New agFM v1.51 Beta and E2B v2.04c Beta available

I have made some tweaks to agFM so that it can now directly boot Strelec, DLCBoot, HBCDPE, Bob Omb's PE, Gandalf PE and Medicat ISOs - no secondary menu is presented if you use file extension override suffixes.

agFM now understands some file extension override suffixes (similar to E2B feature) - e.g.  filename_.override.iso

The special suffix tells E2B\agFM to boot it as if it had that file extension. This allows the file to still keep it's .iso file extension which is needed by some WinPEs to make them work correctly.

· Medicat v18.10 stable_.isowin64.iso
· Bob Omb's WinPE_.isomap64.iso
· DLCBoot WinPE_.isohw.iso
· Windows 10 x64 Eng_.winntsetup.iso

Currently isowin, isomap, isodef, isodefault, isoagfm, isoloop, isohw, isope and winntsetup are supported - with or without the four special suffixes 64, 32, 3GB, 4GB.

agFM v.1.51 

• New search (F) button added (e.g. search for file types such a .iso, .wim from current folder). 
• Boot Windows ISO option now runs X:\Setup.exe so that the Windows Repair option is offered if no XML file is specified. 
• Allow use of file extension override suffixes (e.g. Medicat v18.10 stable_.isowin.iso) so extension can be kept as .iso but it will immediately boot with no secondary menu. 
• Support _.winntsetup.iso file extension suffix for booting to Windows PE from Install ISO and directly loading the ISO into WinNTSetup.exe.

This should be used with E2B v2.04c Beta.

Check the Alternate Download site for these new versions (see top-left sidebar).

Full details are in eBook #4 on agFM v1.12 which I have just updated so you can download the new versions now.

E2B v2.04b Beta includes Danish language and keyboard + better Strelec ISO support

v2.04b Beta now includes the Danish language as an option.

If you want to boot to a Strelec ISO, try the extension .isowin. This should allow you to boot to the two Win10 WinPEs using the Easy2Boot menu system or using the agFM menu system.

Easy2Boot v2.03 released

• a1ive grub2 File Manager.mnu and Enable or Disable UEFI Booting.mnu added to \_ISO\MAINMENU folder.
• The three letters 'MBR' will be ignored if present anywhere in any file extension. This can be used to prevent agFM from listed these files. Useful if the files do not support UEFI-booting and only boot via the E2B menu system.
• New version SWITCH_E2B.exe to fix small bug which affected the appearance only (not function). 
• New default background
• Update_E2B_Drive.cmd now will update agFM files if present. 
• Internet ping test changed in MAKE_E2B_USB_DRIVE.cmd script in case ipv4 blocked. 
• agFM Sample Mnu files folder added with examples files, 
• WinContig files updated
• Keyboard scan code files updated
• KeyCheck.g4b test script added (type KeyCheck from grub4dos console and press down keys to get BIOS key status codes (e.g. NUM LOCK, CAPS LOCK, CTRL, etc.)
• XP Step 1 now warns user if not enough memory to load XP ISO file into RAM
• Example commented code added to SDI_CHOCO.cmd for detecting UEFI or MBR boot

https://www.easy2boot.com/download/

64-bit Scraper cold-boot attack now available!

So the head of SMERSH switches off his password protected and BitLocker-protected PC and walks out of his office to go home for the night.

Stealing the hard drive will get you nowhere because it is encrypted.

But you quickly break into his office - remove the DIMM RAM sticks and plonk them into a flask of liquid Nitrogen and then go back to your secret base. After a few minutes you have collected all the bytes that were in that RAM into a file on your USB drive. Now you can analyse the file to find out what passwords and images, etc. were in his RAM just at the point he shut it down. For instance you could use PHOTOREC to find jpeg images or perhaps use some of the investigative tools in Kali Linux to find passwords or the BitLocker key?

Later you will return the DIMM sticks and no one will be any the wiser. If the BitLocker key or any passwords were found in memory, you could try them out and gain access to the encrypted hard drive too.

Up to now this was only possible for a maximum of 4GB because the 'scraper' code only worked as 32-bit code. However, Basel has now also compiled a 64-bit version for us which seems to work nicely!

My original blog was here and I have updated the original RMPrepUSB Article 124 to include a menu for the 32-bit and 64-bit versions that he has kindly provide - great work Basel!

So now even BitLocker will not protect you Colonel Niktin!

YouTube video of a Cold Boot Attack here.

P.S. A funny thing happened in the park this morning ...
The local park had just opened for the first time for ages (it had been closed due to Corona) and my brother took his collie dog there for a walk as he used to do in the pre-Corona days.
Once there, the dog had a great time and then she saw an old friend - a whippet that she loves to chase and play with. Then suddenly the whippet runs along and puts his foot in a rabbit hole or something and 'SNAP!' goes his right hind leg - broken!
Everyone came to his rescue and even a wheelbarrow was fetched by someone to transport him back to the car park and get him to the vets. No one blamed my brother or his dog - it was just a freak accident.
So my brother goes back to his car and there a middle-aged lady bends down to make a fuss of his collie dog when the lady stumbles, falls over and hits her head on a large stone on the ground. She was unconscious for quite a few seconds and took some more time to slowly come to her senses.
So after that, my brother drove home very slowly and carefully with his dog and they are both staying indoors all day just in case anything else happens! You couldn't make this up!

P.P.S. The vet set the dog's broken leg but unfortunately it later got infected and so had to be amputated. The dog has now been re-named as 'tripod'.

New large font theme for agFM (and discovery of a bug in grub2 themes)

I was experimenting with some grub2 themes yesterday (to use a large font for partially sighted users) and I wanted to create a menu which had a different theme.

However, I noticed a strange problem - sometimes one icon would be missing from the menu list!

agFM v1.50 is now available

agFM v1.50 now can directly boot from DLCBoot ISOs such as DLCBoot2019_v3.6.iso.  Change the extension to .isowin for immediate booting on selection in the agFM menu.

So that it also works with E2B, you can use a filename ending in _.isohw.isowin.

This version also includes a version of grub2 with an enhanced echo command which allows you to easily output coloured text (see previous blog for details or eBook #4 which I have just updated to v1.11).

You can update agFM by running the \e2b\Update agFM\Download and Update agFM cmd file.

Add your own Help menu to agFM

If you have made your agFM MBR+UEFI-bootable USB stick, you might want to add some instructions for your users - or to act as a reminder for yourself on how to use the USB stick in case you forget in a few months time.

You could add a 'Help' menu entry to your Start-up menu and it could display help in the form of a jpg/bmp/png. For instance, you could write the help information in Word or PowerPoint, add your Logo or other graphics and diagrams, and then use a screen capture to save it as a 1024x768x24 colour .jpg file. Then you could simply display the jpg.

Another option would be to display text - perhaps in different colours too.

The following is an example help.cfg file which is saved in UTF-8 format (using Notepad) to preserve non-English glyphs. Note that if you use the text mode for your menu system (mymenu=3) then you should only use English ASCII characters, the background colours are restricted and graphics files (jpg/png/bmp) cannot be displayed.

agFM v1.49 and E2B v2.03c are now available

agFM v1.49 has enhancements and it can now boot directly to Sergei Strelec ISOs. WinPE support has been improved. The extension .isowin (or .isowin64) may now also work for some WinPE ISOs - check the List of Tested Payloads (bottom of page) or eBook #4 (updated just now to v1.10) for the correct file extension to use if you want to skip the secondary menu.

UEFI64 booting should be a bit faster now too.

E2B v2.03c has also had a few changes too including a new default background.

Please feedback any comments.

Keep safe and don't forget to subscribe,
Steve

How to boot 64-bit Linux ISOs on a 32-bit UEFI system (such as the Asus T100)

Some systems such as the Asus T100 Transformer notebook range are a bit of an odd fish!

They have a 64-bit CPU but because they have limited SSD storage (e.g. 32GB or 64GB), the manufacturers use a 32-bit version of Windows. This means that because Microsoft insist that OEMs ship with Secure UEFI enabled, the manufacturers have to use 32-bit UEFI firmware.

In the case of the T100, the firmware does not support Legacy\MBR mode (no CSM option) so we usually need to find UEFI32 OS's.

'Corona special offer' on E2B eBooks - now only $5 each

Some of the eBooks were previously priced at $6.99, $7 and $10.

I have now reduced the price so they are all only $5 each - you can also get a 10% discount on all of the eBooks when you purchase more than one (add one to the Basket and then you will see the others). Why not put down that game controller or 'Joy Stick' (well, that's what my wife calls it), and become a wizard of the USB stick instead?

This special offer will only be for a limited time so grab 'em while they're hot!

P.S. There are a few reviews about the eBooks on the GuestBook page if you want to see if they might be useful to you (and I didn't pay them to write that - honest!).

How to get Batocera working on your Easy2Boot USB drive

Batocera is a linux-based games emulator + KODI.

Batocera-linux

It can be downloaded as a .img.gz file and it is an image file which is intended to be written to a flash drive or SD card.

Here is how to get it working on your E2B drive:

agFM v1.47 download now released

Just a quick note to say that agFM v1.47 (now 1.48 - discovered a bug in 1.47!) is now released which has the latest version of a1ive's grub2 with newer language files. You can update using the .cmd file in the \e2b folder.

The SAMPLE_startup_menu.txt file has also been updated slightly to include a fourth menu style (set mymenu=3). This sets a basic terminal (console) text mode. It has been found that using graphics modes can cause keyboard lockup issues on some systems (e.g. MacBook Pro) due to a long standing grub2 bug. The console mode does not suffer from this issue (it also loads faster), however it does not display any icons or wallpaper, only supports English (because no fonts can be loaded) and it is not as pretty!

I have also updated eBook #4 for agFM - it is now at version 1.9. Download the latest PDF using the link in the Payhip email that you should have received after purchase.

P.S. If you are a Windows 7 or 8 user, I have made available for download a batch file which will delete are re-make the second agFM partition of your E2B USB drive automatically. See the agFM page for more details. Note: It does NOT work under Windows 10.

Free eBook - Learn how to use and hack with Kali Linux

https://ghacks.tradepub.com/free/w_pacb119/prgm.cgi

This link provided by ghacks - limited number.
eBook is 2019 version and 85MB.
You need to give a lot of your details though...

Learn about the latest ethical hacking tools and techniques in Kali Linux 2019 to perform penetration testing from scratch.

The current rise in hacking and security breaches makes it more important than ever to effectively pentest your environment, ensuring endpoint protection. This book will take you through the latest version of Kali Linux and help you use various tools and techniques to efficiently deal with crucial security aspects.

Through real-world examples, you’ll understand how to set up a lab and later explore core penetration testing concepts. Throughout the course of this book, you’ll get up to speed with gathering sensitive information and even discover different vulnerability assessment tools bundled in Kali Linux 2019. In later chapters, you’ll gain insights into concepts such as social engineering, attacking wireless networks, exploitation of web applications and remote access connections to further build on your pentesting skills. You’ll also focus on techniques such as bypassing controls, attacking the end user and maintaining persistence access through social media. Finally, this pentesting book covers best practices for performing complex penetration testing techniques in a highly secured environment.

By the end of this book, you’ll be able to use Kali Linux to detect vulnerabilities and secure your system by applying penetration testing techniques of varying complexity.

Features:

• Get up and running with Kali Linux 2019.2
• Gain comprehensive insights into security concepts such as social engineering, wireless network exploitation, and web application attacks
• Learn to use Linux commands in the way ethical hackers do to gain control of your environment

Free offer expires 5/6/2020.

agFM v1.46 released

The new 1.46 version has a few changes/improvements:

1. New agFM boot files (+ Ventoy support)
2. Some partition references changed to use (e.g.)  hd0,1 instead of hd0,msdos1. This allows the E2B version of agFM to be used on non-legacy partition drives such as gpt drives. Note that some functions such as .imgPTN and .isodef (partnew) won't work on GPT drives and I don't support GPT drives!
3. The variable grubfm_startbat can now be used to define a different start.bat file which is run at the start of Windows Setup. This just provides a way to 'hook' in a custom batch file and will not be of value to most users.
4. SAMPLE_startup_menu.txt re-organised
5. \grldr and \boot\grub\menu.lst file added to allow a system to MBR boot to the agFM partition and then load agFM (grub2).
6. Some README files added to \boot\grubfm folder
7. Load agFM startup menu.cfg copied to root of agFM folder to allow user to re-run the startup menu.
8. Enable or Disable UEFI booting.mnu file added to \e2b folder (for copying to \_ISO\MAINMENU of partition 1 if required).

Item 5 above means that you may now be able to MBR-boot to agFM from the second partition (e.g. using the BIOS boot menu).

This is useful if you have switched in a .imgPTN23 file which does not contain grub4dos or the CSM menu. For instance, you can boot to agFM from the E2B menu. switch in a .imgPTN23 file (no checks are made as to what the new partition contains) and then from the agFM menu you can boot from a file on the new partition #1 or run a grub2 grub.cfg file from partition #1.

How to fix the issue of the BIOS not listing an MBR\Legacy boot option to boot to the E2B menu

If your E2B USB drive now has a FAT32 partition with UEFI boot files in the \EFI boot folder, you may find that some systems will not offer you the choice to Legacy from your E2B USB drive (even though you have enabled CSM) - the only option is to UEFI-boot (or set the BIOS options to disable UEFI-booting) which may not be what you want to do on some occasions. You may need to run a Legacy payload using E2B.

Where is the Legacy boot option?

These buggy BIOSes do not present a Legacy-boot (unless you can change the BIOS options to disable UEFI-booting which sometimes is not possible).

We can however rename the \EFI folder on the 2nd FAT32 agFM partition and this will cause the BIOS pop-up boot menu to list the Legacy-boot option.

agFM v1.45 is now available

agFM v1.45 now supports non-USA keyboards - e.g. German QWERTZ keyboards or French AZERTY keyboards, etc.

To update, use the "\e2b\Update agFM\Download and update agFM_v2.cmd" file.

By pressing F4 you can now set the keyboard type as well as the language.

The developer a1ive has done some great work in getting grub2 to support different keyboards. This is the first time that grub2 can support different keyboards and is reliable!

eBook 4 has also been updated with details of how to configure a language and keyboard type on startup.

P.S. If you have set the 'seven' or user 'slax' theme, then when you press F4 you will see a missing icon for the keyboard menu entry. To fix this, update the seven folder to the latest version (one icon gkb.png has now been added).

The unpleasant truth about Corona!

The Corona virus is highly infectious and can be passed on without the vector (the person spreading the infection) showing any symptoms at the time.

The other reason why this virus is so scary is that, unlike influenza, it can be fatal even to some young, fit and healthy individuals.

So, when considering any population (e.g. an island or a country or a state), the only way that the infection can be stopped is either a significant proportion of that population develops an immunity OR we quarantine EVERY INDIVIDUAL IN THE COUNTRY until there is no further sign of infection. If a population has been locked down in this way however, it only takes one 'foreign' visitor to re-infect the whole country again!

I say a 'significant number', because if an infected person arrives into the country from somewhere-land, they will only be able to pass on the virus if they come into contact with another person who is not already immune. So if 70% of the population are immune, then the virus is not likely to infect anyone else as long as the visitor is quarantined as soon as they show any symptoms (or at least only infect 1 or 2 others at most who are also quickly quarantined).

So, for the sake of argument, let us say that the critical point is when 70% of the population develop immunity, then we can all go back to living virtually normal lives and the virus should die out as it can only survive for approximately 72 hours (or just a few minutes if you stick them in a microwave!).

So how do we get a population which is 70% immune? 

How to easily customise all your WinPE ISOs - add your own Wallpaper, Portable Apps and Desktop shortcuts

So I have my E2B+agFM USB drive and it can Legacy and UEFI64-boot on (almost) any system, including Secure Boot.

The WinPE payloads on my USB drive include:

• Bob Omb's WinPE
• Medicat
• DLCBoot 2019 (must use .cfg or .grubfm file)
• Gandalf'sWin10PE
• Hirens Boot CD PE
• Sergei Strelecs Win8\10 PE (.imgPTN23)
• and a few others

E2B Menu

agFM (UEFI64) menu

However, now some of these old Win PEs have applications which are a bit outdated.
Also, I would like to add more shortcuts to the Desktop for apps which I use frequently.
I would like to add some portable apps too.
Having one or two apps auto-start would be nice as would changing the wallpaper.
But the ISO cannot easily be changed - right?

WRONG!

PEStartup

By using the 'PE Startup.exe' written by the author of AIOBoot, I can boot to any of these WinPEs and instantly change all these things and add Portable Apps too.

Here is a screenshot of my Gandalf Redstone3 desktop (looks a bit different, doesn't it!):

To do this, you need to add the PEStartup files from Tutorial 143 on my RMPrepUSB.com website.
Extract the files to the root of the agFM FAT32 partition (or the 3rd partition if you have one). It would be better to use the 2nd FAT32 partition because it should always be present even when using .imgPTN23 files.

Quick Instructions

agFM v1.44 released

• Latest grub2\agFM version
• Fixes bug when ISO files which don't have a .iso file extension won't UEFI-boot (e.g. xxx.iso would boot but some xxx.isodef would not).
• Additional types recognised, e.g. .isodef64

To update, run \e2b\Update agFM\Download and update agFM.cmd.

E2B v2.03a Beta is available

E2B v2.03a (Beta) just has a small tweak to QRUN.cmd so that any file which has the three letters 'MBR' (not case-sensitive) anywhere in it's extension can be used.

For example: any file with the file extension .isodef32MBR will be booted as if it had an extension of .isodef but will only be listed on systems with 32-bit CPUs (i.e. exactly the same as if it had a .isodef32 file extension).

.isoPEMBR == .isoPE

Note however, that you can't add 'MBR' into the file extensions of files which are under \_ISO\WINDOWS\xxxxx folders as then they won't be seen by E2B. This trick only works in the standard E2B menu folders.

So what's the point of simply ignoring the three letters 'MBR' in a file extension?

Well, it means that the agFM file system will not list the file. So if you want to prevent any payload file from being listed in the agFM menu (e.g. when UEFI-booting to the agFM menu), then you simply add 'MBR' to the file extension.

This means that files which do not support UEFI-booting will not be listed in the agFM menu - e.g. DOS ISOs, DOS floppy images (.ima), old HBCD ISOs, etc.

'Great!' you may say, but how do I hide files from the E2B menu system? For instance, what if I have an ISO which does not support MBR booting at all and only UEFI-boots?

Well, you simply don't place it in an E2B menu folder. For instance, if you have a Linux ISO which does not MBR-boot, put it in a folder named \_ISO\LINUX\UEFI. If it only UEFI64-boots then use a .iso64 file extension or .isodef64 so that no secondary menu is shown.