Updated PEStartup download

I have added a new PEStartup download to the RMPrepUSB tutorial #143.

Gandalf PE ISO with PEStartup_Papps files added to E2B USB drive (you can change the default wallpaper).

WinBuilder-based ISOs such as Gandalf's WinPEs will automatically be configured if you simply add the files to your E2B USB drive.

How to add Ubuntu\LinuxMint to E2B with MBR+UEFI persistence (and an unfixed bug in Ubuntu!)

Early versions of Ubuntu (pre-v14) and Ubuntu-based linuxmint distros (pre-v17.03) could be set up with persistence with no problem.

As long as you added the 'persistent' boot parameter, the kernel script would look for either:

1) a 'casper-rw' file (formatted internally as ext2/3/4)

    - OR -

2) a FAT or ext partition with a volume label of 'casper-rw' which has been formatted as ext2/3/4.

Ubuntu bug!

However, Ubuntu 14.04 and linuxmint 17.03 and (all?) later versions have a bug in the casper boot script which means that they may fail to boot when a casper-rw partition is present and if that partition is located after the filesystem partition in the partition table. This bug does not apply if you booted from an ISO file (only from a 'flat-file' partition), so the .mnu files used by E2B which boot from ISOs are not affected by this bug.

Bug report for Ubuntu here.

So there is no problem if you use a casper-rw file (except it must be on the same partition and it must be a FAT32 or ext partition). So you can create a very large (>4GB) ext3 file on the E2B NTFS USB drive and use a .mnu file to get persistence - but this only works in MBR\Legacy mode.

For UEFI-booting, we need to create a FAT32 .imgPTN file. However, this issue does affect E2B when using .imgPTN partition images...

E2B v1.96e available (bugfix)

There was a bug in v1.95 which means that (*for some reason) the .isofira01 file extension (as used for Strelec ISOs) does not seem to work.

v1.96e fixes this.

* The reason is that firadisk looks for a 'ramdisk' that is below 1MB is size, so using a larger ramdisk did not work!

E2B v1.96d now available

Just a small 'enhancement'.

In this version, if you have created a matching .txt file for your payload file, then E2B will not suggest an alternative file extension (unless SCROLL LOCK is on) and will boot straight to the payload file with no delay.

e.g.
\_ISO\LINUX\Ubuntux64.iso
\_ISO\LINUX\Ubuntux64.txt

I have reasoned that if you have taken the trouble to make a .txt file, then you have already tested it and it works and so has the correct file extension.

This message and delay is now suppressed if a .matching txt file exists.

If you don't like this new feature, please let me know and I will remove it.

E2B 1.96d is available from Alternate Downloads Areas as usual (see side panel on this page).

Modify any WinPE using PEStartup

Following on from my previous blog post on PEStartup, I have written Tutorial #143 on how to use PEStartup to configure any ready-made WinPE OS such as Strelec, Hirens, DLC, Dium and Gandalf WinPEs.

In fact, standard Win10PESE WinBuilder builds including the latest Gandalf Redstone 2 WinPE and Bob Omb's PEs 'just work' and will automatically run PEStartup when they boot, if you follow the Tutorial (you just extract files from a .zip file onto your E2B drive!).

If the WinPE does not have the correct plugin already, you just need to double-click on the \TheOven_Startup.cmd script to run PEStartup and configure your WinPE Desktop.
Many thanks again to Tứ Nguyễn for his PEStartup utility.

Add WinPE Reboot and Shutdown Desktop Shortcuts

Configure PEStartup to add Desktop shortcuts using wpeutil.exe

Add lightweight WinPE versions to E2B that you can easily configure yourself!

It is normally very difficult to tailor a WinPE project to your own requirements unless you rebuild the entire OS each time.

However, there is a way to make changes to your WinPE OS and have those changes remembered on reboots. For instance, you can specify your own wallpaper and Desktop shortcuts.

32-bit XP and 32-bit and 64-bit Win 10 PE builds are available.

See also the more recent blog post here for use with any WinPE.

Gandalf’s Win10PE x64 Redstone 2 build 15063 version 10-01-2017 is now available

Download from here. It is based on WinBuilder and ChrisR's Win10PESE project.

To add to E2B, just copy the .iso file to a menu folder (e.g. \_ISO\WINPE) and run \MAKE_THIS_DRIVE_CONTIGUOUS.exe to make it contiguous.

To suppress the tips and extension suggestions made by the QRUN.g4b script when you run it, just add the letter Q or q to the end of the filename. e.g.
Gandalf'sWin10PEx64Redstone2_10-01-2017q.iso

Do not uses spaces in the filename. If you want to change the menu entry and have spaces in the filename, use a .txt file - e.g. Gandalf'sWin10PEx64Redstone2_10-01-2017.txt

To change keyboard locale press CTRL+TAB.

Tip: if you add PEStartup to your USB drive and PortableApps.com (Start.exe) to the Desktop as Startup options. you can use the Shutdown/reboot button in the PortableApps GUI to shutdown/reboot (as the Start Menu Shutdown\Reboot does not work). You can also add lots of PortableApps apps easily too. Gandalf Redstone 2 will automatically run PEStartup 20 seconds after it loads the Desktop.

E2B v1.96c available

Just a few small changes (no bug fixes)

• QRUN.g4b now checks for fixed type of .VHD\.VHDX file - dynamic VHDs won't boot.
• Added help text for installing from puppy ISOs (.isopup)
• Improved GIFtoIMA.cmd script to calculate size of .IMA file required and now will optionally add the new code lines to your MyE2B.cfg file for you.
• New default wallpaper for E2B
• New SWITCH_E2B.exe version 1.0.17 with improved file re-ordering for dual image payloads
  (see Method 4). 
• Added extra Win7/8/10 disk 1 sample XML unattended install files for use with VMs where disk 1 is the target HDD instead of disk 0.  See here for more info.

Download from Alternate Download Sites as usual.

How to use E2B with Virtual Box to test unattended Windows installs

In a chat session with 'Nathan' today, he explained how he uses VBox to install Windows to a Virtual Machine using ISO files on an E2B USB drive.

Testing E2B's 'Install Windows from ISO' method in a Virtual Machine is problematic because Windows needs to detect a Removable drive (e.g. CD\DVD or USB flash drive) in the system - Setup will only pick up the \AutoUnattend.XML (or \Unattend.XML) file from removable drives.

However, under a VM, a USB drive is 'mapped' as a virtual (IDE\SATA etc.) hard disk when using a .vmdk file (so the drive is not seen as a Removable drive once WinPE\Windows Setup runs).

This means the Product Key and other settings in the XML file are not used by Windows Setup when testing in a VM.

We can get around this by booting in two stages and by adding a USB WinHelper drive:

Adding MDT ISOs to Easy2Boot (UEFI+MBR)

Boot from a .imgPTN23 file

You can 'switch-in' a partition image which holds the MDT boot files and Deployment folder.

For MBR-booting, the simplest way to add an ISO made by the Microsoft Deployment Toolkit, is to convert the MDT ISO file to a .imgPTN file using the E2B MPI Tool Kit. Just Drag-and-Drop the MDT ISO file (or MDT USB drive letter) onto the MPI_FAT32 Windows Desktop shortcut.

Rename the file to have a .imgPTN23 file extension.

MDT Setup

This should work fine, as long as all the files inside the ISO are less than 4GB in size, and then you can MBR and UEFI-boot from the .imgPTN file. Later versions of MDT support the creation of split wims, so this will work even for MDT with large files.

If UEFI-booting and you have a large WIM file, you could try using the MPI_NTFS shortcut to create an NTFS .imgPTN23 file. Then you can UEFI boot to agFM on the 2nd FAT32 partition (E2B v2 only) and from agFM boot from the WIM file on the first partition or the \EFI\BOOT\BOOTX64.EFI file on the first partition.

Tip: Instead of using E2B, you could just copy all your ISOs to an IODD Mini #ad. You can still put E2B on it as well! The IODD Mini just looks like a USB DVD once the ISO is selected, so even Secure UEFI boot works.

Alternate method for MBR-booting

If you have files inside the ISO that are larger than 4GB, then use the MPI_NTFS shortcut instead. However, you will only be able to MBR-boot unless you first  UEFI64-boot to agFM (see above).

Below are instructions for direct booting from an MDT ISO (MBR-booting only) and another set of instructions for MBR+UEFI-booting by using two image files...

New Spanish\Espanol YouTube videos uploaded by 'Decomputo - Valledupar'

Many people make YouTube videos showing Easy2Boot, but here is one that shows multiple wallpapers, a modified language file and uses a different text font...

and another just on how to get started...

Add a slideshow to your E2B menu

I have made a quick PowerPoint presentation and converted it to an 'animated GIF' .IMA file for use with E2B. So you can now have PowerPoint slides on your E2B menu!

Try JondoFox Live CD for secure and anonymous browsing

The JonDo Live CD\ISO is now no longer under development but the 2016 version is still available for download.

You may find it easier to use from E2B than Tails, but it does not seem to support persistence or UEFI.

To see what other sites can learn about you when you simply view their site, click here and then click on Start Test.

JonDoFox Live ISO

To use the network (internet) - click the Network Manager icon at the bottom of the display (move mouse to bottom of screen).

To browse securely, you will need to follow the instruction here.

You can also install the JonDoFox browser onto your OS from here.

Add Kali Linux + persistence (UEFI+MBR) to E2B

There is already a .mnu file for booting to a Kali ISO file in MBR mode with persistence.
E2B v1.B4+ also supports the special .isopersistdebian file extension so no .mnu file is required.
There is also a blog tutorial for a full OS install of Kali onto E2B here.

Recommended method: See also the Kali with persistence sample agFM .cfg file in the \e2b folder on the 2nd agFM partition (see here).

How to install Puppy to an HDD using Easy2Boot

You can boot from a Puppy Linux ISO by giving the file a .isopup file extension.

In this way you can boot directly from the ISO to a 'LiveCD' version of Puppy and get to the Desktop.

But if you try to install Puppy to a hard disk, you will get an error because it cannot find the CDROM.

First, if you have a CD drive, ensure it is empty.

To fix this, use these commands in a terminal shell session before you start the Install process:

mkdir /cdrom
mount /dev/sdX4 /cdrom

where X is the letter for your E2B USB drive (in my case it was 'a' because I was using VBOX+VMUB).

The first command will probably fail if you have a CD-ROM drive fitted (make sure it's empty), but you can ignore the error. The second command should cause the USB partition to be mounted as a read-only device.

This mounts the ISO as the cdrom so it can be found by the installer. Do not create a Save file and do not copy the .sfs file from CDROM when requested on shutdown.

Once you have booted from the hard disk, you can create a save file on shutdown.

Create a Restore partition on your UEFI Windows 8\10 PC using CloneZilla (Version 5)

I have updated the Tutorial 142 and changed the functionality so that you can make unattended backups or restores from Windows (Check the .zip download says 'v.5' or later before downloading).

This allows the user to 'remote-in' using TeamViewer and restore a system from Windows (or make a new backup).

The image file IMG is always used.

When a Backup is made, the current IMG image will be erased.

You can also password protect the menu entries and protect any access to the grub2 console.

You can just have the wallpaper show but no menu (unless you press ESC or press a hotkey).

The Tutorial includes a way to change the default grub2 menu heading too (something you usually cannot do without recompiling grub2)!

Create a Restore partition on your UEFI Windows 8\10 PC using CloneZilla

Tutorial 89 on the RMPrepUSB.com website describes how you can add a local Restore image to your PC\Notebook hard disk so that you can take a backup or restore the Windows partition at boot time.

It uses Clonezilla and grub4dos and it is reasonably easy to set up.

However, that tutorial was for MBR\Legacy Windows systems.

Mike A asked me for a new CloneZilla-based Tutorial for UEFI-based Windows systems using GPT partitions.

Super Boot CD

JG pointed me to this large 4.8GB 'Hiren's type' ISO which includes 32-bit and 64-bit UEFI boot support as well as containing HBCD MiniXP, Strelec Mini-WinPE 10 and SVUIT Mini-WinPE7, memtest, Windows memory diagnostic, KonBoot, chntpwd, MHDD, Windows Recovery .wim files, some MAC apps and Windows AV apps and linux pmagic. It also uses rEFInd for UEFI boot menus.

You can boot it directly as an .ISO file (use E2B v1.95 and used a file name of SBCD 3.6.1.isolinux), although many menu entries (e.g. mini Windows) do not work correctly. So I converted it to a FAT32 .imgPTN file using the E2B MPI Tool Kit MPI_FAT32 Desktop shortcut. This seems to work well and allows UEFI-booting too.

Mini Win10 (Strelec)

The download link provided on the Facebook page seems very slow though, so you will have to be patient!

Note: The HBCDMenu and DLC1Menu shortcuts on the Mini Win7 Desktop do not work due to missing \DLC1 and \SVUIT folders in the SBCD ISO file.

E2B v1.96a Beta available

Just a couple of small changes (no bugfixes):

v1.96a

• QRUN.g4b now checks for dynamic/differencing VHDs - only fixed VHDs will boot.
• Improved GIFtoIMA.cmd script to calculate size of the .IMA file required.

VHDs can be Fixed, Dynamic or Differencing type. E2B can only directly boot the Fixed type of VHD or VHDX file. You can tell by the size which type it is - a 15GB Fixed VHD file will be 15GB in size, the other two types of VHD will usually be a lot less than the 'mounted' size. VHDs created by WinToUSB will work. VHDs created by DiskToVHD will not boot from E2B as they will be Dynamic VHDs.

I have improved the GIFtoIMA.cmd script so that it calculates the required size in KB of the .IMA file needed for animations on the E2B menu. Now you can just press ENTER to accept the suggested size.

Download v1.96a from Alternate Download Areas as usual.

Beware! -  here lies ye Kingdom of Geekland...

Cassini-Huygens (1997-2017)

To mark the end of this remarkable spacecraft, I have made two animations for your E2B menu, which I have taken from the wiki here. Cassini NASA/JET website here.

Cassini-huygens_animation.zip (jpg)

Titan_taken_by_cassini_animation.zip (.bmp)

E2B v1.95 release available

v1.95 Downloads are now available in Alternate Downloads Areas.

I will update the website in a few days.

OneDrive download area
Easy2Boot Download page
E2B Version History

E2B v1.95e available

Download E2B v1.95e from here.

Change History
v1.95a - Czech F1.cfg help added, bugfix for set NOHELPER=1 not working.
v1.95b - XP ISO install issue of 'Selected disk does not exist' fix added, '0K low memory' error fixed for some XP boot issues.
v1.95c - Increase menu memory from 0x50 sectors to 0xA0 sectors for bigger menus, fix bug when using 'set GRUB_USB=045' in MyE2B.cfg, Greek language folder added, Choose a preset wallpaper.mnu file added (also in PimpMyDrive), 0x50 changed to 0xA0 in many Sample mnu files and language files for very large menus.
v1.95d - New \grldr grub4dos 2017-08-28 (change in memory map handling - bugfix), increase size of FASTLOAD cache file for very large menus (bugfix).
v1.95e - Falcon4 sample menu file updated, grldr 2017-08-30, Sample_MyE2B.cfg file updated, small change to ENG English strings.txt file, BIOS beep code references added to \_ISO\docs\Download URLs folder.

I will release this as v1.95 soon. Please update your E2B drives and report if you spot a problem.

I have also added a few more 800x600 wallpapers to the Alternate Download - Themes Areas:

Add PassMark's MemTest86 v7.4 to E2B

The MemTest86 ISO will MBR-boot and run the old MemTest86 version v4.

Version 7.4 will only run if it is UEFI-booted.

However, if you make a .imgPTN file from the MemTest86.zip download, you can MBR boot to the CSM menu and then choose the Clover boot option. This will allow you to run v7.4 even on a non-UEFI system.

MemTest86 has signed UEFI boot files and so the .imgPTN file can UEFI-Secure Boot too.

I have created the latest version of this file (2018-03-29) for you.

Note: This is now included in E2B v1.A8 and later versions in the UTILITIES - Memory Test sub-menu.

Run DOS games from E2B

E2B contains a FreeDOS image in the DOS Menu which can boot to FreeDOS and allow you access to the NTFS files on the E2B drive. This allows you to run copy simple DOS programs to the NTFS E2B drive - boot to FreeDOS - and run them directly from the E2B drive (as drive C:).

However, the amount if free memory is limited in this environment due to the NTFS driver, etc.

Here is how to make your own DOS Games payload (.imgPTN file) for E2B:

E2B v1.95d Beta now available

E2B v1.95d has the latest version of grub4dos 0.4.6a 2017-08-28 (\grldr) (available in Alternate Download Areas). It also fixes a small bug with FASTLOAD when using very large menus.

This new version of grub4dos has major changes on the way grub4dos modifies and uses memory.

Please update to v1.95d and report any problems if you find them (go back to v1.95c to check that the problem is with 1.95d).

The changes in grub4dos fixes a previous bug which could cause XP to fail to boot and give a 0K low memory error (see bug report).

E2B popularity is growing!

When someone uses Make_E2B (exe or cmd) to make an E2B USB drive, the script will download LatestE2B.txt from my web server to tell the user if there is a newer version available. A recent hit count for that file shows that on average, Make_E2B is run 1,500 times a day!

The stats also show there are now over 15,000 downloads a day of E2B and E2B+DPMS (the downloads are used to update E2B drives or make an E2B drive using linux as well as make a new drive under Windows) - and that download count does not include downloads from the Alternate Download site.

E2B is free and I mainly rely on ad revenues (sorry about all the ads but feel free to click on them if they interest you) to pay the site fees and also to buy equipment (for instance, I have bought 2 notebooks on eBay recently to investigate and fix compatibility issues found by users). My aim is that E2B should work on as wide a range of different systems as possible.

You can support E2B by making a donation, I will reward you by sending you two URLs for the easy2boot.com and rmprepusb.com sites which use a tidier format and contain hardly any ads at all. For instance, the Forum page on the E2B site is in the alternate 'cleaner' format for easy2boot.com.

cheers
Steve

Easy2Boot v1.95c available

Additional changes from v1.95b are:

1. Increase menu memory from 0x50 sectors to 0xA0 sectors to cater for bigger menus
2. Fix bug when using 'set GRUB_USB=045' in MyE2B.cfg
3. Greek language folder added (but not Greek choice in 'make utility' because it is only Beta status)
4. Choose a preset wallpaper.mnu file added (also added by PimpMyDrive.cmd)

I added more payload files to my 'test' E2B USB flash drive which resulted in over 70 menu entries in the Main menu. I found then that the F10, F9 and F8 Main menu items, which were usually at the very bottom of the Main menu, had disappeared and pressing F8, F9 or F10 had no affect.

It turns out that I had exceeded the allotted amount of memory that E2B uses to hold all the menu items. v1.95c now has double the amount of memory - from 0x50 sectors of memory to 0xA0 sectors of memory (i.e. 40K to 80K). Since the grub4dos numbering system does not work well past menu entry #99, this should now be enough to allow 100 menu entries (0-99) in all menus!

Note that if you have used any sample .MNU files which still contain '(md)0x3000+0x50'  or  '(md)0xa000+0x50'  then you may still experience 'shortened' menus if your menu is very large.

To fix this, change all occurrences of these two strings to use 0xA0 instead of 0x50 (i.e. use (md)0x3000+0xA0 or (md)0xa000+0xA0).

P.S. Tip: If you first make the \menu.lst file hidden on your E2B drive, then when you run the Update_E2B_Drive.cmd option to update your E2B drive, it will automatically hide most of the other files that are in the root of the E2B drive for you too.

Let me know if you see any issues with v1.95c.

Easy2Boot v1.95b (with XP '0K low memory' error fix)

I have had a few reports of problems with XP Install Step 2 giving the following error:

"Windows NT has found only 0K of low memory. 512k of low memory is required to run Windows NT. You may need to upgrade your computer or run a configuration program provided by the manufacturer."

This has been traced to a compatibility issue between recent 2017 grub4dos versions and some chipsets. See here for a bug report.

E2B v1.95b should fix this issue.

Download E2B v1.95b from one of the Alternate Download Areas. Just click on the 'Update_E2B_Drive' button to update your E2B drive.

I have also had a report that some Gandalf WinPE ISOs do not boot and give a 'Not enough memory to create a RAM Disk' error. This only seems to be a problem on certain systems. These systems also fail in the same way when using Rufus to make a Gandalf bootable USB drive, so it seems to be a compatibility issue between the Gandalf WinPE files with a large boot.wim file and certain system BIOSes (i.e. not an E2B issue!). If you have any info on this issue, please let me know.

Beta version of Greek Language available for E2B

I have used Google Translate to make a Greek Language version here.

To test, extract the two files to your \_ISO folder on your E2B USB drive:

\_ISO\STRINGS.txt
\_ISO\F1.CFG

They will automatically be used by E2B. This is for test purposes only - any missing strings will be reported by E2B.

To use the files in non-test mode, make a \_ISO\e2b\grub\GREEK folder and place the 2 files in that folder. Then add a line to your \_ISO\MyE2B.cfg file as follows:

if "%LANG%"=="" set LANG=GREEK

If you have any corrections, please edit the files and send them to me (save as UTF-8 format using Notepad).

I will not add them to E2B until they have been properly vetted by a Greek-speaking techy (as it is all Greek to me!).

UK Porn

This post is not about USB drives or booting but it is about internet porn!

E2B v1.95a BETA available

Change History here
Download from the Alternate Download Areas as usual (see side panel of blog for link).
Don't forget to subscribe for latest E2B news.

Reduce the CPU load when using the E2B Menu

You may have noticed that when you boot to the E2B menu, your CPU fan speed may start to increase and get quite noisy. This can also occur when booting to the E2B menu under a Virtual Machine such as with Virtual Box.

The reason is that grub4dos is continually calling the BIOS to detect a menu key press from the user and so the CPU is running at full speed.

Most operating systems use an interrupt-driven approach. The CPU is in an idle state when not required, until the user presses a key and causes a CPU interrupt from the keyboard controller which then wakes up the CPU.

e.g. (in x86 code)...
sti           (enable interrupts)
hlt           (stop CPU until it gets an interrupt)

Grub4dos can also use such an interrupt-driven approach if you patch it...

In the \_ISO\Sample_MyE2B.cfg file you will see the lines:

# Use HLT instruction to reduce CPU cycles whilst waiting for keypress (stops CPU from getting too hot)
### write --bytes=1 0x8205 0x20 > nul

Simply uncomment the 2nd line by removing the three ### symbols and add it to your \_ISO\MyE2B.cfg file:

!BAT
# Use HLT instruction to reduce CPU cycles whilst waiting for keypress (stops CPU from getting too hot)
write --bytes=1 0x8205 0x20 > nul

As this patch may cause problems on some systems, it is not included by default in E2B. You may find it useful if you use E2B with a VM a lot.

You can remove or comment out the line to go back to the normal grub4dos behaviour if it causes you any problems (let me know if it does!).

Add i-life Windows OS re-installation payloads to E2B

i-life produce a range of laptops including the ZEDNotes.

It is possible to download the full OS re-installation files + firmware update software (e.g. ZEDNOTE 11.6.rar, 4.5GB) from the appropriate Support page for your particular i-life notebook...

E2B v1.94 full release is now available

v1.94 2017-07-21

• Bugfix for TXT_Maker.exe as iftitle caused a 'no title' in .txt file error. 
• Change_drive_Letter.cmd added to allow you to change 2nd partition drive letter on Removable Flash drive
• Sample mnu files for linux ext3 comment added
• .iso32 and .iso64 allowed in \_ISO\WINDOWS\xxxxx menu folders
• Latest grub4dos \grldr 2017-06-25
• Latest ImDisk driver
• Spanish kbd now addded if Spanish language selected
• Czech language (Beta) added

Available from Alternate Download Areas (will be added to E2B website in a few days).

E2B v1.94c BETA available

The main difference is that I have added a Czech language option.

However, the translations have not been checked by a Czech and so they are probably full of errors!

Czech language for E2B (Beta)

I have used Google Translate to make a very Beta version for the Czech language which you can download from here.  You can test it by simply copying the STRINGS.txt and F1.cfg files to your E2B USB drive's \_ISO folder.

The files are probably a bit of a wreck, so, if any Czech tech can check and make them up to spec (see what I did there?), then please send me a corrected version!

Info: How to make new language files E2B page here.

E2B v1.94b BETA available

Changes from release version 1.93A are:

• bugfix - if TXT_Maker.exe is used with iftitle, it caused a 'no title in .txt file' error.
• Change_drive_letter.cmd added to allow you to change 2nd partition drive letter on Removable Flash drive if using Windows 10 1703
• Sample mnu files for linux - 'use ext3' comment line added
• .iso32 and .iso64 now allowed in \_ISO\WINDOWS\xxxxx menu folders (except XP folder)
• latest grub4dos \grldr 2017-06-25
• latest ImDisk driver for loading Windows ISOs

Available from alternate download areas as usual.

'Kill switch\vaccine' for latest Petya\NotPetya ransomware found

A report on Bleeping Computer says that a way to prevent infection by the latest NotPetya ransomware is to create a read-only file at C:\Windows\perfc.

You can do this by downloading and running this file as Administrator.

I have no idea if it works, but if your organisation has un-updated/unpatched systems, this could be useful to prevent your disk from being encrypted.

As I suspected, virus developers will build in some sort of 'kill switch' to prevent their own systems from getting infected, as with WannaCry. I guess it's kinda difficult to write code and test it, only to find that the code has just encrypted all your source files and the decryption algorithm is not yet working! The Wannacry vaccine was coded to find a specific web server which meant it could be easily stopped by setting up a server of the correct name. The Petya developers obviously did not want to use the same mechanism, which was discovered and then used as a global 'kill switch', and so have used a local file instead to stop infection.

Installing 32-bit and 64-bit Windows ISOs with E2B

A user had Windows 10 32-bit and 64-bit ISO files in his \_ISO\WINDOWS\WIN10 folder.

We can make a .txt file for each .ISO file so that if the system CPU that we are booting from is a 32-bit CPU then only the 32-bit ISO will be listed in the Windows 10 menu. If the CPU is a 64-bit CPU then we can show only the 64-bit ISO file in the menu.

See here for details.

However, this user wanted to only show the 32-bit ISO if the system has <4GB of memory and only show the 64-bit ISO if the system has more than 4GB of memory.

The way around this was to create a new variable (GB4) in our \_ISO\MyE2B.cfg file:

# set 4GB variable if 4GB+ of memory present

set /a M=*0x8298 & 0xffffffff>>10+1 > nul ;; set /a M1=*0x82c0>>10+1 > nul ;; set /a M=%M% + %M1% > nul ;; if %M%>=4096 set GB4=1 ;; set M= ;; set M1=

We can now test for the existence of the variable GB4 in our .txt file:

Example:
We have a Windows10_x86.iso and a Windows10_x64.iso:

\_ISO\WINDOWS\WIN10\Windows10_x86.iso

\_ISO\WINDOWS\WIN10\Windows10_x64.iso

If a system has more than 4GB of memory, only show the 64-bit Windows ISO (it must have a 64-bit CPU if it detects >4GB). If it has less than 4GB we only show 32-bit Windows ISO.

 

Windows10_x64.txt

iftitle [if exist GB4] Win10 1703 x64\n Install 64-bit Windows 10

Windows10_x86.txt

iftitle [if not exist GB4] Win10 1703 x86\n Install 32-bit Windows 10

Note: There is a bug in E2B which causes a 'no title keyword found in xxxx.txt file' error when the Windows menu loads. This can be fixed by saving the .txt file as ANSI encoded instead of UTF-8 encoded - OR update your E2B drive with E2B v1.94a (beta) which has a bugfix for this.

MPI Tool Kit v0.077 now available

This version has two small changes:
1. Latest RMPartUSB.exe in the e2b folder
2. MakePartImage.cmd will now not  copy some 'special' files and folders when you use a USB drive as the source to make the .imgPTN file.

The excluded files/folders include $recycle.bin, pagefile.sys, hiberfil.sys, System Volume Information, etc. which often cause problems when copying under Windows.

To upgrade, download and extract the new MPI_Tool_Pack_Plus_CloverLite_077 folder to your Desktop and run CreateDesktopShortcuts.cmd. You can then delete the old MPI_Tool_Pack_Plus_CloverLite_0xx folder from your desktop.

Add PeppermintOS 8 + persistence to E2B

PeppermintOS 8 is based on Ubuntu\Lubuntu, so I have modified one of the Ubuntu_Persistence Sample menu files.

I used the Peppermint-8-20170527-amd64.iso (1.2GB) with the .mnu file shown below: