Saturday, 5 October 2013

Adding ESET SysRescue ISO to Easy2Boot

Kart3 on reboot.pro recently asked how to boot the ESET System Rescue ISO on an Easy2Boot drive as it BSOD's.

Note: eset-sysrescue.1.0.9.0.enu.iso will 'just work' as an ISO file on E2B as it is based on linux!

On investigation, I found that the ISO contained a WinPE 'flat file' boot folder structure. So I could have suggested that he extracted all the files to the E2B USB drive and then just used a grub4dos entry to chainload bootmgr after using EasyBCD to change the \boot\BCD file so it boots from the USB drive. But this would mean we could only have one 'windows' flat-file installation on the E2B USB drive. It is far more preferable to boot from an ISO...

Vista/7/8 WinPE (not XP WinPE) usually boots in one of two ways (see here for more details):

Flat File Boot - This is the same way as a normal Windows Vista/7/8 system boots. There is the BCD which is loaded by bootmgr and the BCD points to C:\Windows\System32\Winload.exe and a source Drive of C: . All the files and folders (e.g. \Windows, \Program Files, \Users, \ProgramData, \Boot) are present.

Ramdisk Boot - This is typical of the way a Win7 Install ISO boots and many WinPE implementations. There is a BCD on the DVD which is loaded by bootmgr and the BCD points to \windows\system32\boot\winload.exe and the boot device is [boot]\sources\boot.wim. Notice that there is no drive letter specified in the BCD, the 'source' device is the boot device and the 'id' is just {default} and not a specific drive letter or partition. This means the BCD can be used with any boot device (there are also {7619dcc8-fafe-11d9-b411-000476eba25f} 'ramdisk' entries in the BCD).

BCD entry for a ramdisk version of WinPE:
Windows Boot Manager
--------------------
identifier              {bootmgr}
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {default}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {default}
device                  ramdisk=[boot]\sources\boot.wim,{7619dcc8-fafe-11d9-b411-000476eba25f}
path                    \windows\system32\boot\winload.exe
description             Windows Setup
locale                  en-US
inherit                 {bootloadersettings}
osdevice                ramdisk=[boot]\sources\boot.wim,{7619dcc8-fafe-11d9-b411-000476eba25f}
systemroot              \windows
detecthal               Yes
winpe                   Yes
ems                     Yes

The OS files are actually in \sources\boot.wim. A ramdisk is made by bootmgr and the contents of the boot.wim is copied into the ramdisk. The rest of the OS is then booted from the files on the ramdisk. This makes for faster operation.

'Flat File WinPE' is typically used in situations where they is less than 512MB of memory in the computer. 'Ramdisk WinPE' requires a ramdisk to be made in memory and the contents of the boot.wim file are expanded into the ramdisk. Consequently we need  enough space for this and free memory for the OS to use.

So one way to get the System Rescue ISO to work would be to convert it to a ramdisk ISO. These can be booted directly from an ISO file.

After a little effort, I wrote Tutorial 115 which describes how I went about it. The steps are basically:

1. Take an existing working 'ramdisk' based WinPE ISO
2. Make a new boot.wim from the ESET SysRescue ISO files
3. Replace the boot.wim in the WinPE ISO with the SysRescue boot.wim file.

However, not everyone will have a Vista/7/8 WinPE ISO laying around, so I wrote the tutorial so that it could be adapted by most people.

I decided not to provide instructions on how to create a ramdisk-bootable BCD from scratch as this relied on using bcdedit which could be dangerous (you could find that your system no longer booted the next day due to a corrupt BCD) and was also complicated (though I could have scripted it to make it easier). It was easiest just to 'borrow' the BCD from an existing WinPE ISO.
I wanted to avoid having to download and install the WAIK too, so I have shown how to download just the parts of the WAIK needed, by using JFX's GetWaikTools utility (Tutorial 83).

The end result is an ISO that we can now add to Easy2Boot (or any multiboot solution).

Since some other 'rescue' ISOs use WinPE Flat File booting (so they can be used on low-ram systems), this conversion process may prove useful for them too!