Help - Search - Members - Calendar
Full Version: bootable USB-Stick and FBWF
The CD Forum > Bart's PE Builder > Troubleshooting
knoks
Hi,
i build a bootable USB-Stick based on XP-Prof SP3 with XPE, but the FBWF dont work. I like to protect the Stick against physically writes (virus infections).
Maybe it would help if the Stick can be formatet as CDFS. But i can not find a program which can format a USB-Stick with CDFS. Has someone a idea?
jaclaz
QUOTE (knoks @ Jun 13 2011, 01:32 AM) *
Hi,
i build a bootable USB-Stick based on XP-Prof SP3 with XPE, but the FBWF dont work. I like to protect the Stick against physically writes (virus infections).
Maybe it would help if the Stick can be formatet as CDFS. But i can not find a program which can format a USB-Stick with CDFS. Has someone a idea?

We have plenty of ideas. smiling9.gif

You CANNOT "format" a floppy-like or hd-like device as CDFS.

You can create a PE .iso (read only file residing on a FAT/NTFS filesystem) and boot it allright.

Or (it depends on the controller of the stick) create a CD-like device on it, something very similar (if not identical) to U3 devices. (though this approach is long, risky and troublesome).


jaclaz
knoks
I have tryed to create a NTFS USB-Stick and set the attribute for all files to read only. But the read only attribute effects also the FBWF. I like to use FBWF to write on the Stick but after a reboot the Stick should be in its original state. I also tryed to copy a CD .iso with the dd.exe tool to the Stick. But the Stick dont boot.
Is there a description on building a U3 like Stick?
jaclaz
As said it depends on the actual stick (and to the controller inside it), AND if we can find the suitable "Mass Production Tool" for the specific chip.
An example is given here for the UT163/165:
http://www.msfn.org/board/topic/125138-ins...165-usb-sticks/

Run Chipgenius:
http://reboot.pro/4661/
on your stick and let's see what it finds.


Any reason why not using a "normal" RAMDISK based PE?

jaclaz
Ed_P
QUOTE (knoks @ Jun 13 2011, 09:13 AM) *
I also tryed to copy a CD .iso with the dd.exe tool to the Stick. But the Stick dont boot.

You need to do more than copy the ISO to the stick. First you must make the stick bootable, then add GRUB4DOS to it and possibly a utility called firadisk.gz. Then add the ISO to the stick. Then boot the stick, invoke GRUB4DOS and select the ISO to boot.

This thread should help: http://www.911cd.net/forums//index.php?sho...mp;#entry164416

And this one: http://www.911cd.net/forums//index.php?showtopic=20089
cdob
QUOTE (knoks @ Jun 12 2011, 11:32 PM) *
i build a bootable USB-Stick based on XP-Prof SP3 with XPE, but the FBWF dont work. I like to protect the Stick against physically writes

FBWF allows writing at read only media. However FBWF dosn't prohibit writing. Works as designed.

Read: How To Make A Usb Boot Flash Stick Writeprotected
http://www.911cd.net/forums//index.php?showtopic=19422
knoks
@jaclaz
Here is the Chip Genius output:
Click to view attachment

@Ed_P
For a normal Stick i use the "Bootable USB-Drive Utility v1.6.3" by fuwi.
The copy with dd.exe was only a test to get a CDFS formatted Stick which fails.

@cdob
Thanks for the link. it seems that is what i serched for.
QUOTE
FBWF allows writing at read only media. However FBWF dosn't prohibit writing. Works as designed.

One can use FBWF also on a normal HD. In that case FBWF works as a protection from physical writes on that HD. But this dont work on a Stick.

@All
I have still another additional question:
I use the FBWFAUTO2 Plugin which is based on FBWF version 2.0.965.0. In this version the maximum FBWF threshold is 128 MB. The newest FBWF from Microsoft is version 2.0.1200.0 and allow 1GB threshold. Is there a new plugin for this version?
jaclaz
The good news are that the chip has this provision. smile.gif
More good news thumbsup.gif are that there are several versions of the utility/Mass production tools .
http://flashboot.ru/index.php?name=Files&a...p=cat&id=10
The bad news sad.gif are that they are of the "complex" type, and though in some of the available files there are "instructions" they are not very "easy"/"intuitive" ph34r.gif

cheers.gif
jaclaz
oscar
QUOTE (knoks @ Jun 13 2011, 02:46 PM) *
@All
I have still another additional question:
I use the FBWFAUTO2 Plugin which is based on FBWF version 2.0.965.0. In this version the maximum FBWF threshold is 128 MB. The newest FBWF from Microsoft is version 2.0.1200.0 and allow 1GB threshold. Is there a new plugin for this version?


No need for a new plugin if files have the same name.
What I know is that the threshold for any version is 16 to 1024 MB.
The threshold may be created of any size till 1024 MB but it is unusable after about 120 MB.


knoks
@cdob
The write protect doesn't work for me within a PE-Stick (in HD-installation it works). I made the registry entry:
0x4, "ControlSet001\Control\StorageDevicePolicies","WriteProtect", 0x00000001
but there is no effect. Any ideas?

@jaclaz
I think that the following tool can make a cdfs-Partition on a Stick:
http://flashboot.ru/index.php?name=Files&a...ile&lid=299
But i can't download the tool because the captcha is always wrong. Maybe its because i have no cyrillic keyboard.
Ed_P
FWIW This is the FBWF plugin that I use. http://wolfware.limewebs.com/bpe-plugins/fbwf.htm
knoks
The write protection suggested by cdob work now. It was my mistake. I put the registry entry under [Software.AdReg].
But i get a error message from XPElogon: "Registry file exists but is not writable". Furthermore a write to the Stick stops with the message media has not enough space although the FBWF has still 50MB free space.
I tested also Oskars Plugin, with the same result.

My plugin look as follows:
CODE
[Version]
Signature="$Windows NT$"

[PEBuilder]
Name="SYS: FBWFAuto2"
Enable=0

[SourceDisksFiles]
files\fbwflib.dll=2,,1
files\fbwf.sys=4,,1
files\fbwfdll.dll=2,,1
files\fbwfmgr.exe=1,,1
files\fltmgr.inf=20
files\fltmgr.sys=4
files\fltlib.dll=2
files\fltmc.exe=2
files\fbwfauto2.exe=2,fbwfauto.exe,1

[Software.AddReg]
0x1,"Microsoft\Windows\CurrentVersion\RunOnceEx\800","800","||xpeinit.exe -f -m FBWFAutoSizer %Systemroot%\system32\fbwfauto.exe 5" ;;;;;; 20 means 20% of total memory

[SetupReg.AddReg]
0x1,"ControlSet001\Services\fbwf","DisplayName","fbwf"
0x2,"ControlSet001\Services\fbwf","ImagePath","system32\drivers\fbwf.sys"
0x1,"ControlSet001\Services\fbwf","Description","fbwf driver"
0x4,"ControlSet001\Services\fbwf","ErrorControl",0x1
0x4,"ControlSet001\Services\fbwf","Start",0x0
0x4,"ControlSet001\Services\fbwf","Type",0x2
0x7,"ControlSet001\Services\fbwf","DependOnService","fltmgr"
0x1,"ControlSet001\Services\fbwf\Instances","DefaultInstance","Fbwf Instance"
0x1,"ControlSet001\Services\fbwf\Instances\Fbwf Instance","Altitude","226000"
0x4,"ControlSet001\Services\fbwf\Instances\Fbwf Instance","Flags",0x0
0x4,"ControlSet001\Services\FltMgr","Type",0x2
0x4,"ControlSet001\Services\FltMgr","Start",0x3
0x4,"ControlSet001\Services\FltMgr","ErrorControl",0x1
0x2,"ControlSet001\Services\FltMgr","ImagePath","system32\drivers\fltmgr.sys"
0x1,"ControlSet001\Services\FltMgr","DisplayName","FltMgr"
0x1,"ControlSet001\Services\FltMgr","Description","File System Filter Manager Driver"
0x4,"ControlSet001\Services\FltMgr","AttachWhenLoaded",0x0
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR","NextInstance",0x1
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Service","FltMgr"
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Legacy",0x1
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","ConfigFlags",0x0
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Class","LegacyDriver"
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","DeviceDesc","FltMgr"
0x4,"ControlSet001\Services\FBWF","CacheType", 0x2

[AddLine]
"txtsetup.sif", "BusExtenders.Load","fltmgr=fltmgr.sys"
"txtsetup.sif", "files.fbwf",     "fbwf.sys,4"
"txtsetup.sif", "files.fbwf",     "fbwflib.dll,2"
"txtsetup.sif", "files.fltmgr",   "fltmgr.sys,4"
"txtsetup.sif", "files.fltmgr",   "fltlib.dll,2"



It seems the texsetup entrys are not necessarily. Can someone confirm that?
nuMe
QUOTE (knoks @ Jun 15 2011, 01:44 PM) *
It seems the texsetup entrys are not necessarily. Can someone confirm that?

Have you compared the file with the one Ed_P linked to?
oscar
QUOTE (knoks @ Jun 15 2011, 02:44 PM) *
It seems the texsetup entrys are not necessarily. Can someone confirm that?

No, they are not necessary.


I have written a new version of fbwfauto.exe fbwf loader.
Usage:
fbwfauto5.exe /?
fbwfauto5.exe (without parameters, default 15% of total memory and 128MB max. size)
fbwfauto5.exe 20 (20% and 1024 max. size)
fbwfauto5.exe 25 256 (25% and 256 max. size)

fbwfauto5verbose.exe has informative splash windows.

download link:
http://www.mediafire.com/?ae05amysp0ugkpc




Plugin:
QUOTE
; pebuilder plugin
; fbwfauto.inf
; oscar 15/june/2011


[Version]
Signature= "$Windows NT$"

[PEBuilder]
Name="fbwfauto"
Enable=1


[SourceDisksFiles]
files\fbwflib.dll=2,,1
files\fbwf.sys=4,,1
files\fbwfdll.dll=2,,1
files\fbwfmgr.exe=1,,1

files\fbwfauto5.exe=2,fbwfauto.exe,1

[Software.AddReg]

;disable driver signing and *.pnf file creation, turn off the INF verifications
;INFCACHE.1 verification is active still
0x4, "Microsoft\Windows\CurrentVersion\Setup", "MinimizeFootprint", 0x1

;loading and setting % of total memory fbwf cache size and maximun size
0x1,"Microsoft\Windows\CurrentVersion\RunOnceEx\100","100","|| xpeinit.exe -f -m FBWFAutoSizer %Systemroot%\system32\fbwfauto.exe 20 128" ;;; 20% 128 MB max., without parameters the default is 15% and 128



[SetupReg.AddReg]

; 0x1 = "dynamic"
; 0x2 = "dynamic compressed"
; 0x3 = "pre-allocated"

0x4,"ControlSet001\Services\FBWF","CacheType", 0x3
0x1,"ControlSet001\Services\FBWF","DisplayName","fbwf"
0x1,"ControlSet001\Services\FBWF","Group","FSFilter System Recovery"
0x2,"ControlSet001\Services\FBWF","ImagePath","system32\DRIVERS\fbwf.sys"
0x1,"ControlSet001\Services\FBWF","Description","File Based Write Filter Driver"
0x4,"ControlSet001\Services\FBWF","ErrorControl", 0x1
0x4,"ControlSet001\Services\FBWF","Start", 0x0
0x4,"ControlSet001\Services\FBWF","Tag", 0x5
0x4,"ControlSet001\Services\FBWF","Type", 0x2
0x7,"ControlSet001\Services\FBWF","DependOnService","fltmgr"
0x1,"ControlSet001\Services\FBWF\Instances","DefaultInstance","Fbwf Instance"
0x1,"ControlSet001\Services\FBWF\Instances\Fbwf Instance","Altitude","226000"
0x4,"ControlSet001\Services\FBWF\Instances\Fbwf Instance","Flags", 0x0
0x4,"ControlSet001\Services\FltMgr","AttachWhenLoaded", 0x0
0x1,"ControlSet001\Services\FltMgr","DisplayName","FltMgr"
0x1,"ControlSet001\Services\FltMgr","Group","FSFilter Infrastructure"
0x2,"ControlSet001\Services\FltMgr","ImagePath","system32\drivers\fltmgr.sys"
0x1,"ControlSet001\Services\FltMgr","Description","File System Filter Manager Driver"
0x4,"ControlSet001\Services\FltMgr","ErrorControl", 0x3
0x4,"ControlSet001\Services\FltMgr","Start", 0x0
0x4,"ControlSet001\Services\FltMgr","Tag", 0x1
0x4,"ControlSet001\Services\FltMgr","Type", 0x2
0x1,"ControlSet001\Services\FltMgr\Enum","0","Root\LEGACY_FLTMGR\0000"
0x4,"ControlSet001\Services\FltMgr\Enum","Count", 0x1
0x4,"ControlSet001\Services\FltMgr\Enum","NextInstance", 0x1
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR","NextInstance", 0x1
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Service","FltMgr"
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Legacy", 0x1
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","ConfigFlags", 0x0
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Class","LegacyDriver"
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","DeviceDesc","FltMgr"

knoks
@Oskar
I use the fbwf files version 2.0.965.0. I hope that your fbwfauto5.exe is compatible to this files.
The error message from XPElogon is still present. This is because XPELogon runs before the start of fbwf. I think i will disable this message within the source code of XPELogin.
The Problem with the wrong free space of the fbwf comes because i used "dynamic compressed" as the CacheType.

I have also tested the verson 2.0.1200.0 of fbwf. But when i use the 2.0.1200.0 files, the system crachs with a bluescreen stop: 0x00000044

Furthermore i could download the program: http://flashboot.ru/index.php?name=Files&a...ile&lid=299
The captcha accept only small letters. With this tool i can make the stick write protected and dont need to protect all usb devices.

Thanks to all
jaclaz
just for the record, cross-linking with this:
http://reboot.pro/13899/

jaclaz
knoks
To prevent The error message from XPElogon while using a write protected usb-stick one can use the -x option for XPELogon:
0x1,"Setup","CmdLine","XPELogon.exe -r -x"
cdob
@knoks
Can you try "USB Write Protect" at your hardware.
Application seems to trigger a firmware setting
A general utility/Mass production tool setting?

QUOTE (al_jo)
is working just fine here
http://reboot.pro/13899/page__view__findpost__p__131131

USB Write Protect by Naresh Manandhar. Namaste Bai.
http://www.nareshmdr.com.np/index.php?pg=m...&soft=usbwp

Does work here at a
QUOTE
PnP Device ID: VID = 0C76 PID = 0005
Chip Vendor: SSS
Chip Part-Number: SSS6677/SSS6690
knoks
@cdob
USBWriteProtect.exe work with my two Sticks:

PnP Device ID: VID = 090C PID = 1000
Chip Vendor: SMI
Chip Part-Number: SM321~SM325

PnP Device ID: VID = 14CD PID = 8123
Chip Vendor: SuperTop
Chip Part-Number: MA8123

UFDisk Utilities can do more (Password, CDFS-Partitions) but only for the first Stick.

cdob
QUOTE (knoks @ Jun 18 2011, 04:36 PM) *
USBWriteProtect.exe work with my two Sticks:

At second glance USBWriteProtect.exe set StorageDevicePolicies\WriteProtect only.
Refers to current running OS only. Dosn't change setting for offline BartPE
That's not a mass production tool.

QUOTE
UFDisk Utilities can do more (Password, CDFS-Partitions) but only for the first Stick.

Yes, a mass production tool can do this.
jaclaz
QUOTE (cdob @ Jun 18 2011, 07:13 PM) *
At second glance USBWriteProtect.exe set StorageDevicePolicies\WriteProtect only.

Yes, there are quite a bunch of similar tools, using that registry setting:
http://www.911cd.net/forums//index.php?showtopic=19422

More similar ones:
http://www.irongeek.com/i.php?page=securit...b-write-blocker
http://www.m2cfg.com/downloads.htm
http://www.gaijin.at/dlusbwp.php
http://www.netwrix.com/usb_blocker_freeware.html
http://dsionline.biz/downloads/?did=9


there is also another "trick":
http://www.911cd.net/forums//index.php?showtopic=19118
http://www.joeware.net/freetools/tools/writeprot/index.htm

And this thingy here (which AFAICR is "news"):
http://kashu-sd.co.jp/en/products/usbwpservice.html
a dedicated service (rigorously UNtested by me)

cheers.gif
Wonko
knoks
A new problem occured:
The sysinternals "junction.exe" program do not work on a write protected USB-Stick. FBWF is started bevor the execution of junction.exe.
Has someone a junction.exe which works on a write protected stick?
shahril
Hello guys...im being called to share something, sweatingbullets.gif how to make your USB Stick (flashdrive) with XPE and plus,it is write protected...

1st. I didn't use FAT,or FAT32 filesystem on my usb stick,instead im using NTFS filesystem..(flashdrive must be 2gb or 4gb)
2nd. After copying all XPE file into on my flash drive.im started locking the flashdrive with CALCS.EXE is MICROSOFT product please find it over google closedeyes.gif
3rd. The file CACLS.EXE MUST BE ON THE ROOT OT THE FLASH DRIVE.and make a batch file with this :

CODE
@ECHO OFF
ECHO PLEASE ENTER PORTABLE HD,OR THUMB DRIVE TO MAKE IT BOOTABLE PARADOX XPE
SET /P TARGET=PLEASE ENTER YOUR DRIVE(INCLUDE SEMICOLON) :
CLS
CACLS "%TARGET%" /E /T /R Users
CACLS "%TARGET%" /E /T /R Everyone
CACLS "%TARGET%" /E /T /R SYSTEM
CACLS "%TARGET%" /E /T /R Everyone
CACLS "%TARGET%" /E /T /P Administrators:R
CACLS "%TARGET%" /E /T /P User:R


and save this file as PROTECT.CMD ON THE ROOT OF FLASH DRIVE.

4th. Execute the Protect.cmd and key in your flash drive "DriveLetter + semicolon" example = i:
5th. Please wait until the process is finish(the cmd is gone)..and here we go,all the file on flash drive CAN'T BE DELETED,MOVE AND RENAME...

p/s: to acess the flashdrive (XPE) on Windows 7 or vista with this lock tehnique.please disable the UAC to acess the flashdrive.

if any problem occur,the flash drive can be formatted.im already used if for a year and it's really awesome,also sorry for my broken english..wish Good Luck.
Ed_P
Thank you shahril, an interesting approach.

How do you change a file locked this way? Why don't I see the BartPE folders I326/MININT and PROGRAMS locked?

BTW CACLS is in the Windows system folder so it doesn't need to be copied to the USB drive for the CMD script to run.
shahril
Thank you for the reply Ed_P.

Well actually i'm using the "folder permission" concept to make your flashdrive look like it is "locked"..
and for information,i'm already tested on windows xp,vista,7 also on winxpe

about CACLS.EXE,Well i'm actually mention it to make it clear and simple..BTW you can modify it by %systemroot%\system32\CACLS.exe on the batch file celebrate14.gif also ,im using windows xp to make xpe cd by using bartpe.

for information about folder permission please go this website : http://www.ntfs.com/ntfs-permissions-file-advanced.htm

sorry for my bad english unsure.gif
Ed_P
QUOTE (shahril @ Jul 23 2011, 09:49 AM) *
BTW you can modify it by %systemroot%\system32\CACLS.exe on the batch file celebrate14.gif

Actually, since CACLS.exe is in all Windows host systems, the batch file doesn't need to be modified. It will work fine as is, you just don't need to put the CACLS.exe file on the USB drive.
shahril
hahaha LOL! i didn't know it hysterical.gif shame on me.thanks for the information ... hahaha
knoks
Good News!

I tested the CDFS funktion of the tool: SMI_UFDiskUtilities.exe
With this tool it is easy to build a BartPE CDFS USB-Stick. Only create a CDFS partition on the stick and define your BartPE .iso file. That's all. The tool work only on SMI based USB-Sticks. There must be a minimum non CDFS partition on the stick. The stick is write protected, FBWF works and Kaspersky AV updates are possible.
[img]
http://www.911cd.net/forums//index.php?act...ost&id=1991
[/img]
[img]
http://www.911cd.net/forums//index.php?act...ost&id=1990
[/img]
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2013 Invision Power Services, Inc.