Saturday, 22 March 2025

Legacy Boot with persistence of Kaspersky Rescue Disk ISO 2025 using E2B (grub4dos)

Here is how to get the KRD2025 ISO to legacy boot on E2B with user file persistence and with update file persistence.

1. Download the krd.iso file and save it to \_ISO\LINUX folder as KRD2025.iso.

2. Download the Ventoy pre-made 'backend' persistence files contained within the images.zip and extract ONE of the following persistence files as a .dat file using 7zip. I tried the 2gb one.

  •  persistence_ext4_1GB_persistence.dat.7z
  •  persistence_ext4_2GB_persistence.dat.7z
  •  persistence_ext4_4GB_persistence.dat.7z
The file \_ISO\docs\Linux Persistence Files\blank_persistent_image.dat_files.zip on the E2B drive is similar and can be used and extracted instead of downloading it.

Add the .dat file (you must extract the .dat file from within the 7z file so the filename ends in .dat) to the root of your E2B drive (partition 1 - first partition).

Rename the .dat file to \krd2025-rw   (no file extension). The file will contain a persistence.conf file inside it which is required for Debian-based persistence files.

3. Run \'Make this drive contiguous.cmd' to ensure both files are contiguous

4. Create a new text file at \_ISO\LINUX\KRD2025.mnu containing the following text:

iftitle [if exist $HOME$/KRD2025.iso] Kaspersky Rescue ISO 2025
set ISO=$HOME$/KRD2025.iso
set PER=/krd2025-rw
if "%E2BDEV%"=="" set E2BDEV=hd0 && pause E2BDEV forced to hd0!
if exist CD echo WARNING: Cannot use partnew command! && pause && configfile (bd)/menu.lst
#enable parttype output
debug 1
# make empty table entry in 3rd position in ptn table
parttype (%E2BDEV%,2) | set check=
debug off
set check=%check:~-5,4%
if "%check%"=="0x00" partnew (%E2BDEV%,2) 0 0 0
if not "%check%"=="0x00" echo WARNING: PTN TABLE 3 IS ALREADY IN USE - PERSISTENCE MAY NOT WORK! && pause
debug 1
if not exist %PER% echo WARNING: %PER% persistence file not found! && pause
errorcheck off
if "%check%"=="0x00" partnew (%E2BDEV%,2) 0x0 %PER%
errorcheck on
#map ptn 4 to ISO
partnew (%E2BDEV%,3) 0x0 %ISO%
map %ISO% (0xff)
map --hook
root (0xff)
#find boot files inside ISO
set vml=/live/vmlinuz && set init=/live/initrd.img
kernel %vml% boot=live components trace dontencrypt persistence noeject
initrd %init%



Note: The 'noeject' parameter stops the shutdown process from asking you to press ENTER before it will fully shutdown.

5. Now legacy\BIOS boot to E2B and the LINUX menu and select the 'Kaspersky Rescue ISO 2025' menu entry.




6. You should be able to create a new folder on the Desktop ('STEVE' in this example) and it will still be there after a reboot if persistence is working.

Also, the virus update files should download to the E2B drive (to a \KRD2024_Data folder) and be kept for future boots.

Tip: Make sure that folder is not present on any other drive because if a folder already exists on another drive then that folder may be updated instead of the one on the usb drive 




NOTE:  If strange things happen (e.g. the Kaspersky Rescue Tool will not run) or your persistent  files and folders disappear, it usually means that your persistence file (\krd2025-rw) has become corrupt. In this case you will have to delete the one on the E2B USB drive and create another persistence file in the same way as you did before (step 2).

ALWAYS SHUTDOWN CAREFULLY TO AVOID PERSISTENT STORE CORRUPTION!

I recommend you keep a backup of the krd2025-rw file if you have files on it which you need. Then if your persistence file does become corrupt, you can replace it with your backup file. You have been warned!

Since the KRD2025.ISO file is also in the LINUX folder, you can still boot to that without persistence. If you wish, you can change the 'iftitle' line menu text to include the word PERSISTENT...

iftitle [if exist $HOME$/KRD2025.iso] Kaspersky Rescue ISO 2025 (PERSISTENT)

No comments:

Post a Comment