not though of we would like toknow it and help you with it.But blindly playing with registry and drivers approach can't work inthiscase.There is no MS conspiracy involved in why XPP do not boot from CD orothersimilar things, this is just how drivers that XPP/XPe/WinPE use aredesigned.Nothing more nothing less.So beliefs that something will or not work on XP that you so often mentionare wrong way to do.Hunches based on how things are implemented andstretching the implementationto limits are the right way to go, although they also can be dead-endsbecause of many reasons that are beyond ourcontrol and that we could notforeseen up-front.So again what is your expectation in regards to driver load order andtheirmutual interaction?This is very important and answering this will tell youwhy it will or won'twork.Regards,Slobodan

[Slobodan Brcin (eMVP)]

I give up.

Can someone tell me the secret char sequence that prevented.line break on
bottom text?

Regards,
Slobodan

Post by Slobodan Brcin (eMVP)
Dietmer,
Heck what hapened here, my outlook went crazy :-(
I reformatted text again hope this time it will be ok.
Hi Dietmar,
1. Use regedit to edit offline registry and change registry values that
belong to WinPE, this is the only way.
2. ARC path is the least of the problems. You don't have to use it is SP2
since you should be able to use driver ID. You problem (was, is and will be)
cdrom.sys which is used instead of disk.sys and driver stack above them.
I'm impressed with your stubbornness to mess with things that you know
little or nothing about and not even want to pursue the enough knowledge to
understand how things work
1. Install remote Windows Debugger and learn how to use it, so that you can
see loaded drivers and learn about them.
2. Install DDK and analyze documentation and sources about cdrom.sys and
disk.sys drivers and what drivers lie above them and how.
3. From DDK doc learn about filter drivers, especially UpperFilter class
drivers. This will allow you to know what ewf.sys do how it does it and why
it does that.
4. Learn all that you can find on net about CDFS.sys driver.
5. Based on above choose where to install ewf.sys driver (above which driver
if possible that is)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]for
UpperFilter driver is probably the wrong key for CD device.To save you
some time based on my humble experience with drivers and XP.1. WinPE boot
by using cdfs.sys driver and you want that functionality.2. cdfs.sys
driver is simple File System driver that give you access tofiles stored on
CD.3. cdfs.sys driver being the simple driver do not have
writeoperationsimplemented.4. EWF.sys can't be installed above FS
driver.5. Installing EWF anywhere else that above FS driver would not make
anysensesince no write requests would reach it. (Like I said cdfs.sys
havefile readonly support.)Please Dietmar tell me which of my assumptions
in bullets are wrong?Since if they are all true there is no way for you to
use EWF as you want touseit.You see this is type of discussion that you
should have chosen from day one.You have many people here including
Konstantin and me that can help you withunderstanding this.If you have
some info or idea that we did not though of we would like toknow it and
help you with it.But blindly playing with registry and drivers approach
can't work inthiscase.There is no MS conspiracy involved in why XPP do not
boot from CD orothersimilar things, this is just how drivers that
XPP/XPe/WinPE use aredesigned.Nothing more nothing less.So beliefs that
something will or not work on XP that you so often mentionare wrong way to
do.Hunches based on how things are implemented andstretching the
implementationto limits are the right way to go, although they also can be
dead-endsbecause of many reasons that are beyond ourcontrol and that we
could notforeseen up-front.So again what is your expectation in regards to
driver load order andtheirmutual interaction?This is very important and
answering this will tell youwhy it will or won'twork.Regards,Slobodan

[Dietmar]

Hi Slobodan,
I put the key ENABLED to Volume0 in EWF and set it to 0. But again there
appears after full boot and setting the personal entries the message (both
on virtual CD and harddisk) that "

Your system has no paging file, or the paging file is too small. " I
think its because EWF.

So work must go on but tomorrow is school again and I have then only
little time. I have windebug and I integrated in my large XPE DVD image
the component for firewire debug. So I can do all what I (and YOU) want to
do and now I am understanding a lot of whats do do next...hihi

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

Why make you think that EWF even started?

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I put the key ENABLED to Volume0 in EWF and set it to 0. But again there
appears after full boot and setting the personal entries the message (both
on virtual CD and harddisk) that "
Your system has no paging file, or the paging file is too small. " I
think its because EWF.
So work must go on but tomorrow is school again and I have then only
little time. I have windebug and I integrated in my large XPE DVD image
the component for firewire debug. So I can do all what I (and YOU) want to
do and now I am understanding a lot of whats do do next...hihi
Dietmar

[Dietmar]

Hi Slobodan,
I enabled C:\pagefile.sys in registry but still isnt factory.exe able to
build a pagefile (as described in winbomb.ini). This gives the message No
pagefile... . Therefore I think that factory and EWF wont work together.
Perhaps You can disable factory, is this possible? The problem with
factory MUST be solved, simply to have a commandline where You can type
C:\ewfmgr c: and see...hihi

Dietmar

[Dietmar]

Hi Slobodan,
I controlled the 2 logfiles at WinPE on harddrive.
All seems to start with c:\factory -WinPe but
not the pagefile (driver?).
My last thought for today is: Let factory do all its work and disable
everywhere any pagefile (winbomb.ini , registry and so on). Perhaps this
work, I will try this tomorrow.

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

So you don't have command line, right?
I don't know how you were able to conclude that EWF is working?

About pagefile I have no clue based on informations that you gave us so far.
What pagefile on WinPE image do you talk about?

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I enabled C:\pagefile.sys in registry but still isnt factory.exe able to
build a pagefile (as described in winbomb.ini). This gives the message No
pagefile... . Therefore I think that factory and EWF wont work together.
Perhaps You can disable factory, is this possible? The problem with
factory MUST be solved, simply to have a commandline where You can type
C:\ewfmgr c: and see...hihi
Dietmar

[Dietmar]

Hi Slobodan,
now I have a commandline on virtual CD and on harddisk with WinPE.

All the registryentrances changed like SFiorito told. You can probe this
with regedit under running WinPE.

But if You type C:\ ewfmgr c: then comes the message with error 1,
Failed getting protected volumen...
This means: EWF and WinPE can live together WITHOUT any problems, but EWF
does not start, perhaps because it need a function which is implemented in
XP(E) but not in WinPE.
I search for...hihi

Dietmar

[KM]

Dietmar,

Post by Dietmar
Hi Slobodan,
now I have a commandline on virtual CD and on harddisk with WinPE.
All the registryentrances changed like SFiorito told. You can probe this
with regedit under running WinPE.
But if You type C:\ ewfmgr c: then comes the message with error 1,
Failed getting protected volumen...
This means: EWF and WinPE can live together WITHOUT any problems, but EWF

This is an interesting conclusion. :-) I wonder what you think a problem is.

The EWF itself has very minimum dependencies. They are likely in WinPE but you can check it out with Dependency Walker.

Btw, what makes you think the ewf.sys got installed properly? (you saw some messages in SetupApi.log? you ran devcon?)

If you followed SFiorito's tutorial, you probably set EWF above disk.sys? (you didn't change it to have the filter on top of
cdfs.sys or cdrom.sys?)

[Slobodan Brcin (eMVP)]

Dietmar,

Post by Dietmar
All the registryentrances changed like SFiorito told. You can probe this
with regedit under running WinPE.

And my opinion that it won't work if you don't change some values does not
count?

Post by Dietmar
But if You type C:\ ewfmgr c: then comes the message with error 1,
Failed getting protected volumen...

Exactly this was expected by me, (or error 50 cant tell from head).
While booting from CD try protecting some present HDD partition, just to
verify that EWF can work on WinPE at all. (You will need User Mode PnP
functionality in your image)

Post by Dietmar
This means: EWF and WinPE can live together WITHOUT any problems, but EWF
does not start, perhaps because it need a function which is implemented in
XP(E) but not in WinPE.

Just read your sentense please, what does it tell you?

Most people would say something like: "EWF is not working, please help, what
it wrong with it!"

How can you say that they live together WITHOUT ANY problems, when ewf is
not working?

Regards,
Slobodan

[Dietmar]

Hi Slobodan,
I believe what You say when we speak of boot from CD.
But, why does EWF not work on a WinPE image on harddisk? What is the main
difference between WinPE and XP(E) on harddisk that causes EWF not to work
there? First I thought it may be therefore, that some functions are missed.
But Konstantin told me, that there are very fiew dependencies of EWF to
other components. Perhaps it does not work, because simple names of
folders and files has changed and (or) because of the minint mode. EWF to
persuade to run on CD is another thing. But: If You burn a CD without EWF
enabled on the image You get message
"delayed write fail". This disappears, if EWF was enabled on the image.
Therefor EWF must be able to be set as enabled in any form direct on CD or
am I wrong?

Dietmar

[Slobodan Brcin (eMVP)]

Hi Dietmar,

Post by Dietmar
But, why does EWF not work on a WinPE image on harddisk? What is the main
difference between WinPE and XP(E) on harddisk that causes EWF not to work
there?

Now you have finaly started to ask right questions.
When you preinstall EWF in XPe image by filling registry, EWF will start
working only after FBA make one reboot. Some informations are requred beside
main EWF registry entries to make it work. I never took enough time to
search for these entries installed by PnP. They might be simple entries
missing from enum brach when EWF in installed by PnP. Or they might be
volume class entries related, have no idea and this is what you will have to
check out.

WinPE do not save any info to registry after you reboot computer so these
entries will be lost and you will never get them that way.
Other thing that I have no explanation is why User mode PnP component is
required in XPe image. My guess is that it is not required but for proper
installation purposes it must be there while FBA or PnP is done for first
time.
Probably later User mode PnP is not required.

Things that you should check on minlogon image are:
How to make EWF run without User mode PnP.

You must make EWF run during the first FBA pass, so that each boot start
with same FBA image. (No changes should be written to disk).
If you manage to figure out registry keys to make this work then WinPe won't
give you any headaches.

Post by Dietmar
First I thought it may be therefore, that some functions are missed.
But Konstantin told me, that there are very fiew dependencies of EWF to
other components. Perhaps it does not work, because simple names of
folders and files has changed and (or) because of the minint mode.

It must work since Konstantin did not give you a complete truth about ewf
dependencies. ewf.sys driver does not have dependencies.
Ony things that ewf.sys driver is using are: ntoskrnl.exe and hal.dll and
without these you can't boot your OS, since they are the OS.

All that is needed are correct registry entries. And forget about those that
are mentioned in documentations that you can find on the net or in this NG.

Post by Dietmar
EWF to
persuade to run on CD is another thing. But: If You burn a CD without EWF
enabled on the image You get message
"delayed write fail". This disappears, if EWF was enabled on the image.
Therefor EWF must be able to be set as enabled in any form direct on CD or
am I wrong?

Probably results based on bad testing, nothing more. WinPE can boot without
ewf.sys just fine.
For this to make any sense EWF would need to work.

Regards,
Slobodan

[Dietmar]

Hi Slobodan and Konstantin,
I understand all that You are saying.
Here is my question:
Is it possible to BUILD in XPE an image, which looks
(nearly) complet as WinPE? This has a major advantage: You can use all the
great possibilities from XPE!
When You dont use Tap.exe but ta.exe from start You will get much less
drivers. But that is not what I am searching for. You must build an image
which is indepent from special used computer and his hardware. So does
WinPe.
This means you have to notice all the drivers and their registryentrances
and dependencies as it is described from XPE in the middle of targetbuilder
as they ARE in WinPe. IF(!) then EWF runs on that image, you only have to
search through that registry which entries differ from those in real
WinPE.
And about the files and folders: Is it possible (or even have You to do
this) to rename them in XPE that they have identical names as in WinPE?
(Even UPPERCASE?) That thougt has another aspect too.
I heard in NGs, that ntldr changes his doings, when it is renamed from
setupldr.bin to ntldr and vice versa. I heard, that only that with "ntldr"
name looks whether there is a boot.ini. Now I think that THIS is wrong,
because I renamed EWFNTLDR to SETUPLDR.BIN and this special one is still
searching for a boot.ini! setupldr.bin of WinPe does NOT search for any
boot.ini. But for another example the root on WinPE CD is I386 and on
harddisk it is minint. So I am thinking that not all is wrong what has
been told in newsgroups about the behavior of ntldr.

Dietmar

PS: In my WinPE image (from real WinPE CD) is a DLL called UMPNPMGR.DLL.
Is that enough, that User Mode PnP is working in WinPE or have I to
examine all the registryentraces belonging to that component in XPE too?

[Slobodan Brcin (eMVP)]

Hi Dietmar,

Please give us more direct questions it is hard to give an answer to
sentences with statements.

You can make XPe image without using TA, or TAP.
This has been discussed and referenced in this NG by Konstantin and me many
times. Just add minlogon sample macro component to empty project resolve
dependencies and you are good to go.

About ntldrs I though that they are all different. Do binary check on them.

Post by Dietmar
PS: In my WinPE image (from real WinPE CD) is a DLL called UMPNPMGR.DLL.
Is that enough, that User Mode PnP is working in WinPE or have I to
examine all the registryentraces belonging to that component in XPE too?

I do not know. But you have missed the point. User mode PnP is not required
for EWF to work, it is required just to make it work. But since you can't
save cahnges to registry and reboot WinPE for these to take effect it is
quite useless for you.
You must make XPe image with EWF that will work without User mode PnP.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan and Konstantin,
I understand all that You are saying.
Is it possible to BUILD in XPE an image, which looks
(nearly) complet as WinPE? This has a major advantage: You can use all the
great possibilities from XPE!
When You dont use Tap.exe but ta.exe from start You will get much less
drivers. But that is not what I am searching for. You must build an image
which is indepent from special used computer and his hardware. So does
WinPe.
This means you have to notice all the drivers and their registryentrances
and dependencies as it is described from XPE in the middle of
targetbuilder
as they ARE in WinPe. IF(!) then EWF runs on that image, you only have to
search through that registry which entries differ from those in real
WinPE.
And about the files and folders: Is it possible (or even have You to do
this) to rename them in XPE that they have identical names as in WinPE?
(Even UPPERCASE?) That thougt has another aspect too.
I heard in NGs, that ntldr changes his doings, when it is renamed from
setupldr.bin to ntldr and vice versa. I heard, that only that with "ntldr"
name looks whether there is a boot.ini. Now I think that THIS is wrong,
because I renamed EWFNTLDR to SETUPLDR.BIN and this special one is still
searching for a boot.ini! setupldr.bin of WinPe does NOT search for any
boot.ini. But for another example the root on WinPE CD is I386 and on
harddisk it is minint. So I am thinking that not all is wrong what has
been told in newsgroups about the behavior of ntldr.
Dietmar
PS: In my WinPE image (from real WinPE CD) is a DLL called UMPNPMGR.DLL.
Is that enough, that User Mode PnP is working in WinPE or have I to
examine all the registryentraces belonging to that component in XPE too?

[KM]

Dietmar,

You can build an image that is "close" to WinPE by functionality (just a Command Line Shell, Minlogon, etc.).
You can also go by WinPE approach and make some driver installation dynamic (e.g., network stack using snetcfg tool, or using devcon
for some other drivers that do not require reboot).

Reading the following thread may give you an idea on how to create one image that will run on many different computers:
http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded/browse_frm/thread/18f886794b5ed5ff/390526d295f4c00d#390526d295f4c00d

However, one thing you will unlikely be able to do is the testing as much as WinPE tested. WinPE is a product of Microsoft and they
put a great effort to make sure it runs on x86 computers. You probably don't have as much resources to test it so thoroughly.
--
Regards,
Konstantin

Post by Dietmar
Hi Slobodan and Konstantin,
I understand all that You are saying.
Is it possible to BUILD in XPE an image, which looks
(nearly) complet as WinPE? This has a major advantage: You can use all the
great possibilities from XPE!
When You dont use Tap.exe but ta.exe from start You will get much less
drivers. But that is not what I am searching for. You must build an image
which is indepent from special used computer and his hardware. So does
WinPe.
This means you have to notice all the drivers and their registryentrances
and dependencies as it is described from XPE in the middle of targetbuilder
as they ARE in WinPe. IF(!) then EWF runs on that image, you only have to
search through that registry which entries differ from those in real
WinPE.
And about the files and folders: Is it possible (or even have You to do
this) to rename them in XPE that they have identical names as in WinPE?
(Even UPPERCASE?) That thougt has another aspect too.
I heard in NGs, that ntldr changes his doings, when it is renamed from
setupldr.bin to ntldr and vice versa. I heard, that only that with "ntldr"
name looks whether there is a boot.ini. Now I think that THIS is wrong,
because I renamed EWFNTLDR to SETUPLDR.BIN and this special one is still
searching for a boot.ini! setupldr.bin of WinPe does NOT search for any
boot.ini. But for another example the root on WinPE CD is I386 and on
harddisk it is minint. So I am thinking that not all is wrong what has
been told in newsgroups about the behavior of ntldr.
Dietmar
PS: In my WinPE image (from real WinPE CD) is a DLL called UMPNPMGR.DLL.
Is that enough, that User Mode PnP is working in WinPE or have I to
examine all the registryentraces belonging to that component in XPE too?

[Dietmar]

Hi Konstantin and Slobodan,
do You know which switch in boot.ini or in WinPE here as bootoptions
produces a complet list of all the drivers that are loaded or even
failed?

And my second question: There is a file called TXTSETUP.SIF in WinPE. When
there stands under [SourceDisksFiles]
ewf.sys = 100,,,,,,,4,0,0
ewfmgr.exe = 100,,,,,,,2,0,0

is it also importand, whether these files stand after disk.sys =
100,,,,,,5_,4,0,0,,1,4
or before or did the numbers after them give them there right place
automatically?

Dietmar

[KM]

Dietmar,

Post by Dietmar
Hi Konstantin and Slobodan,
do You know which switch in boot.ini or in WinPE here as bootoptions
produces a complet list of all the drivers that are loaded or even
failed?

/SOS ?

Post by Dietmar
And my second question: There is a file called TXTSETUP.SIF in WinPE. When
there stands under [SourceDisksFiles]
ewf.sys = 100,,,,,,,4,0,0
ewfmgr.exe = 100,,,,,,,2,0,0
is it also importand, whether these files stand after disk.sys =
100,,,,,,5_,4,0,0,,1,4
or before or did the numbers after them give them there right place
automatically?

I couldn't understand this question.
The [SourceDisksFiles] section is used to define the files for partucilar INF installation and the installation sources for each
file.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/install/hh/install/inf-format_98e4d013-4846-474d-8ccd-eb5ec33b67ee.xml.asp



Konstantin

[Slobodan Brcin (eMVP)]

Dietmar,

Post by Dietmar
And my second question: There is a file called TXTSETUP.SIF in WinPE. When
there stands under [SourceDisksFiles]
ewf.sys = 100,,,,,,,4,0,0
ewfmgr.exe = 100,,,,,,,2,0,0
is it also importand, whether these files stand after disk.sys =
100,,,,,,5_,4,0,0,,1,4
or before or did the numbers after them give them there right place
automatically?

Order of entries in this file is irrelevant, but unfortunately IIRC you
can't define boot critical "Upper Class Filter Driver" using this or any
other documented and to me known method :-(

Regards,
Slobodan

[Dietmar]

Hi Konstantin and Slobodan,
/sos does not work in WinPE. I make a try with /bootlog and this works. It
gives me the following ntbtlog.txt file: (Are there all drivers listened,
that started or failed?)

Microsoft (R) Windows (R) Version 5.1 (Build 2600)
4 6 2005 19:34:41.500
Loaded driver \minint\system32\ntkrnlmp.exe
Loaded driver \minint\system32\halaacpi.dll
Loaded driver \minint\system32\KDCOM.DLL
Loaded driver \minint\system32\BOOTVID.dll
Loaded driver setupdd.sys
Loaded driver \minint\system32\drivers\SPDDLANG.SYS
Loaded driver pci.sys
Loaded driver acpi.sys
Loaded driver \minint\system32\drivers\WMILIB.SYS
Loaded driver isapnp.sys
Loaded driver acpiec.sys
Loaded driver \minint\system32\drivers\OPRGHDLR.SYS
Loaded driver ohci1394.sys
Loaded driver \minint\system32\drivers\1394BUS.SYS
Loaded driver pcmcia.sys
Loaded driver pciide.sys
Loaded driver \minint\system32\drivers\PCIIDEX.SYS
Loaded driver intelide.sys
Loaded driver viaide.sys
Loaded driver cmdide.sys
Loaded driver toside.sys
Loaded driver aliide.sys
Loaded driver mountmgr.sys
Loaded driver ftdisk.sys
Loaded driver partmgr.sys
Loaded driver fdc.sys
Loaded driver dmload.sys
Loaded driver dmio.sys
Loaded driver sbp2port.sys
Loaded driver lbrtfdc.sys
Loaded driver usbehci.sys
Loaded driver \minint\system32\drivers\USBPORT.SYS
Loaded driver usbohci.sys
Loaded driver usbuhci.sys
Loaded driver usbhub.sys
Loaded driver \minint\system32\drivers\USBD.SYS
Loaded driver usbccgp.sys
Loaded driver hidusb.sys
Loaded driver \minint\system32\drivers\HIDPARSE.SYS
Loaded driver \minint\system32\drivers\HIDCLASS.SYS
Loaded driver serial.sys
Loaded driver serenum.sys
Loaded driver usbstor.sys
Loaded driver i8042prt.sys
Loaded driver kbdhid.sys
Loaded driver kbdclass.sys
Loaded driver mouclass.sys
Loaded driver mouhid.sys
Loaded driver SCSIPORT.SYS
Loaded driver cpqarray.sys
Loaded driver atapi.sys
Loaded driver aha154x.sys
Loaded driver sparrow.sys
Loaded driver symc810.sys
Loaded driver aic78xx.sys
Loaded driver i2omp.sys
Loaded driver dac960nt.sys
Loaded driver ql10wnt.sys
Loaded driver amsint.sys
Loaded driver asc.sys
Loaded driver asc3550.sys
Loaded driver mraid35x.sys
Loaded driver ini910u.sys
Loaded driver ql1240.sys
Loaded driver aic78u2.sys
Loaded driver symc8xx.sys
Loaded driver sym_hi.sys
Loaded driver sym_u3.sys
Loaded driver asc3350p.sys
Loaded driver abp480n5.sys
Loaded driver cd20xrnt.sys
Loaded driver ultra.sys
Loaded driver adpu160m.sys
Loaded driver dpti2o.sys
Loaded driver ql1080.sys
Loaded driver ql1280.sys
Loaded driver ql12160.sys
Loaded driver perc2.sys
Loaded driver hpn.sys
Loaded driver cbidf2k.sys
Loaded driver dac2w2k.sys
Loaded driver dmboot.sys
Loaded driver flpydisk.sys
Loaded driver cdrom.sys
Loaded driver \minint\system32\drivers\CLASSPNP.SYS
Loaded driver disk.sys
Loaded driver sfloppy.sys
Loaded driver ramdisk.sys
Loaded driver ksecdd.sys
Loaded driver fastfat.sys
Loaded driver ntfs.sys
Loaded driver cdfs.sys
Loaded driver ndis.sys
Loaded driver mup.sys
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\System32\DRIVERS\AN983.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbios.sys
Loaded driver \SystemRoot\System32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipsec.sys
Loaded driver \SystemRoot\System32\DRIVERS\tcpip.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys

There is nothing (?!)even no fail with EWF.SYS. How can this happen?
Registry for EWF entries are

Windows Registry Editor Version 5.00



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]

"Enable"="N"



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]

"EnableAutoLayout"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]

"NtfsDisableLastAccessUpdate"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management\PrefetchParameters]

"EnablePrefetcher"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

BootExecute=""



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF]

"NextInstance"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000]

"Service"="EWF"

"Legacy"=dword:00000001

"ConfigFlags"=dword:00000020

"Class"="LegacyDriver"

"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"

"DeviceDesc"="EWF"

"Capabilities"=dword:00000000



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control]

"ActiveService"="EWF"



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]

"ErrorControl"=dword:00000001

"Group"="System Bus Extender"

"Start"=dword:00000000

"Type"=dword:00000001



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

"UpperFilters"="Ewf"



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]

"Type"=dword:00000001

"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"

and ewf.sys is in system32\drivers folder and ewfmgr.exe in system32. The
entries in real WinPE registry are for shure exact as above described.

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

This tell you that ewf.sys was not loaded period. But it does not tell you
for other drivers that are loaded that they are actualy started. It tell you
that ntldr put them in memory, nothing more, nothing less.

If I had to guess then I would point my finger to:
TXTSETUP.SIF

You will have to figure out what else should be changed there.

Regards,
Slobodan

PS: You will still have to figure out how to configure EWF in XPe so that it
do not need User Mode PnP and that it start working before FBA.
I made a manual test and EWF can be configured to work in these conditions
like I though that it can.
Unfortunately this require you to know volume id name before it is created
and this is not usable for any product.

Making EWF as boot critical filter driver is the only way but I still have
not an idea how to do that for "Class Filter drivers".

Post by Dietmar
Hi Konstantin and Slobodan,
/sos does not work in WinPE. I make a try with /bootlog and this works. It
gives me the following ntbtlog.txt file: (Are there all drivers listened,
that started or failed?)
Microsoft (R) Windows (R) Version 5.1 (Build 2600)
4 6 2005 19:34:41.500
Loaded driver \minint\system32\ntkrnlmp.exe
Loaded driver \minint\system32\halaacpi.dll
Loaded driver \minint\system32\KDCOM.DLL
Loaded driver \minint\system32\BOOTVID.dll
Loaded driver setupdd.sys
Loaded driver \minint\system32\drivers\SPDDLANG.SYS
Loaded driver pci.sys
Loaded driver acpi.sys
Loaded driver \minint\system32\drivers\WMILIB.SYS
Loaded driver isapnp.sys
Loaded driver acpiec.sys
Loaded driver \minint\system32\drivers\OPRGHDLR.SYS
Loaded driver ohci1394.sys
Loaded driver \minint\system32\drivers\1394BUS.SYS
Loaded driver pcmcia.sys
Loaded driver pciide.sys
Loaded driver \minint\system32\drivers\PCIIDEX.SYS
Loaded driver intelide.sys
Loaded driver viaide.sys
Loaded driver cmdide.sys
Loaded driver toside.sys
Loaded driver aliide.sys
Loaded driver mountmgr.sys
Loaded driver ftdisk.sys
Loaded driver partmgr.sys
Loaded driver fdc.sys
Loaded driver dmload.sys
Loaded driver dmio.sys
Loaded driver sbp2port.sys
Loaded driver lbrtfdc.sys
Loaded driver usbehci.sys
Loaded driver \minint\system32\drivers\USBPORT.SYS
Loaded driver usbohci.sys
Loaded driver usbuhci.sys
Loaded driver usbhub.sys
Loaded driver \minint\system32\drivers\USBD.SYS
Loaded driver usbccgp.sys
Loaded driver hidusb.sys
Loaded driver \minint\system32\drivers\HIDPARSE.SYS
Loaded driver \minint\system32\drivers\HIDCLASS.SYS
Loaded driver serial.sys
Loaded driver serenum.sys
Loaded driver usbstor.sys
Loaded driver i8042prt.sys
Loaded driver kbdhid.sys
Loaded driver kbdclass.sys
Loaded driver mouclass.sys
Loaded driver mouhid.sys
Loaded driver SCSIPORT.SYS
Loaded driver cpqarray.sys
Loaded driver atapi.sys
Loaded driver aha154x.sys
Loaded driver sparrow.sys
Loaded driver symc810.sys
Loaded driver aic78xx.sys
Loaded driver i2omp.sys
Loaded driver dac960nt.sys
Loaded driver ql10wnt.sys
Loaded driver amsint.sys
Loaded driver asc.sys
Loaded driver asc3550.sys
Loaded driver mraid35x.sys
Loaded driver ini910u.sys
Loaded driver ql1240.sys
Loaded driver aic78u2.sys
Loaded driver symc8xx.sys
Loaded driver sym_hi.sys
Loaded driver sym_u3.sys
Loaded driver asc3350p.sys
Loaded driver abp480n5.sys
Loaded driver cd20xrnt.sys
Loaded driver ultra.sys
Loaded driver adpu160m.sys
Loaded driver dpti2o.sys
Loaded driver ql1080.sys
Loaded driver ql1280.sys
Loaded driver ql12160.sys
Loaded driver perc2.sys
Loaded driver hpn.sys
Loaded driver cbidf2k.sys
Loaded driver dac2w2k.sys
Loaded driver dmboot.sys
Loaded driver flpydisk.sys
Loaded driver cdrom.sys
Loaded driver \minint\system32\drivers\CLASSPNP.SYS
Loaded driver disk.sys
Loaded driver sfloppy.sys
Loaded driver ramdisk.sys
Loaded driver ksecdd.sys
Loaded driver fastfat.sys
Loaded driver ntfs.sys
Loaded driver cdfs.sys
Loaded driver ndis.sys
Loaded driver mup.sys
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\System32\DRIVERS\AN983.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbios.sys
Loaded driver \SystemRoot\System32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipsec.sys
Loaded driver \SystemRoot\System32\DRIVERS\tcpip.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
There is nothing (?!)even no fail with EWF.SYS. How can this happen?
Registry for EWF entries are
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction]
"Enable"="N"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout]
"EnableAutoLayout"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisableLastAccessUpdate"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management\PrefetchParameters]
"EnablePrefetcher"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
BootExecute=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF]
"NextInstance"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000]
"Service"="EWF"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000020
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="EWF"
"Capabilities"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control]
"ActiveService"="EWF"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"="Ewf"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"Type"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"
and ewf.sys is in system32\drivers folder and ewfmgr.exe in system32. The
entries in real WinPE registry are for shure exact as above described.
Dietmar

[Dietmar]

Hi Slobodan,
I tried /debug on WinPE on harddisk in bootoptions and place windbg.exe in
rootfolder.
Is it possible on that way to receive a dump file
from the bootprocess of the WinPE OS, or have I to connect it to another
computer via nullmodem or firewirecable because the WinPE does NOT crash
until full boot?

Dietmar

[Slobodan Brcin (eMVP)]

Dietmar,

When dealing with driver debugging you should always use remote debugging.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I tried /debug on WinPE on harddisk in bootoptions and place windbg.exe in
rootfolder.
Is it possible on that way to receive a dump file
from the bootprocess of the WinPE OS, or have I to connect it to another
computer via nullmodem or firewirecable because the WinPE does NOT crash
until full boot?
Dietmar

[Dietmar]

Hi Slobodan,
I installed windbg and connected it through a nullmodem cable. When WinPE
is running as to be the debugged machine, there come the following
messages on the other computer but nothing about all the drivers whether
they are loaded or failed???


Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.

Opened \\.\com1
Waiting to reconnect...
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpsp1.020828-1920
Kernel base = 0x80400000 PsLoadedModuleList = 0x80477e30
System Uptime: not available
SMSS: !!! MiniNT Boot !!!
FACTORY.EXE::Factory is using the following WinBOM.ini file:
C:\minint\system32\WINBOM.INI
DmServer::Initialize() Warning: Unable to RegisterEventSource LDMS, Win32
Error=1717FACTORY.EXE::Not installing a configuration set because one of
the variables from the [WinPE] section was missing: Lang, Sku, ConfigSet,
Arch.
FACTORY.EXE::ERROR: Factory state "Finishing WinPE" failed.


Dietmar

[Slobodan Brcin (eMVP)]

Ditmar,

windbg is not easy program to use, and it will show you only things that you
ask him to show you. You will have to go trough help and find commands that
will give you listing of things in formats that yuo want and that you can
read.

Break into target machine so that you enter command.
And use "!devnode 0 1" command for start.

Regards,
Slobodan

Post by Dietmar
Hi Slobodan,
I installed windbg and connected it through a nullmodem cable. When WinPE
is running as to be the debugged machine, there come the following
messages on the other computer but nothing about all the drivers whether
they are loaded or failed???
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Opened \\.\com1
Waiting to reconnect...
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: C:\WINDOWS\Symbols
Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpsp1.020828-1920
Kernel base = 0x80400000 PsLoadedModuleList = 0x80477e30
System Uptime: not available
SMSS: !!! MiniNT Boot !!!
C:\minint\system32\WINBOM.INI
DmServer::Initialize() Warning: Unable to RegisterEventSource LDMS, Win32
Error=1717FACTORY.EXE::Not installing a configuration set because one of
the variables from the [WinPE] section was missing: Lang, Sku, ConfigSet,
Arch.
FACTORY.EXE::ERROR: Factory state "Finishing WinPE" failed.
Dietmar

[Dietmar]

Hi Slobodan,
Yeah, this works and gives the following message:

nt!RtlpBreakWithStatusInstruction:
8043c3fa cc int 3
kd> !devnode 0 1
Dumping IopRootDeviceNode (= 0x863efa50)
DevNode 0x863efa50 for PDO 0x863b83c8
InstancePath is "HTREE\ROOT\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ef600 for PDO 0x863ef748
InstancePath is "Root\LEGACY_EWF\0000"
ServiceName is "EWF"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b7dc8 for PDO 0x863b7f10
InstancePath is "ROOT\ACPI_HAL\0000"
ServiceName is "\Driver\ACPI_HAL"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b4d50 for PDO 0x863b7ba0
InstancePath is "ACPI_HAL\PNP0C08\0"
ServiceName is "acpi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ec228 for PDO 0x863ee110
InstancePath is "ACPI\AuthenticAMD_-_x86_Family_15_Model_4\_0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863b6008 for PDO 0x863ed030
InstancePath is "ACPI\PNP0C0C\2&daba3ff&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b6230 for PDO 0x863ed258
InstancePath is "ACPI\PNP0A03\2&daba3ff&0"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637a528 for PDO 0x863efd20
InstancePath is
"PCI\VEN_1106&DEV_3188&SUBSYS_00000000&REV_01\3&61aaa01&0&00"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637a408 for PDO 0x863eeb38
InstancePath is
"PCI\VEN_1106&DEV_B188&SUBSYS_00000000&REV_00\3&61aaa01&0&08"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637c430 for PDO 0x8637ca18
InstancePath is
"PCI\VEN_1002&DEV_4E4A&SUBSYS_C0001043&REV_00\4&83d6234&0&0008"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637c310 for PDO 0x8637c6d0
InstancePath is
"PCI\VEN_1002&DEV_4E6A&SUBSYS_C0011043&REV_00\4&83d6234&0&0108"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637a2e8 for PDO 0x863ef030
InstancePath is
"PCI\VEN_1102&DEV_0002&SUBSYS_00201102&REV_04\3&61aaa01&0&48"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863b5ee8 for PDO 0x863ec928
InstancePath is
"PCI\VEN_1102&DEV_7002&SUBSYS_00201102&REV_01\3&61aaa01&0&49"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863b5dc8 for PDO 0x863ec738
InstancePath is
"PCI\VEN_1317&DEV_0985&SUBSYS_100C1734&REV_11\3&61aaa01&0&58"
ServiceName is "AN983"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5ca8 for PDO 0x8637d940
InstancePath is
"PCI\VEN_11C1&DEV_5811&SUBSYS_10261734&REV_61\3&61aaa01&0&68"
ServiceName is "ohci1394"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5b88 for PDO 0x8637d5f8
InstancePath is
"PCI\VEN_1106&DEV_3149&SUBSYS_102E1734&REV_80\3&61aaa01&0&78"
ServiceName is "pciide"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ceaa8 for PDO 0x863cf108
InstancePath is "PCIIDE\IDEChannel\4&abecf3c&0&0"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ce988 for PDO 0x863cebf0
InstancePath is "PCIIDE\IDEChannel\4&abecf3c&0&1"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5a68 for PDO 0x8637d2b0
InstancePath is
"PCI\VEN_1106&DEV_0571&SUBSYS_102E1734&REV_06\3&61aaa01&0&79"
ServiceName is "viaide"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863cd918 for PDO 0x863cde60
InstancePath is "PCIIDE\IDEChannel\4&2544908&0&0"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8633b8e0 for PDO 0x862e3940
InstancePath is
"IDE\DiskWDC_WD2500JB-00GVA0_____________________08.02D08\4457572d4143374c313132313335_039_0_0_0_0"
ServiceName is "Disk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863cd7f8 for PDO 0x863cdc90
InstancePath is "PCIIDE\IDEChannel\4&2544908&0&1"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862ecee8 for PDO 0x86388a98
InstancePath is
"IDE\CdRomTOSHIBA_DVD-ROM_SD-M1712________________1004____\5&23501ecc&0&0.0.0"
ServiceName is "CdRom"
TargetDeviceNotify List - f 0xe117f598 b 0xe126e8d0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863d8860 for PDO 0x8638f7f8
InstancePath is
"IDE\CdRom_NEC_DVD+RW_ND-1100A____________________1.91____\5&23501ecc&0&0.1.0"
ServiceName is "CdRom"
TargetDeviceNotify List - f 0xe10171c8 b 0xe11f9e00
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5948 for PDO 0x863b6e40
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&80"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863e1358 for PDO 0x86345030
InstancePath is "USB\ROOT_HUB\4&253043c2&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5828 for PDO 0x863b6af8
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&81"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86345a00 for PDO 0x863dc030
InstancePath is "USB\ROOT_HUB\4&37e9f467&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5708 for PDO 0x863b67b0
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&82"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8633ba00 for PDO 0x86335030
InstancePath is "USB\ROOT_HUB\4&f08db05&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b55e8 for PDO 0x863b6468
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&83"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863dca00 for PDO 0x8632f030
InstancePath is "USB\ROOT_HUB\4&21c28baa&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b54c8 for PDO 0x863edce8
InstancePath is
"PCI\VEN_1106&DEV_3104&SUBSYS_102E1734&REV_86\3&61aaa01&0&84"
ServiceName is "usbehci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863dbae0 for PDO 0x862ef030
InstancePath is "USB\ROOT_HUB20\4&1b22a742&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b53a8 for PDO 0x863ed9a0
InstancePath is
"PCI\VEN_1106&DEV_3227&SUBSYS_00000000&REV_00\3&61aaa01&0&88"
ServiceName is "isapnp"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637b628 for PDO 0x8637b030
InstancePath is "ISAPNP\ReadDataPort\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637b508 for PDO 0x8637bf18
InstancePath is "ACPI\PNP0C02\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637b3e8 for PDO 0x8637be00
InstancePath is "ACPI\PNP0200\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637b2c8 for PDO 0x8637bce8
InstancePath is "ACPI\PNP0000\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637b1a8 for PDO 0x8637bbd0
InstancePath is "ACPI\PNP0B00\4&10c7922&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea008 for PDO 0x8637bab8
InstancePath is "ACPI\PNP0100\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863eaee8 for PDO 0x8637b9a0
InstancePath is "ACPI\PNP0C04\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863eadc8 for PDO 0x8637b888
InstancePath is "ACPI\PNP0800\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863eaca8 for PDO 0x8637b770
InstancePath is "ACPI\PNP0A05\4&10c7922&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea840 for PDO 0x863eabb8
InstancePath is "ACPI\PNP0303\5&38a20744&0"
ServiceName is "i8042prt"
TargetDeviceNotify List - f 0xe1203360 b 0xe1203360
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea720 for PDO 0x863eaaa0
InstancePath is "ACPI\PNP0F13\5&38a20744&0"
ServiceName is "i8042prt"
TargetDeviceNotify List - f 0xe11c59a0 b 0xe11c59a0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea600 for PDO 0x863ea988
InstancePath is "ACPI\PNP0700\5&38a20744&0"
ServiceName is "fdc"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863790a8 for PDO 0x8638f4d0
InstancePath is "FDC\GENERIC_FLOPPY_DRIVE\6&52b70c0&0&0"
ServiceName is "flpydisk"
TargetDeviceNotify List - f 0xe10210e0 b 0xe10210e0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5288 for PDO 0x863ed7b0
InstancePath is
"PCI\VEN_1022&DEV_1100&SUBSYS_00000000&REV_00\3&61aaa01&0&C0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637c008 for PDO 0x863ed5c0
InstancePath is
"PCI\VEN_1022&DEV_1101&SUBSYS_00000000&REV_00\3&61aaa01&0&C1"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637cee8 for PDO 0x863ed3d0
InstancePath is
"PCI\VEN_1022&DEV_1102&SUBSYS_00000000&REV_00\3&61aaa01&0&C2"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637cdc8 for PDO 0x8637a030
InstancePath is
"PCI\VEN_1022&DEV_1103&SUBSYS_00000000&REV_00\3&61aaa01&0&C3"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863efee8 for PDO 0x863ec030
InstancePath is "ACPI\FixedButton\2&daba3ff&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863798f0 for PDO 0x86379a38
InstancePath is "ROOT\ftdisk\0000"
ServiceName is "ftdisk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862e6288 for PDO 0x863e2e30
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset7E00Length25BF9C00"
TargetDeviceNotify List - f 0xe1017c90 b 0xe1017c90
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862dfcc0 for PDO 0x86386590
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset9C459D800LengthEA6094200"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862dfba0 for PDO 0x862e7030
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset2B9281C000LengthEA6094200"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862dfa80 for PDO 0x862e7238
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset186A639800Length13281E2800"
TargetDeviceNotify List - f 0xe11781d0 b 0xe11781d0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86378740 for PDO 0x86378888
InstancePath is "ROOT\dmio\0000"
ServiceName is "dmio"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86267998 for PDO 0x86267ae0
InstancePath is "Root\LEGACY_BEEP\0000"
ServiceName is "Beep"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x8625e008 for PDO 0x86267820
InstancePath is "Root\LEGACY_CDFS\0000"
ServiceName is "cdfs"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x8625e4c0 for PDO 0x8625e608
InstancePath is "Root\LEGACY_DMBOOT\0000"
ServiceName is "dmboot"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x8625e280 for PDO 0x8625e3c8
InstancePath is "Root\LEGACY_DMLOAD\0000"
ServiceName is "dmload"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86266008 for PDO 0x8625e188
InstancePath is "Root\LEGACY_FASTFAT\0000"
ServiceName is "fastfat"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x862665d8 for PDO 0x86266720
InstancePath is "Root\LEGACY_KSECDD\0000"
ServiceName is "ksecdd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86266398 for PDO 0x862664e0
InstancePath is "Root\LEGACY_MOUNTMGR\0000"
ServiceName is "mountmgr"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86266158 for PDO 0x862662a0
InstancePath is "Root\LEGACY_NDIS\0000"
ServiceName is "ndis"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86283710 for PDO 0x86283030
InstancePath is "Root\LEGACY_NTFS\0000"
ServiceName is "ntfs"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x862834d0 for PDO 0x86283618
InstancePath is "Root\LEGACY_NULL\0000"
ServiceName is "Null"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86283290 for PDO 0x862833d8
InstancePath is "Root\LEGACY_SETUPDD\0000"
ServiceName is "setupdd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86262ee8 for PDO 0x86283198
InstancePath is "Root\LEGACY_VGASAVE\0000"
ServiceName is "VgaSave"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)



I heard from another program called "Softice".
Which program windbg or softice gives more information on what happend on
targetmachine?
And which is easier to handle?

Thanks
Dietmar

PS: I showed my computer with SDI boot from USB harddisk and boot from DVD
with EWF to about 100 pupils in my school. There was so much enthusiasm
for that! So I decided to offer a lesson about XPE. I think it is not too
difficult, but needs supreme effort.

[Slobodan Brcin (eMVP)]

Dietmar,

Post by Dietmar
I heard from another program called "Softice".

Yup but I do not think that it is for free.

Post by Dietmar
Which program windbg or softice gives more information on what happend on
targetmachine?

Debugging support is integral part of NT kernel itself. With kd, windbg you
can send commands to kernel and ask it for info about object and drivers
that you are insterested in and then kernel will give you text describing
that object. You can get all info that you want provided that you know what
info you really need.

I do not used Softice so I can't speek of it.

Post by Dietmar
And which is easier to handle?

This depend on which one you have used before. Here read people comments on
both of them:
http://groups-beta.google.com/groups?q=softice+windbg

Please keep in mind that there are many people that mix uage of softice and
windbg. So opinion of peoples will be coloured by the tool that they are
currently using.

This NG is bad for most of questions that you ask:
You should ask your questions in debugger and driver programming related
NG's
microsoft.public.windbg

One hint what to look for:

Currently EWF is connected as upper filter to volumes that you can see in
form similar to:
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset186A639800Length13281E2800"


Regards,
Slobodan

Post by Dietmar
Thanks
Dietmar
Hi Slobodan,
8043c3fa cc int 3
kd> !devnode 0 1
Dumping IopRootDeviceNode (= 0x863efa50)
DevNode 0x863efa50 for PDO 0x863b83c8
InstancePath is "HTREE\ROOT\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ef600 for PDO 0x863ef748
InstancePath is "Root\LEGACY_EWF\0000"
ServiceName is "EWF"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b7dc8 for PDO 0x863b7f10
InstancePath is "ROOT\ACPI_HAL\0000"
ServiceName is "\Driver\ACPI_HAL"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b4d50 for PDO 0x863b7ba0
InstancePath is "ACPI_HAL\PNP0C08\0"
ServiceName is "acpi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ec228 for PDO 0x863ee110
InstancePath is "ACPI\AuthenticAMD_-_x86_Family_15_Model_4\_0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863b6008 for PDO 0x863ed030
InstancePath is "ACPI\PNP0C0C\2&daba3ff&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b6230 for PDO 0x863ed258
InstancePath is "ACPI\PNP0A03\2&daba3ff&0"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637a528 for PDO 0x863efd20
InstancePath is
"PCI\VEN_1106&DEV_3188&SUBSYS_00000000&REV_01\3&61aaa01&0&00"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637a408 for PDO 0x863eeb38
InstancePath is
"PCI\VEN_1106&DEV_B188&SUBSYS_00000000&REV_00\3&61aaa01&0&08"
ServiceName is "pci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637c430 for PDO 0x8637ca18
InstancePath is
"PCI\VEN_1002&DEV_4E4A&SUBSYS_C0001043&REV_00\4&83d6234&0&0008"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637c310 for PDO 0x8637c6d0
InstancePath is
"PCI\VEN_1002&DEV_4E6A&SUBSYS_C0011043&REV_00\4&83d6234&0&0108"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637a2e8 for PDO 0x863ef030
InstancePath is
"PCI\VEN_1102&DEV_0002&SUBSYS_00201102&REV_04\3&61aaa01&0&48"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863b5ee8 for PDO 0x863ec928
InstancePath is
"PCI\VEN_1102&DEV_7002&SUBSYS_00201102&REV_01\3&61aaa01&0&49"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863b5dc8 for PDO 0x863ec738
InstancePath is
"PCI\VEN_1317&DEV_0985&SUBSYS_100C1734&REV_11\3&61aaa01&0&58"
ServiceName is "AN983"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5ca8 for PDO 0x8637d940
InstancePath is
"PCI\VEN_11C1&DEV_5811&SUBSYS_10261734&REV_61\3&61aaa01&0&68"
ServiceName is "ohci1394"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5b88 for PDO 0x8637d5f8
InstancePath is
"PCI\VEN_1106&DEV_3149&SUBSYS_102E1734&REV_80\3&61aaa01&0&78"
ServiceName is "pciide"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ceaa8 for PDO 0x863cf108
InstancePath is "PCIIDE\IDEChannel\4&abecf3c&0&0"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ce988 for PDO 0x863cebf0
InstancePath is "PCIIDE\IDEChannel\4&abecf3c&0&1"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5a68 for PDO 0x8637d2b0
InstancePath is
"PCI\VEN_1106&DEV_0571&SUBSYS_102E1734&REV_06\3&61aaa01&0&79"
ServiceName is "viaide"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863cd918 for PDO 0x863cde60
InstancePath is "PCIIDE\IDEChannel\4&2544908&0&0"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8633b8e0 for PDO 0x862e3940
InstancePath is
"IDE\DiskWDC_WD2500JB-00GVA0_____________________08.02D08\4457572d4143374c313132313335_039_0_0_0_0"
ServiceName is "Disk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863cd7f8 for PDO 0x863cdc90
InstancePath is "PCIIDE\IDEChannel\4&2544908&0&1"
ServiceName is "atapi"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862ecee8 for PDO 0x86388a98
InstancePath is
"IDE\CdRomTOSHIBA_DVD-ROM_SD-M1712________________1004____\5&23501ecc&0&0.0.0"
ServiceName is "CdRom"
TargetDeviceNotify List - f 0xe117f598 b 0xe126e8d0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863d8860 for PDO 0x8638f7f8
InstancePath is
"IDE\CdRom_NEC_DVD+RW_ND-1100A____________________1.91____\5&23501ecc&0&0.1.0"
ServiceName is "CdRom"
TargetDeviceNotify List - f 0xe10171c8 b 0xe11f9e00
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5948 for PDO 0x863b6e40
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&80"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863e1358 for PDO 0x86345030
InstancePath is "USB\ROOT_HUB\4&253043c2&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5828 for PDO 0x863b6af8
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&81"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86345a00 for PDO 0x863dc030
InstancePath is "USB\ROOT_HUB\4&37e9f467&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5708 for PDO 0x863b67b0
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&82"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8633ba00 for PDO 0x86335030
InstancePath is "USB\ROOT_HUB\4&f08db05&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b55e8 for PDO 0x863b6468
InstancePath is
"PCI\VEN_1106&DEV_3038&SUBSYS_102E1734&REV_81\3&61aaa01&0&83"
ServiceName is "usbuhci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863dca00 for PDO 0x8632f030
InstancePath is "USB\ROOT_HUB\4&21c28baa&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b54c8 for PDO 0x863edce8
InstancePath is
"PCI\VEN_1106&DEV_3104&SUBSYS_102E1734&REV_86\3&61aaa01&0&84"
ServiceName is "usbehci"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863dbae0 for PDO 0x862ef030
InstancePath is "USB\ROOT_HUB20\4&1b22a742&0"
ServiceName is "usbhub"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b53a8 for PDO 0x863ed9a0
InstancePath is
"PCI\VEN_1106&DEV_3227&SUBSYS_00000000&REV_00\3&61aaa01&0&88"
ServiceName is "isapnp"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637b628 for PDO 0x8637b030
InstancePath is "ISAPNP\ReadDataPort\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637b508 for PDO 0x8637bf18
InstancePath is "ACPI\PNP0C02\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637b3e8 for PDO 0x8637be00
InstancePath is "ACPI\PNP0200\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637b2c8 for PDO 0x8637bce8
InstancePath is "ACPI\PNP0000\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x8637b1a8 for PDO 0x8637bbd0
InstancePath is "ACPI\PNP0B00\4&10c7922&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea008 for PDO 0x8637bab8
InstancePath is "ACPI\PNP0100\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863eaee8 for PDO 0x8637b9a0
InstancePath is "ACPI\PNP0C04\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863eadc8 for PDO 0x8637b888
InstancePath is "ACPI\PNP0800\4&10c7922&0"
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
Problem = CM_PROB_NOT_CONFIGURED
DevNode 0x863eaca8 for PDO 0x8637b770
InstancePath is "ACPI\PNP0A05\4&10c7922&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea840 for PDO 0x863eabb8
InstancePath is "ACPI\PNP0303\5&38a20744&0"
ServiceName is "i8042prt"
TargetDeviceNotify List - f 0xe1203360 b 0xe1203360
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea720 for PDO 0x863eaaa0
InstancePath is "ACPI\PNP0F13\5&38a20744&0"
ServiceName is "i8042prt"
TargetDeviceNotify List - f 0xe11c59a0 b 0xe11c59a0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863ea600 for PDO 0x863ea988
InstancePath is "ACPI\PNP0700\5&38a20744&0"
ServiceName is "fdc"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863790a8 for PDO 0x8638f4d0
InstancePath is "FDC\GENERIC_FLOPPY_DRIVE\6&52b70c0&0&0"
ServiceName is "flpydisk"
TargetDeviceNotify List - f 0xe10210e0 b 0xe10210e0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863b5288 for PDO 0x863ed7b0
InstancePath is
"PCI\VEN_1022&DEV_1100&SUBSYS_00000000&REV_00\3&61aaa01&0&C0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637c008 for PDO 0x863ed5c0
InstancePath is
"PCI\VEN_1022&DEV_1101&SUBSYS_00000000&REV_00\3&61aaa01&0&C1"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637cee8 for PDO 0x863ed3d0
InstancePath is
"PCI\VEN_1022&DEV_1102&SUBSYS_00000000&REV_00\3&61aaa01&0&C2"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8637cdc8 for PDO 0x8637a030
InstancePath is
"PCI\VEN_1022&DEV_1103&SUBSYS_00000000&REV_00\3&61aaa01&0&C3"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863efee8 for PDO 0x863ec030
InstancePath is "ACPI\FixedButton\2&daba3ff&0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x863798f0 for PDO 0x86379a38
InstancePath is "ROOT\ftdisk\0000"
ServiceName is "ftdisk"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862e6288 for PDO 0x863e2e30
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset7E00Length25BF9C00"
TargetDeviceNotify List - f 0xe1017c90 b 0xe1017c90
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862dfcc0 for PDO 0x86386590
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset9C459D800LengthEA6094200"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862dfba0 for PDO 0x862e7030
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset2B9281C000LengthEA6094200"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x862dfa80 for PDO 0x862e7238
InstancePath is
"STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset186A639800Length13281E2800"
TargetDeviceNotify List - f 0xe11781d0 b 0xe11781d0
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86378740 for PDO 0x86378888
InstancePath is "ROOT\dmio\0000"
ServiceName is "dmio"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x86267998 for PDO 0x86267ae0
InstancePath is "Root\LEGACY_BEEP\0000"
ServiceName is "Beep"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x8625e008 for PDO 0x86267820
InstancePath is "Root\LEGACY_CDFS\0000"
ServiceName is "cdfs"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x8625e4c0 for PDO 0x8625e608
InstancePath is "Root\LEGACY_DMBOOT\0000"
ServiceName is "dmboot"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x8625e280 for PDO 0x8625e3c8
InstancePath is "Root\LEGACY_DMLOAD\0000"
ServiceName is "dmload"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86266008 for PDO 0x8625e188
InstancePath is "Root\LEGACY_FASTFAT\0000"
ServiceName is "fastfat"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x862665d8 for PDO 0x86266720
InstancePath is "Root\LEGACY_KSECDD\0000"
ServiceName is "ksecdd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86266398 for PDO 0x862664e0
InstancePath is "Root\LEGACY_MOUNTMGR\0000"
ServiceName is "mountmgr"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86266158 for PDO 0x862662a0
InstancePath is "Root\LEGACY_NDIS\0000"
ServiceName is "ndis"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86283710 for PDO 0x86283030
InstancePath is "Root\LEGACY_NTFS\0000"
ServiceName is "ntfs"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x862834d0 for PDO 0x86283618
InstancePath is "Root\LEGACY_NULL\0000"
ServiceName is "Null"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86283290 for PDO 0x862833d8
InstancePath is "Root\LEGACY_SETUPDD\0000"
ServiceName is "setupdd"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
DevNode 0x86262ee8 for PDO 0x86283198
InstancePath is "Root\LEGACY_VGASAVE\0000"
ServiceName is "VgaSave"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeInitialized (0x302)
I heard from another program called "Softice".
Which program windbg or softice gives more information on what happend on
targetmachine?
And which is easier to handle?
Thanks
Dietmar
PS: I showed my computer with SDI boot from USB harddisk and boot from DVD
with EWF to about 100 pupils in my school. There was so much enthusiasm
for that! So I decided to offer a lesson about XPE. I think it is not too
difficult, but needs supreme effort.

[Dietmar]

Hi Slobodan,
my harddisk with WinPe is

STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset7E00Length25BF9C00

But in ewf...volume0 you cant set an VolumeID for that harddrive, because
it changes with every boot. Only the last 12 numbers stays permanent.

There is a constant VolumeID for CF cards, which work always, but I testet
it for WinPE and nothing happens.

Is it possible in any way to combine the harddrive number above with the
arcpath in EWF...Volume0?

Dietmar

[Slobodan Brcin (eMVP)]

Hi Dietmar,

I do not know what you have tested, but I guess that we are talking about
completely different things.

Post by Dietmar
STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset7E00Length25BF9C00

This name precisely identify each partition in your computer (deciphering
meanings of these numbers is simple but it is irrelevant).

Post by Dietmar
Is it possible in any way to combine the harddrive number above with the
arcpath in EWF...Volume0?

I have no idea what you are talking about :-(

Basically EWF driver is installed as UpperFilter of Class Volume this by
default mean that it is upper filter driver for all Storage\Volumes\.....
I was just telling you where you should expect to see EWF attached to when
looking from windbg on drivers.

Anyhow EWF will not be connected to volumes that are detected for first time
(always true in WinPE case).
So you must know STORAGE\Volume\..... path and preinstall it to WinPE
registry to make EWF start on that volume. (this does not mean that EWF is
enabled or disabled it mean just that driver can be used on that volume)

Info that I told you is only good for testing purposes, and has no practical
usage value since you can't anticipate all Volume IDs that can be detected.

I do not have a slight idea how to overcome this particular limitation of
Windows (I do not mean here EWF but problem with filter drivers in general),
but if you can figure this out I'm very interested in hearing the solution
since I need it for some other (non EWF) usage on WinPE and XPe in general.

Regards,
Slobodan

PS:
Try to sum all things that you think that you know. Make a plan what you
want to accomplish and how you want to accomplish that with all steps
including tests and things why do you think that something should work (keep
that on driver interaction level).
And post that in new thread. Also include clear short questions that we can
give you answers on.

Post by Dietmar
Hi Slobodan,
my harddisk with WinPe is
STORAGE\Volume\1&30a96598&0&Signature28C728C6Offset7E00Length25BF9C00
But in ewf...volume0 you cant set an VolumeID for that harddrive, because
it changes with every boot. Only the last 12 numbers stays permanent.
There is a constant VolumeID for CF cards, which work always, but I testet
it for WinPE and nothing happens.
Is it possible in any way to combine the harddrive number above with the
arcpath in EWF...Volume0?
Dietmar