How MS made XP Dos bootdisk, Can people check their XP and report? Options

[jaclaz]

Very nice article on the internals of the DOS boot diskette you can make from XP.

Here:
http://mirror.href.com/thestarman/winxp/winxpsd.htm

I asked a friend that runs XP English (I am on Win2K) SP2 and the file version is 6.0.2600.0,
size 1.501.696 byte, like in the article.

Can people with different version of XP/2003 in English and other languages check whether the file is still the same?

jaclaz

[Draugen]

same results here, on english xp sp2. same filesize and version.

I even extracted the bytes in question (from offset 0x40F0 to offset 0x16C0EF) and tested in WinImage. Works perfectly - all files mentioned are present and accounted for.

kinda neat actually (i don't know how USEFUL - there are better DOS boot disks out there, but a fancy "trick").

[Nuno Brito]

You'd be amazed with quantity of older files hanging around in newer systems - most times they are kept strictly for compatiblity - but it's always good to know the forensics of this boot disk..

[philon]

In XP Pro German:

filesize: 1502.208 Bytes
fileversion: 6.0.2600.0 (xpclient.010817-1148)
dated: 18.August 2001

philon

[jaclaz]

In XP Pro German:

filesize: 1502.208 Bytes
fileversion: 6.0.2600.0 (xpclient.010817-1148)
dated: 18.August 2001

philon

Philon (and all other languages users)
could you please check with a hex editor whether the Disk image starts at the same offset.

I'll explain why I need this info.

I am putting together a batch file to generate a "good" DOS bootdisk from an installed XP.
By "good" I mean one that has a quick CD-ROM driver, i.e. QCDROM and some other useful nice Freeware utilities that can be freely distributed.
I tried all I could think of to make one with FREEDOS that could be recursively booted using GRUB4DOS/GRUB.EXE, but it seems like the loading of TSRs, like the CDROM extensions/driver breaks compatibility with GRUB.EXE, whilst DOS files from Windows 98 or those (originally ME ones) that come with XP seem to work ok.

The idea would be:
1) Use a program like dsfo, from the DS File Ops Kit:
http://members.ozemail.com.au/~nulifetv/fr...ware/index.html
to extract the floppy image from the diskcopy.dll

dsfo %SystemRoot%\System32\diskcopy.dll 440 1474560 XpDOS.img

2) Use a program like MCOPYF.EXE, part of the Mtools for Win32:
http://www.frontiernet.net/~fys/mtools.htm
to extract from the floppy image relevant files

mcopyf XpDOS.img %builddir%\COMMAND.COM
mcopyf XpDOS.img %builddir%\MSDOS.SYS
mcopyf XpDOS.img %builddir%\IO.SYS

3) Use a program like bfd or bfi from Bart's:
http://www.nu2.nu/bfd/index.php
http://www.nu2.nu/bfi/index.php
to re-build the floppy image including all the tools already assembled in the %toolsdir% directory

bfi -v -t=6 -o=IO.SYS -o=MSDOS.SYS -o=COMMAND.COM -l=GRUB4DOS -b=XPNT2003.bin -f=GRUB4FPY.IMG %toolsdir%

This way you can do it from batch, without need of a physical floppy drive, without mounting a Virtual Floppy Driver like Ken Kato's one and without need to install Winimage. UFS Explorer or other similar utilities.

Hope the above makes sense.

As always, ideas, suggestions and corrections are welcome.....

jaclaz

[aec]

Philon (and all other languages users)
could you please check with a hex editor whether the Disk image starts at the same offset.

In XP Greek

diskcopy.dll
Ver: 6.0.2600.0
FileSize: 1.502.720 bytes
Image starts at offset: 3828 hex

aec

[philon]

Addendum:

the german version starts at offset 3820

philon

[jaclaz]

Sorry mates, I know this is probably getting a nuisance, but could you try and verify the following:
1) Download gsar from here:
http://home.online.no/~tjaberg/
http://home.online.no/~tjaberg/gsar112.zip
(it is a 41 Kb file)
2) unzip gsar.exe wherever you want, make in the same dir a batch file with this content:

CODE

gsar -b -s:xEB:x3C:x90:x2A:x2D:x76:x34:x56:x49:x48:x43:x00 %SystemRoot%\System32\diskcopy.dll

(the above is on a single line)
3)open a dos prompt, navigate to the directory and execute the batch file
output should be something like

C:\Windows\System32\diskcopy.dll: 0x40f0
C:\Windows\System32\diskcopy.dll: 1 match found

As it seems that addresses are different in different languages I find it better to do a search for the floppy header and get "dynamically" the offset, this, provided that in all versions the "strange" floppy label of "*-v4VIHC" is fixed, should guarantee a better portability....

jaclaz

[aec]

Hi jaclaz

The output is correct for WinXP Greek

CODE

gsar -b -s:xEB:x3C:x90:x2A:x2D:x76:x34:x56:x49:x48:x43:x00 %SystemRoot%\System32\diskcopy.dll

C:\WINDOWS\System32\diskcopy.dll: 0x3828
C:\WINDOWS\System32\diskcopy.dll: 1 match found

aec

[philon]

@jaclaz (master of links)

was very close :

CODE

C:\WINDOWS\System32\diskcopy.dll
C:\WINDOWS\System32\diskcopy.dll: 0x3828
C:\WINDOWS\System32\diskcopy.dll: 1 match found

philon

[jaclaz]

Thanks,
I think I can take for granted that the disk image "label" is the same in all languages.

Any other taker (from other countries)?


jaclaz

[ceroni]

Windows XP SP2 PT-BR (Brazilian portuguese) diskcopy.dll:
6.0.2600.0 (1.502.208 bytes)

CODE

C:\WINDOWS\System32\diskcopy.dll: 0x3828

[hamradio]

Philon (and all other languages users)
could you please check with a hex editor whether the Disk image starts at the same offset.

I'll explain why I need this info.

I am putting together a batch file to generate a "good" DOS bootdisk from an installed XP.
By "good" I mean one that has a quick CD-ROM driver, i.e. QCDROM and some other useful nice Freeware utilities that can be freely distributed.
I tried all I could think of to make one with FREEDOS that could be recursively booted using GRUB4DOS/GRUB.EXE, but it seems like the loading of TSRs, like the CDROM extensions/driver breaks compatibility with GRUB.EXE, whilst DOS files from Windows 98 or those (originally ME ones) that come with XP seem to work ok.

The idea would be:
1) Use a program like dsfo, from the DS File Ops Kit:
http://members.ozemail.com.au/~nulifetv/fr...ware/index.html
to extract the floppy image from the diskcopy.dll

dsfo %SystemRoot%\System32\diskcopy.dll 440 1474560 XpDOS.img

2) Use a program like MCOPYF.EXE, part of the Mtools for Win32:
http://www.frontiernet.net/~fys/mtools.htm
to extract from the floppy image relevant files

mcopyf XpDOS.img %builddir%\COMMAND.COM
mcopyf XpDOS.img %builddir%\MSDOS.SYS
mcopyf XpDOS.img %builddir%\IO.SYS

3) Use a program like bfd or bfi from Bart's:
http://www.nu2.nu/bfd/index.php
http://www.nu2.nu/bfi/index.php
to re-build the floppy image including all the tools already assembled in the %toolsdir% directory

bfi -v -t=6 -o=IO.SYS -o=MSDOS.SYS -o=COMMAND.COM -l=GRUB4DOS -b=XPNT2003.bin -f=GRUB4FPY.IMG %toolsdir%

This way you can do it from batch, without need of a physical floppy drive, without mounting a Virtual Floppy Driver like Ken Kato's one and without need to install Winimage. UFS Explorer or other similar utilities.

Hope the above makes sense.

As always, ideas, suggestions and corrections are welcome.....

jaclaz

Another way to extract
Use Restorator (or similar prog) and extract BINFILE saving it in .raw format - the size is 1474560 and
you got floppy image.
Size of diskcopy.dll depends on language - different string length.

[jaclaz]

Another way to extract
Use Restorator (or similar prog) and extract BINFILE saving it in .raw format - the size is 1474560 and
you got floppy image.
Size of diskcopy.dll depends on language - different string length.

Yep, but you see, all the point is doing it from batch and on all languages.


On a side note, it seems like this "version" of ME already has HIMEM.SYS "embedded", at least both HIMEM.SYS 3.95 (Win9x) and FREEDOS HIMEM.EXE do not load, saying that XMS has been already installed.

This is coherent with MDGX's report here:
http://www.mdgx.com/newtip20.htm
but I am failing to see why ME bootdisks you can find all have HIMEM.SYS as a separate file, and even on the diskette image there is a "deleted" HIMEM.SYS.


jaclaz

[bilou_gateux]

2003 Server Web Edition w/ SP1 ENU %SystemRoot%\system32\diskcopy.dll 0x4720
XP Pro w/ SP1 FRA %SystemRoot%\system32\diskcopy.dll 0x3828

[hamradio]

Yep, but you see, all the point is doing it from batch and on all languages.
On a side note, it seems like this "version" of ME already has HIMEM.SYS "embedded", at least both HIMEM.SYS 3.95 (Win9x) and FREEDOS HIMEM.EXE do not load, saying that XMS has been already installed.

This is coherent with MDGX's report here:
http://www.mdgx.com/newtip20.htm
but I am failing to see why ME bootdisks you can find all have HIMEM.SYS as a separate file, and even on the diskette image there is a "deleted" HIMEM.SYS.
jaclaz

Yes, using batch process is better way.
Image contains a lot of deleted files - they just kept core (kernel) files.

[Bernat]

Windows XP SP2 French
diskopy.dll
6.00.2600.0000 (xpclient.010817-1148)
size 1 502 208 bytes

Searching hexa chain EB3C902A2D76345649484300
Found once at 0x3828

[Ozzyguy66]

Same results here.
WinXP SP2 Australia

C:\Windows\System32\diskcopy.dll: 0x40f0
C:\Windows\System32\diskcopy.dll: 1 match found


Ozzy

[Nuno Brito]

Results differ in Windows 2003 standard edition (english)

C:\Windows\System32\diskcopy.dll: 0x4720
C:\Windows\System32\diskcopy.dll: 1 match found


I hope this helps your research..

[jaclaz]

Nuno,
since you "happened to pass nearby" (I did not want to bother you asking it out of topic), I can extract the files allright, using my "rude" batch way.

But, as you can see above, the user needs to have quite a bit of utilities handy.

Couldn't you put together one of yours batcher .scripts to do this ?

jaclaz