How To Boot A Readwrite Pe System From Ram, (not SDI based) Options

[aec]

RAM Loading

Current status
The W2k3 loading system has turned out to be a revolutionary solution for creating MS systems that load an image in RAM and start it from there.
We have been using it for quite a while to load in RAM ISO or SDI images of PE systems.
The initial boot media (which can be a cd, a usb stick, a hd,...) is, after the loading, free to be removed or to be used for other purposes.

The ISO based system results in a system where the system drive appears as a ReadOnly one, leaving the bootmedia we booted from, free for further use.

The SDI based system is preferable since on one hand the system drive is Writable and on the other it can be prepared as a NTFS compressed filesystem leaving us more free space in RAM.
The disadvantage of a SDI based system is that its creation depends on the installation in our system of an extra SDI management system (MS Windows embedded subsystem) which is unnecessarily complex to use and not easy to fully automate.


New developements
In this post we will use an excellent idea (presented in the thread of Booting Xp from RamDisk) that has been recently used in the context of loading and booting a normal XP system from RAM !!!.

Thanks to the work of euhenio, dennis123123, jaclaz, HighwayStar ...
http://euhenio.mam.by/
http://www.911cd.net/forums//index.php?s=&...st&p=127683
we now know that the w2k3 loading system is capable of loading in RAM not only ISO and SDI images but also normal disk images like those created by filedisk freeware virtual disk management utility.

Note: This finding, although independent, is actually not new.
It has been known for several months now at boot-land but this knowledge unfortunately never found its way over to 911cd.
Highwaystar has used it and even developed winbuilder scripts for this (ramboot winbuilder scripts)

It turns out that we can build systems similar to the SDI based ones that however do not have the disadvantages that were mentioned above. The creation of the disk image is straightforward and is actually fully scriptable.

In short, the process involves the creation of a disk image (we may use filedisk to create it), the copying of the files of a PE system and replacing if necessary the ramdisk.sys driver with the w2k3sp1 version.
Finally, the loader files are the well known w2k3sp1 files which allow the loading of the image in RAM.

Below is an attempt to present a step-by-step description of the logic:

Building instructions

Needed Files
1. Find a copy of RAMDISK.SYS, SETUPLDR.BIN and NTDETECT.COM from a W2k3Sp1 source cd or system
and copy them in a directory of your choice. Let us represent it with %W2k3SP1%

2. Install filedisk:
http://www.acc.umu.se/~bosse/
http://www.acc.umu.se/~bosse/filedisk-15.zip
in your system (you need to do this only once)
Preferably put filedisk.exe in your path so that is easily accessible.

3. Prepare your files for your PE system.
Use any building environment you like (pebuilder, reatogo, ubcd4win, winbuilder,..)
We need either the final output files OR the prepared iso.
Keep the size small enough, in any case < 500M.

RW RamPE systems: The procedure
4. Specify a folder that contains the PE Files.
For the sake of the presentation let us call the path to the PE Files as %PEFilesDir%

(i) %PEFilesDir% could be for example the outdir of pebuilder (e.g. c:\pe\BartPE)
(ii) In case you want to start with an ISO containing the PEFiles (e.g. c:\pe\pe.iso) you can mount
the iso file with filedisk as a drive (say I:)

CODE

filedisk /mount 0 c:\pe\pe.iso /cd I:

and your %PEFilesDir% will be I:

5. Create somewhere in your system an initially empty disk image (say c:\pe\rampe.img) that is big enough to host the PEFiles (size<500M),
format it with NTFS compressed filesystem and mount it as a RW drive, say R:

CODE

filedisk /mount 1 c:\pe\rampe.img 256M R:
   format R: /FS:NTFS /C /V:RAMPE

Choose the 256M size appropriately so that it is large enough to host the files of your build and also leave some free space.
Take into account that by using ntfs compression our files occupy less space than their total uncompressed size.
The extra space you leave will appear as available writable space on your pe system disk.
In this way you can spare the use of ramdrv if you like.


6. Copy the contents of %PEFilesDir% to R:

CODE

xcopy %PEFilesDir%\*.* R:\ /E /H /R /Y

NOTE: One may use robocopy instead of xcopy for more options

7. If your files were not generated from a W2k3-SP1 system you need to replace the ramdisk.sys with the w2k3 version
Supposing that you have the w2k3sp1 files in %W2k3SP1% dir

CODE

copy %W2k3SP1%\ramdisk.sys r:\i386\system32\drivers\RAMDISK.SYS

8. Unmount any filedisk drives

CODE

filedisk /umount I:   # needed if you used step 4ii
filedisk /umount R:

9. Prepare W2k3 loading system (need files from a w2k3 with at least SP1)
The details depend on the boot media.
Below we describe two common cases where we boot from CD and from a USB stick.

9a. Boot from CD and load in RAM

Create a folder/file structure (upper case) in some folder, say RamPE

CODE

RamPE\
RamPE\BOOTSECT.BIN        # cd bootsector from a bartpe system
RamPE\RAMPE.IMG        # the (unmounted) image prepared above
RAMPE\WINNT.SIF        # text file (see below)
RamPE\I386\
RamPE\I386\NTDETECT.COM    # w2k3sp1 file
RamPE\I386\SETUPLDR.BIN    # w2k3sp1 file

The contents of winnt.sif is

CODE

[SetupData]
BootDevice = "ramdisk(0)"
BootPath = "\i386\System32\"
OsLoadOptions = "/noguiboot /fastdetect /minint /rdpath=RAMPE.IMG"

Build an iso out of this by running mkisofs with a commandline similar to next code (we assume we are running from the directory that is the parent folder of RamPE folder of step 9a)

CODE

mkisofs -iso-level 4 -force-uppercase -volid "RAMPE" -b BOOTSECT.BIN -no-emul-boot -boot-load-size 4 -hide BOOTSECT.BIN -hide boot.catalog -o "RAMPE.ISO" "RamPE"

Burn the RAMPE.ISO and test your new boot cd.

9b. Boot from a properly formatted USB stick/disk

Format your USB (flash) drive with a utility (e.g. with standard XP format, HP utility, pe2usb, ...)
(we need a drive with standard MBR calling NTLDR)
Note: For better compatibility format with FAT16

Copy in the root of the USB stick the following

CODE

NTLDR        # w2k3sp1 setupldr.bin renamed to NTLDR
NTDETECT.COM    # w2k3sp1 file
WINNT.SIF    # text file (see below)
RAMPE.IMG    # the (unmounted) image file prepared above

The contents of winnt.sif is

CODE

[SetupData]
BootDevice = "ramdisk(0)"
BootPath = "\i386\System32\"
OsLoadOptions = "/noguiboot /fastdetect /minint /rdpath=rampe.img"

Boot with this USB drive and test.




Hope you find this guide usefull.

Regards

This post has been edited by jaclaz: Jul 17 2009, 08:42 AM

Reason for edit: Fixed filedisk link to new version

[hilander999]

Thats pretty cool, can't wait to play with it.

Nice to see a solution that is freeware, not controlled by MS, other then still needing the ramdrive from 2k3.

[scankurban]

Thats a diffirent idea and simple.Thanks.I have two copy of pe with sdi ram load 55.mb and 119 mb. with network support.I'll try this maybe better.

Nice to see a solution that is freeware, not controlled by MS, other then still needing the ramdrive from 2k3.

Sdi mounter - maker in embedded studio already free to use.Pe is not free is you don't have one copy of windows xp.Another option Live slax for me

This post has been edited by scankurban: Feb 19 2007, 08:01 PM

[jaclaz]

VERY good!

With this and XP Ramboot we finally got "freed" from the SDI "legacy" and it's "custom" format.

I know I repeat myself, but while I do like a lot filedisk, I have found that it has on some machines some problems and moreover it's installation procedure is more complicated than needed, as an alternative you can use Ken Kato's VDK and DSFOK toolkit fsz, see my post here for more insight:
http://www.911cd.net/forums//index.php?sho...19056&st=49

Quick guide:

Just put fsz, vdk.exe and vdk.sys in the same directory

CODE

fsz vdktest.img 256000000

will create the file

CODE

vdk.exe OPEN 0 vdktest.img /RW

will install the driver, start it and mount the image

CODE

vdk.exe LINK 0 0 R:

will link the letter R: to the image

CODE

format R: /FS:NTFS /C /V:RAMPE

will format it

Once you have finished

CODE

vdk.exe REMOVE

will unlink the drive letter, stop the driver and unnstall it.

Once it is formatted, the image can be re-mounted with:

CODE

vdk.exe OPEN 0 vdktest.img /RW

(mapped to the first available driveletter)
or

CODE

vdk.exe OPEN 0 vdktest.img /RW /L:R

(mapped to the R: driveletter)


jaclaz

This post has been edited by jaclaz: Feb 20 2007, 05:40 AM

[aec]

I know I repeat myself, ...

I'm really glad that you are not tired of repeating extremely useful info .

I am also biased towards vdk and once I verify the procedure with vdk I will bind your instructions in my first post.

Thanks

This post has been edited by aec: Feb 20 2007, 06:18 AM

[ktp]

Thanks aec and jaclaz, at first I dropped the procedure due to the filedisk installation requiring reboot, but now it seems much easier.
I will experiment this new (for me) to boot PE system.

[ktp]

Well I just try vdk and get this error :

D:\Multiboot\Tools\dsfok>vdk OPEN 0 vdktest.img /RW
Virtual Disk Driver for Windows version 3.1
http://chitchat.at.infoseek.co.jp/vmware/

Installed the Virtual Disk Driver.
Failed to start the Virtual Disk Driver.
Impossible to create already existing file. <= translated message which seems to come from the OS.

Of course previously I already create vdktest.img with fsz successfully.

Update: I try on my other machine and all works well. So the problem appears on my main machine. But how to solve this problem? On this machine
I usually use vfd without any problem.

Update #2: I found that I have to use suite of commands:
vdk install
vdk start
vdk open 0 vdktest.img /RW
vdk link 0 0 R:
== other commands here
vdk close r:
vdk stop
vdk uninstall

so that vdk work on my main machines.
Typing directly the command "vdk open 0 vdktest.img /RW" failed on my machine with no vdk installed.

This post has been edited by ktp: Feb 20 2007, 07:45 AM

[dog]

We need either the final output files OR the prepared iso.
Keep the size small enough, in any case < 500M.

I thought 500mb was a limit of sdi - is it a limit of w2003, or just advice?

[jaclaz]

Typing directly the command "vdk open 0 vdktest.img /RW" failed on my machine with no vdk installed.

Quite strange.

Some Registry permissions?

R: letter already mapped (and remained "sticky" in the DosDevices enrtry in Registry)?

The "vdk OPEN" command should be a "shortcut" to the "proper" series of commands "INSTALL, START, OPEN" as well as "REMOVE" should be the same as "CLOSE, STOP, UNINSTALL".

However, if the right series of command appears to be working, it is still better than the reboot required by filedisk, assembling them in very small CMD file is trivial.

Have you tried my pseudo-GUI for it?
http://home.graffiti.net/jaclaz:graffiti.n...ts/VDM/vdm.html
(it uses the command line "vdk OPEN * imagefile /RW" for the "ezMount feature)

jaclaz

This post has been edited by jaclaz: Feb 20 2007, 10:17 AM

[cdob]

There are different images.

XP embedded sdi image: a hard disk image with a header.
8 sector header: sector zero of a hard disk. And partion geometry use CHS 63 sectors.
Therefore boot sector of first partition is at sector 71.
A hd sector contains 512 byte data.

71*512=36352

OsLoadOptions = "/fastdetect /minint /rdpath=BartPE.sdi /rdimageoffset=36352"

Idea:
Windows 2003 SP1 setupldr.bin read imageoffset and jump to a partition boot sector.

fsutil file createnew x:\img250.img 262144000
vdk open 0 X:\img250.img /rw /p:0 /l:y

Image x:\img250.img contains a partition. This image start with a boot sector: offset is zero.

CODE

OsLoadOptions = "/fastdetect /minint /rdpath=img250.img /rdimageoffset=0"

BartPE does boot. This is a sdi ramloader without the sdi driver.
"/rdimageoffset=0" is not required and may be abandoned


A Kent Kato vdk.sys vmware image contain boot sector at 128.
Be aware, there are different vmware images.
128*512=65536

OsLoadOptions = "/fastdetect /minint /rdpath=disk250.vmdk /rdimageoffset=65536"

Loading failed. Maybe a different offset or CHS translation.

[jaclaz]

A Kent Kato vdk.sys vmware image contain boot sector at 128.

NO, actually vdk defaults to a geometry of Nx64x32 on RAW images, so bootsector is on sector 32 or CHS 0/1/1 with that geometry, see my post here:
http://www.911cd.net/forums//index.php?sho...19056&st=49

for the trick of using .pln files to "force" Nx255x63 geometry.

jaclaz

This post has been edited by jaclaz: Feb 20 2007, 10:39 AM

[ktp]

Quite strange.

Some Registry permissions?

R: letter already mapped (and remained "sticky" in the DosDevices enrtry in Registry)?

The "vdk OPEN" command should be a "shortcut" to the "proper" series of commands "INSTALL, START, OPEN" as well as "REMOVE" should be the same as "CLOSE, STOP, UNINSTALL".

However, if the right series of command appears to be working, it is still better than the reboot required by filedisk, assembling them in very small CMD file is trivial.

Have you tried my pseudo-GUI for it?
http://home.graffiti.net/jaclaz:graffiti.n...ts/VDM/vdm.html
(it uses the command line "vdk OPEN * imagefile /RW" for the "ezMount feature)

jaclaz

Yes you are probably right, when the driver installs I have MS Windows Defender (MS anti-spyware) notifies me of the action. As I set Windows Defender to wait for me to validate any unknown change to the system by unknown program (e.g. registry change), maybe there is a timing problem for following commands.

I am used to command line, so as far as it works, no problem, and vdk is better then filedisk (reboot required).

Yes I take a look at the GUI version vdm.cmd. There is no vdkread.txt so I rename readme.txt to vdkread.txt.
Personally I'll use the command line, seems for me to be faster (also with command recall).

This post has been edited by ktp: Feb 20 2007, 11:40 AM

[ktp]

@jaclaz
How can I mount the bartpe.iso with vdk ? Using normal "vdk open 0 bartpe.iso" then mount it gives drive not ready.
filedisk has /cd parameter on mount operation. What is the equivalent for vdk ?

[jaclaz]

@jaclaz
How can I mount the bartpe.iso with vdk ? Using normal "vdk open 0 bartpe.iso" then mount it gives drive not ready.
filedisk has /cd parameter on mount operation. What is the equivalent for vdk ?

There is none.
VDK has not .iso support, it is a feature I requested some time ago to Ken, but until now it was not implemented.

Not that it is really missing, besides filedisk there are several other "Virtual CD" apps, including Microsoft own VCDcontroltool:
http://support.microsoft.com/kb/916902/en-us

Or the one that I normally use:
VirtualClonedrive
http://www.elby.ch/en/fun/software/index.html

That one usually have installed anyway to "peek" into .iso's.

For the record, the version of filedisk by Gilles Vollant:
http://www.winimage.com/misc/filedisk64.htm
also supports .bin images. (don't be fooled by the "64" reference, the download has 32 bit exe too)

jaclaz

[aec]

Just finished my first vdk images according to jaclaz instructions and they boot just fine.
Also no special rdimageoffset is needed.

Furthermore, as far as I know, there are already solutions for installing filedisk service without rebooting.
- There is a driver installer utility (instdrvw.exe).
- I also remember vb and autoit script solutions.
I will search for the links but in case someone has them handy, please post them.
In any case I think I could easily compile a similar utility in c.

regards

This post has been edited by aec: Feb 20 2007, 02:09 PM

[ktp]

For your information, I followed aec's procedure, and the rampe.img loaded just fine with my key.

This post has been edited by ktp: Feb 20 2007, 02:53 PM

[jaclaz]

I will search for the links but in case someone has them handy, please post them.

Cannot say if it helps, but some time ago I made a small related search, results are here:
http://www.boot-land.net/forums/index.php?...c=461&st=16

Just finished my first vdk images according to jaclaz instructions and they boot just fine.
Also no special rdimageoffset is needed.

cdob post above made me realize that the " /rdimageoffset=" is just, as the name implies, an offset from the beginning of "disk" (actually file being a disk image) to the bootsector, I had never fixed my attention on SDI file format.

This opens the possibility of using a "full hard disk" image, either with the Nx255x63 or Nx64x32 geometry, including MBR, hidden sectors and possibly other partitions too, though I cannot say how it could be useful, unless we can do, on USB sticks, some kind of multiboot that allows the editing of WINNT.SIF, but maybe some other member can find some use for the possibility.

Also, as soon as one verifies the position of the bootsector on .vmdk images, reported as 128 by cdob, it will open the possibility of using directly VMware disks or, with a 6 sectors offset, virtualbox ones:
http://www.911cd.net/forums//index.php?sho...19155&st=22

jaclaz

This post has been edited by jaclaz: Feb 21 2007, 09:06 AM

[aec]

Tests with flat and sparse VMWare vmdk disks.

Two disk images (flat and sparse, size 256M), were created with VMWare WS 5.5.3.
From within a virtual machine they were prepared with 1 primary partition and formated with NTFS +compression.
They were mounted/unmounted with VMwareDiskMount.exe


Results
Flat (preallocated space):
rdimageoffset=32356 [63*512]
BOOTS OK

Sparse (growable):
rdimageoffset=97792 [(128+63)*512] (has an 128 sector header)
DOES NOT BOOT


regards

This post has been edited by aec: Feb 22 2007, 02:43 AM

[ktp]

Note that the filedisk /mount command requires an absolute path to the disk image.
Without the absolute path (or even with .\disk.img) it will report file not found !
Currently I use filedisk over vdk since on my system vdk has intermittent problems (failure) to start or to open (link) image file.

This post has been edited by ktp: Feb 22 2007, 03:00 PM

[jaclaz]

As some members might know, I am collecting all RAMdisk/FILEdisk related links I can find here:
http://www.boot-land.net/forums/index.php?...=1507&st=0#

The new link for IMDISK is this one:
http://www.ltr-data.se/opencode.html

ImDisk Virtual Disk Driver - Latest version 1.0.2 built 27 april 2007.

ImDisk is a virtual disk driver for Windows NT/2000/XP/2003. It can use one or more disk image files to create virtual hard disk, floppy or CD/DVD drives .The install package installs a console-mode control program called imdisk.exe and a Control Panel applet. After install is finished, type imdisk without parameters for syntax help or double click the ImDisk icon in the Control Panel. It also adds a menu item in Windows Explorer so that you can right-click on a file to mount it as a virtual disk drive. Users of mdconfig in FreeBSD will probably be familiar with the command line syntax of imdisk.exe. The driver, service and control program can be uninstalled using the Add/Remove programs applet in the Control Panel. No reboot is required for installing or uninstalling.

The install package also contains a user-mode helper service that enables the virtual disk driver to forward I/O requests to other computers on the network. This makes it possible to boot a machine with NTFS partitions with a *nix Live-CD and use the included devio tool to let ImDisk on another computer running Windows on the network mount the NTFS partition on the machine you booted with the *nix Live-CD. This way you can recover information and even run chkdsk on drives on machines where Windows does not boot. I am working on a Live CD image with devio and other useful things for this pre-loaded. Will publish that one for download soon.

jaclaz

Links updated.

This post has been edited by jaclaz: May 3 2007, 04:09 AM