64-bit Scraper cold-boot attack now available!

So the head of SMERSH switches off his password protected and BitLocker-protected PC and walks out of his office to go home for the night.

Stealing the hard drive will get you nowhere because it is encrypted.

But you quickly break into his office - remove the DIMM RAM sticks and plonk them into a flask of liquid Nitrogen and then go back to your secret base. After a few minutes you have collected all the bytes that were in that RAM into a file on your USB drive. Now you can analyse the file to find out what passwords and images, etc. were in his RAM just at the point he shut it down. For instance you could use PHOTOREC to find jpeg images or perhaps use some of the investigative tools in Kali Linux to find passwords or the BitLocker key?

Later you will return the DIMM sticks and no one will be any the wiser. If the BitLocker key or any passwords were found in memory, you could try them out and gain access to the encrypted hard drive too.

Up to now this was only possible for a maximum of 4GB because the 'scraper' code only worked as 32-bit code. However, Basel has now also compiled a 64-bit version for us which seems to work nicely!

My original blog was here and I have updated the original RMPrepUSB Article 124 to include a menu for the 32-bit and 64-bit versions that he has kindly provide - great work Basel!

So now even BitLocker will not protect you Colonel Niktin!

YouTube video of a Cold Boot Attack here.

P.S. A funny thing happened in the park this morning ...
The local park had just opened for the first time for ages (it had been closed due to Corona) and my brother took his collie dog there for a walk as he used to do in the pre-Corona days.
Once there, the dog had a great time and then she saw an old friend - a whippet that she loves to chase and play with. Then suddenly the whippet runs along and puts his foot in a rabbit hole or something and 'SNAP!' goes his right hind leg - broken!
Everyone came to his rescue and even a wheelbarrow was fetched by someone to transport him back to the car park and get him to the vets. No one blamed my brother or his dog - it was just a freak accident.
So my brother goes back to his car and there a middle-aged lady bends down to make a fuss of his collie dog when the lady stumbles, falls over and hits her head on a large stone on the ground. She was unconscious for quite a few seconds and took some more time to slowly come to her senses.
So after that, my brother drove home very slowly and carefully with his dog and they are both staying indoors all day just in case anything else happens! You couldn't make this up!

P.P.S. The vet set the dog's broken leg but unfortunately it later got infected and so had to be amputated. The dog has now been re-named as 'tripod'.

New large font theme for agFM (and discovery of a bug in grub2 themes)

I was experimenting with some grub2 themes yesterday (to use a large font for partially sighted users) and I wanted to create a menu which had a different theme.

However, I noticed a strange problem - sometimes one icon would be missing from the menu list!

agFM v1.50 is now available

agFM v1.50 now can directly boot from DLCBoot ISOs such as DLCBoot2019_v3.6.iso.  Change the extension to .isowin for immediate booting on selection in the agFM menu.

So that it also works with E2B, you can use a filename ending in _.isohw.isowin.

This version also includes a version of grub2 with an enhanced echo command which allows you to easily output coloured text (see previous blog for details or eBook #4 which I have just updated to v1.11).

You can update agFM by running the \e2b\Update agFM\Download and Update agFM cmd file.

Add your own Help menu to agFM

If you have made your agFM MBR+UEFI-bootable USB stick, you might want to add some instructions for your users - or to act as a reminder for yourself on how to use the USB stick in case you forget in a few months time.

You could add a 'Help' menu entry to your Start-up menu and it could display help in the form of a jpg/bmp/png. For instance, you could write the help information in Word or PowerPoint, add your Logo or other graphics and diagrams, and then use a screen capture to save it as a 1024x768x24 colour .jpg file. Then you could simply display the jpg.

Another option would be to display text - perhaps in different colours too.

The following is an example help.cfg file which is saved in UTF-8 format (using Notepad) to preserve non-English glyphs. Note that if you use the text mode for your menu system (mymenu=3) then you should only use English ASCII characters, the background colours are restricted and graphics files (jpg/png/bmp) cannot be displayed.

agFM v1.49 and E2B v2.03c are now available

agFM v1.49 has enhancements and it can now boot directly to Sergei Strelec ISOs. WinPE support has been improved. The extension .isowin (or .isowin64) may now also work for some WinPE ISOs - check the List of Tested Payloads (bottom of page) or eBook #4 (updated just now to v1.10) for the correct file extension to use if you want to skip the secondary menu.

UEFI64 booting should be a bit faster now too.

E2B v2.03c has also had a few changes too including a new default background.

Please feedback any comments.

Keep safe and don't forget to subscribe,
Steve

How to boot 64-bit Linux ISOs on a 32-bit UEFI system (such as the Asus T100)

Some systems such as the Asus T100 Transformer notebook range are a bit of an odd fish!

They have a 64-bit CPU but because they have limited SSD storage (e.g. 32GB or 64GB), the manufacturers use a 32-bit version of Windows. This means that because Microsoft insist that OEMs ship with Secure UEFI enabled, the manufacturers have to use 32-bit UEFI firmware.

In the case of the T100, the firmware does not support Legacy\MBR mode (no CSM option) so we usually need to find UEFI32 OS's.

'Corona special offer' on E2B eBooks - now only $5 each

Some of the eBooks were previously priced at $6.99, $7 and $10.

I have now reduced the price so they are all only $5 each - you can also get a 10% discount on all of the eBooks when you purchase more than one (add one to the Basket and then you will see the others). Why not put down that game controller or 'Joy Stick' (well, that's what my wife calls it), and become a wizard of the USB stick instead?

This special offer will only be for a limited time so grab 'em while they're hot!

P.S. There are a few reviews about the eBooks on the GuestBook page if you want to see if they might be useful to you (and I didn't pay them to write that - honest!).

How to get Batocera working on your Easy2Boot USB drive

Batocera is a linux-based games emulator + KODI.

Batocera-linux

It can be downloaded as a .img.gz file and it is an image file which is intended to be written to a flash drive or SD card.

Here is how to get it working on your E2B drive:

agFM v1.47 download now released

Just a quick note to say that agFM v1.47 (now 1.48 - discovered a bug in 1.47!) is now released which has the latest version of a1ive's grub2 with newer language files. You can update using the .cmd file in the \e2b folder.

The SAMPLE_startup_menu.txt file has also been updated slightly to include a fourth menu style (set mymenu=3). This sets a basic terminal (console) text mode. It has been found that using graphics modes can cause keyboard lockup issues on some systems (e.g. MacBook Pro) due to a long standing grub2 bug. The console mode does not suffer from this issue (it also loads faster), however it does not display any icons or wallpaper, only supports English (because no fonts can be loaded) and it is not as pretty!

I have also updated eBook #4 for agFM - it is now at version 1.9. Download the latest PDF using the link in the Payhip email that you should have received after purchase.

P.S. If you are a Windows 7 or 8 user, I have made available for download a batch file which will delete are re-make the second agFM partition of your E2B USB drive automatically. See the agFM page for more details. Note: It does NOT work under Windows 10.

Free eBook - Learn how to use and hack with Kali Linux

https://ghacks.tradepub.com/free/w_pacb119/prgm.cgi

This link provided by ghacks - limited number.
eBook is 2019 version and 85MB.
You need to give a lot of your details though...

Learn about the latest ethical hacking tools and techniques in Kali Linux 2019 to perform penetration testing from scratch.

The current rise in hacking and security breaches makes it more important than ever to effectively pentest your environment, ensuring endpoint protection. This book will take you through the latest version of Kali Linux and help you use various tools and techniques to efficiently deal with crucial security aspects.

Through real-world examples, you’ll understand how to set up a lab and later explore core penetration testing concepts. Throughout the course of this book, you’ll get up to speed with gathering sensitive information and even discover different vulnerability assessment tools bundled in Kali Linux 2019. In later chapters, you’ll gain insights into concepts such as social engineering, attacking wireless networks, exploitation of web applications and remote access connections to further build on your pentesting skills. You’ll also focus on techniques such as bypassing controls, attacking the end user and maintaining persistence access through social media. Finally, this pentesting book covers best practices for performing complex penetration testing techniques in a highly secured environment.

By the end of this book, you’ll be able to use Kali Linux to detect vulnerabilities and secure your system by applying penetration testing techniques of varying complexity.

Features:

• Get up and running with Kali Linux 2019.2
• Gain comprehensive insights into security concepts such as social engineering, wireless network exploitation, and web application attacks
• Learn to use Linux commands in the way ethical hackers do to gain control of your environment

Free offer expires 5/6/2020.

agFM v1.46 released

The new 1.46 version has a few changes/improvements:

1. New agFM boot files (+ Ventoy support)
2. Some partition references changed to use (e.g.)  hd0,1 instead of hd0,msdos1. This allows the E2B version of agFM to be used on non-legacy partition drives such as gpt drives. Note that some functions such as .imgPTN and .isodef (partnew) won't work on GPT drives and I don't support GPT drives!
3. The variable grubfm_startbat can now be used to define a different start.bat file which is run at the start of Windows Setup. This just provides a way to 'hook' in a custom batch file and will not be of value to most users.
4. SAMPLE_startup_menu.txt re-organised
5. \grldr and \boot\grub\menu.lst file added to allow a system to MBR boot to the agFM partition and then load agFM (grub2).
6. Some README files added to \boot\grubfm folder
7. Load agFM startup menu.cfg copied to root of agFM folder to allow user to re-run the startup menu.
8. Enable or Disable UEFI booting.mnu file added to \e2b folder (for copying to \_ISO\MAINMENU of partition 1 if required).

Item 5 above means that you may now be able to MBR-boot to agFM from the second partition (e.g. using the BIOS boot menu).

This is useful if you have switched in a .imgPTN23 file which does not contain grub4dos or the CSM menu. For instance, you can boot to agFM from the E2B menu. switch in a .imgPTN23 file (no checks are made as to what the new partition contains) and then from the agFM menu you can boot from a file on the new partition #1 or run a grub2 grub.cfg file from partition #1.

How to fix the issue of the BIOS not listing an MBR\Legacy boot option to boot to the E2B menu

If your E2B USB drive now has a FAT32 partition with UEFI boot files in the \EFI boot folder, you may find that some systems will not offer you the choice to Legacy from your E2B USB drive (even though you have enabled CSM) - the only option is to UEFI-boot (or set the BIOS options to disable UEFI-booting) which may not be what you want to do on some occasions. You may need to run a Legacy payload using E2B.

Where is the Legacy boot option?

These buggy BIOSes do not present a Legacy-boot (unless you can change the BIOS options to disable UEFI-booting which sometimes is not possible).

We can however rename the \EFI folder on the 2nd FAT32 agFM partition and this will cause the BIOS pop-up boot menu to list the Legacy-boot option.

agFM v1.45 is now available

agFM v1.45 now supports non-USA keyboards - e.g. German QWERTZ keyboards or French AZERTY keyboards, etc.

To update, use the "\e2b\Update agFM\Download and update agFM_v2.cmd" file.

By pressing F4 you can now set the keyboard type as well as the language.

The developer a1ive has done some great work in getting grub2 to support different keyboards. This is the first time that grub2 can support different keyboards and is reliable!

eBook 4 has also been updated with details of how to configure a language and keyboard type on startup.

P.S. If you have set the 'seven' or user 'slax' theme, then when you press F4 you will see a missing icon for the keyboard menu entry. To fix this, update the seven folder to the latest version (one icon gkb.png has now been added).

The unpleasant truth about Corona!

The Corona virus is highly infectious and can be passed on without the vector (the person spreading the infection) showing any symptoms at the time.

The other reason why this virus is so scary is that, unlike influenza, it can be fatal even to some young, fit and healthy individuals.

So, when considering any population (e.g. an island or a country or a state), the only way that the infection can be stopped is either a significant proportion of that population develops an immunity OR we quarantine EVERY INDIVIDUAL IN THE COUNTRY until there is no further sign of infection. If a population has been locked down in this way however, it only takes one 'foreign' visitor to re-infect the whole country again!

I say a 'significant number', because if an infected person arrives into the country from somewhere-land, they will only be able to pass on the virus if they come into contact with another person who is not already immune. So if 70% of the population are immune, then the virus is not likely to infect anyone else as long as the visitor is quarantined as soon as they show any symptoms (or at least only infect 1 or 2 others at most who are also quickly quarantined).

So, for the sake of argument, let us say that the critical point is when 70% of the population develop immunity, then we can all go back to living virtually normal lives and the virus should die out as it can only survive for approximately 72 hours (or just a few minutes if you stick them in a microwave!).

So how do we get a population which is 70% immune? 

How to easily customise all your WinPE ISOs - add your own Wallpaper, Portable Apps and Desktop shortcuts

So I have my E2B+agFM USB drive and it can Legacy and UEFI64-boot on (almost) any system, including Secure Boot.

The WinPE payloads on my USB drive include:

• Bob Omb's WinPE
• Medicat
• DLCBoot 2019 (must use .cfg or .grubfm file)
• Gandalf'sWin10PE
• Hirens Boot CD PE
• Sergei Strelecs Win8\10 PE (.imgPTN23)
• and a few others

E2B Menu

agFM (UEFI64) menu

However, now some of these old Win PEs have applications which are a bit outdated.
Also, I would like to add more shortcuts to the Desktop for apps which I use frequently.
I would like to add some portable apps too.
Having one or two apps auto-start would be nice as would changing the wallpaper.
But the ISO cannot easily be changed - right?

WRONG!

PEStartup

By using the 'PE Startup.exe' written by the author of AIOBoot, I can boot to any of these WinPEs and instantly change all these things and add Portable Apps too.

Here is a screenshot of my Gandalf Redstone3 desktop (looks a bit different, doesn't it!):

To do this, you need to add the PEStartup files from Tutorial 143 on my RMPrepUSB.com website.
Extract the files to the root of the agFM FAT32 partition (or the 3rd partition if you have one). It would be better to use the 2nd FAT32 partition because it should always be present even when using .imgPTN23 files.

Quick Instructions

agFM v1.44 released

• Latest grub2\agFM version
• Fixes bug when ISO files which don't have a .iso file extension won't UEFI-boot (e.g. xxx.iso would boot but some xxx.isodef would not).
• Additional types recognised, e.g. .isodef64

To update, run \e2b\Update agFM\Download and update agFM.cmd.

E2B v2.03a Beta is available

E2B v2.03a (Beta) just has a small tweak to QRUN.cmd so that any file which has the three letters 'MBR' (not case-sensitive) anywhere in it's extension can be used.

For example: any file with the file extension .isodef32MBR will be booted as if it had an extension of .isodef but will only be listed on systems with 32-bit CPUs (i.e. exactly the same as if it had a .isodef32 file extension).

.isoPEMBR == .isoPE

Note however, that you can't add 'MBR' into the file extensions of files which are under \_ISO\WINDOWS\xxxxx folders as then they won't be seen by E2B. This trick only works in the standard E2B menu folders.

So what's the point of simply ignoring the three letters 'MBR' in a file extension?

Well, it means that the agFM file system will not list the file. So if you want to prevent any payload file from being listed in the agFM menu (e.g. when UEFI-booting to the agFM menu), then you simply add 'MBR' to the file extension.

This means that files which do not support UEFI-booting will not be listed in the agFM menu - e.g. DOS ISOs, DOS floppy images (.ima), old HBCD ISOs, etc.

'Great!' you may say, but how do I hide files from the E2B menu system? For instance, what if I have an ISO which does not support MBR booting at all and only UEFI-boots?

Well, you simply don't place it in an E2B menu folder. For instance, if you have a Linux ISO which does not MBR-boot, put it in a folder named \_ISO\LINUX\UEFI. If it only UEFI64-boots then use a .iso64 file extension or .isodef64 so that no secondary menu is shown.

E2B v2.02 released

v2.02 is now live and is just a small update to E2B.

• Latest WinContig.exe (small bugfixes wont affect 99.9% of users)
• Add support for .isoagfm extension (same as .isodef)
• Update new ChocBox.cmd and ChocolateStore.exe (now requires .Net 4.8)
• Bugfix in Make USB cmd - if  user specifies 32GB FAT32 then it failed to format it.

If you want to install offline Chocolatey packages using the offline SDI_CHOCO install process, you will need to make the packages using ChocolateStore. However, it no longer worked because .Net 4.8 is now required to download the package files. The developer has just updated the executable, so now we are back in business.

In case you didn't know, once you have set up a Windows SDI_CHOCO configuration on your E2B drive, you can quickly install Windows with the correct locale/language/country options, Windows components, add extra missing drivers (auto-detected and installed), install applications (online or offline Chocolate) and your own app packages and tweak the final settings. During installation it actually speaks to you to let you know what's going on at each stage (if you have speakers connected).

Get the latest eBook revisions for free!

In case you didn't realise it, if you have purchased any eBooks, you can get the latest versions for free!

Just click on the download link sent to you by Payhip and you can download the latest version.

Up to 5 downloads per eBook are allowed, but if you need more, just let me know. The four E2B eBooks have all been updated just recently.

• eBook #1: Getting started with Easy2Boot v2.17.pdf
• eBook #2: How to install Microsoft Windows using Easy2Boot v1.6.pdf
• eBook #3: How to make a UEFI multi-boot Easy2Boot USB drive v1.00.pdf
• eBook #4: UEFI-multiboot using the a1ive grub2 File Manager v1.6.pdf

• Getting started with grub4dos_v0.95.pdf

agFM 1.43 now available

v1.43 changes:

• Special extensions (e.g. .iso3g, iso64, imgptn2364pwd) are now not listed in the agFM menu list if the criteria does not match
• Fix for partition 4 needing to be erased after selecting an ISO using partnew\easy2boot option.
• True Hide\Unhide .cfg files in \e2b\Sample agFM Menu files\MISC\
• Latest grubfm
• .iso323gb, .iso3gb, .iso4gb, .iso644gb extensions now recognised
• F1 now displays total memory in system
• if using 'pwd' string in the extension, you must set pwd variable in your user startup menu (e.g. set pwd="Hi Steve") - beware of incorrect keyboard scan codes if using AZERTY or QWERTZ keyboards!

To update, just run \e2b\Update agFM\Download and Update agFM.cmd.

File extension suffixes:

The order is critical for agFM:  23 AUTO 32\64 3GB\4GB pwd

The supported extra file extensions exist as files in the \boot\grubfm\types folder.

For example, if you have

• \_ISO\LINUX\Ubuntux64.iso64
• \_ISO\WINDOWS\WIN10\Windows 10 64-bit.iso64

then they will not be listed if you boot on a 32-bit system.

If you have

• \_ISO\WINDOWS\WIN10\Windows 10 64-bit.iso4GB

then it will only be listed on a system which has 4GB or more of RAM.

• \_ISO\WINDOWS\WIN10\Windows 10 32-bit.iso32 

will only be listed on a system with a 32-bit CPU.

Let me know if you have any problems.

agFM v1.42 available

agFM v1.42 adds these changes:

v1.42 2020-04-16 

• Latest grub2 with new partnew command option and stat -r command
• True Hide and True UnHide .cfg files to protect partitions 1 and 2 (experimental)
• support .imgPTN extensions with 23, auto, 32\64, pwd, 3GB\4GB (must be in that order). Not all combinations are supported.

The website download will not be updated for a day or two.

supported .imgptn* extensions.

imgptn
imgptn23
imgptn2332
imgptn2332pwd
imgptn233gb
imgptn234gb
imgptn2364
imgptn23644gb
imgptn2364pwd
imgptn23auto
imgptn23auto32
imgptn23auto32pwd
imgptn23auto64
imgptn23auto64pwd
imgptn23autopwd
imgptn23autopwd4gb
imgptn23pwd
imgptn32
imgptn32autopwd
imgptn3gb
imgptn4gb
imgptn64
imgptn644gb
imgptn64autopwd
imgptn64pwd
imgptnauto
imgptnauto32
imgptnauto64
imgptnautopwd
imgptnpwd

These files will be still listed in the agFM File Manager menu system but will not run if the system conditions do not match.

Examples
If you have '64' in the file extension then it will not load on a system with a 32-bit CPU.
If you have 3GB in the file extension then it won't load if the system has 4GB or more of memory.
If you have 4GB in the file extension then it won't load if the system has less than 4GB.
If you have 'pwd' in the file extension then you will need to enter a password. The password is set in your user startup menu - e.g. set pwd="secret123".

The True Hide and UnHide .cfg files are experimental. The True Hide will cause the NTFS ptn1 and the FAT32 ptn2 partitions to be inaccessible. You should still be able to UEFI-boot or MBR boot however. If you UEFI-boot to a True-Hidden drive, press F2 to get to the agFM menu and run the Unhide cfg file. Do not use these unless you are well experienced!

• True Hide Ptn1 and Ptn2.cfg
• True Unhide Ptn1 and Ptn2.cfg

True Hide protects the partition from being accessed\infected. You can still boot from a hidden partition and then unhide the partitions when you want to boot a (Windows) payload.

a1ive grub2 File Manager v1.41 available

v1.41 2020-04-15 

• Bugfix to allow non-contiguous Windows Install ISOs to run
• Latest grub2/agFM from a1ive
• A few French language corrections

Just run the update .cmd script from the agFM partition e2b folder to update.

a1ive grub2 File Manager v1.40 now available

To update run "\e2b\Update agFM\Download and update agFM.cmd" from the USB drive.

• New initial startup menu
• Latest agFM grub2
• Improve French
• Add "\e2b\Update agFM\Download and update agFM_v2.cmd" for improved update experience so no 7z.exe and 7z.dll errors on update, etc.

The new startup menu is "\boot\grubfm\startup_default.cfg".  It has no timeout set and is in English.

If you create or have your own "\boot\grubfm\startup_menu.txt" file then the default startup_default.cfg file will not be used.

The new startup menu just lists the non-empty menu folders in \_ISO\ so the user can quickly access any of the files in each folder. If you have switched in a .imgPTN file, then the 'Restore E2B Partitions.cfg' file will also be listed.

Let me know if you like it. If you prefer to have no startup menu and just see a list of all the partitions as before, then just make an empty "\boot\grubfm\startup_menu.txt" file.

Note that the F1-F6 hotkeys will still work in this menu even though the small icons are not displayed.

If you want to 'tweak' this menu, just copy the startup_default.cfg file to startup_menu.txt and then edit the startup_menu.txt file.

Do NOT edit the startup_default.cfg file or the config file because the next time you update, they will be replaced!

Excellent new Decomputo YT video series in Spanish

In the past Decomputo has provided some excellent videos on E2B. Here is his latest one on E2B v2.

He promises more to come...

Are you French, Korean, Japanese or Vietnamese? Please help!

The a1ive grub2 File Manager menu system is now available in more languages, thanks to some users adding translations in Crowdin. However, we still need your help.

Please refer to the previous blog for details of how to add a translation.

ChocBox.cmd script seems to be broken!

The ChocBox.cmd script allows you to make Chocolatey offline packages for the SDI_CHOCO install process.

This allows you to install Chocolatey packages without needing an internet connection.

You could run ChocBox.cmd (after installing chocolatey) on a Win10 system and it would download and make the package files.

It seems to be a powershell SSL issue and the ChocolateStore developer does not seem to be active, so I am a bit stuck!

UPDATE: The dev has fixed ChocolateStore.exe. Please update to E2B v2.02a Beta if you want to use ChocBox.cmd.

Hack into any Windows User Account from a UEFI Secure Boot

A cheaper (i.e. free, but less convenient) alternative to Kon-Boot, is to use the well-known UtilMan.exe hack to create a new Admin account.

Easy2Boot contains two XML files which allow you to semi-automate the hack process which works even on Windows 10 systems. It will backup the hacked files for you and automate the creation of a new ADMIN account. By using a different XML file, it will also undo the hack.

This should work on UEFI32, UEFI64 and MBR\Legacy systems.

Since we can usually Secure UEFI64 Boot to the agFM menu system, this means we can even hack a Secure Boot-enabled system (as long as the Kaspersky efi shim is not blacklisted in the target systems DBx UEFI firmware list!).

All we need is a WinPE or Windows Install ISO. I use a standard Windows 10 Install ISO because it will have the latest chipset and USB drivers in it and I can use the same ISO to re-install or repair Windows if I need to.

Requirements

1. E2B+agFM USB drive
2. \_ISO\WINDOWS\WIN10\Windows10_x64.iso  (any WinPE\Win ISO should work)

Method

We first need to reboot the Windows target system and configure it so that it will restart in Safe Mode on the next boot.

This is for two reasons:

1. To ensure that Windows is not in a sleep (fast boot) or hibernate state.
2. To boot to Windows in Safe Mode which temporarily disables Windows Defender and so prevents it from un-doing the UtilMan.exe file hack.

This can be done without needing to log in to any Windows account on the target system.

Once the Windows target system is set to boot into Safe Mode on the next boot, then we just need to UEFI-boot to E2B+agFM and select the Windows\WinPE ISO and the Load UtilMan - Hack Windows XML file...

After the files have been patched under WinPE, you will then reboot to Windows and type [WinKey]+U after booting into Safe Mode and then type 2 quickly...

Besides creating a new Admin account, it also launches the Window Control Panel password app. to allow you to change any account password.

For full step-by-step instructions, see the UtilMan Hack page on the E2B website.

P.S. The way to avoid this hack is to set a BIOS password, do not allow USB booting in the BIOS options or/and use BitLocker.

How to UEFI64 Secure Boot to Kon-Boot and break into a Windows account without needing a password

The good thing about Kon-Boot is that is does not change any files on the target system disk - it is all done in memory.

However, the current  previous Kon-Boot licensing system restricted you  into making licensed bootable USB Flash drive of only 16GB or less. 

This 16GB limitation is apparently applied because some BIOSes will not successfully MBR-boot to grub4dos if the USB drive capacity is larger than 16GB. This was true on some very old systems about 20 years ago, but AFAIK, it is not required for systems that are in service today. So the limitation makes no practical sense to me, except to prevent more sales of Kon-Boot licences so that it can be installed onto larger USB drives including large Easy2Boot USB Flash drives and USB hard-disk drives! In fact, what is more important, is that they should create a second Primary partition on the USB drive because there are still systems about which require this for MBR\Legacy booting!

Note: later versions now have no 16gb restriction after I asked them to remove the restriction 😉

 

Since Kon-Boot v2.7 one purchased license allows user to install on one and only one selected USB pendrive. Meaning the newest version will be installed only on this one selected USB pendrive (newest Kon-Boot files will be generated only for this device and they will not be visible in the installation package). For usability purposes, older versions of Kon-Boot will be allowed to be installed on a separate USB pendrive.
In short the BIOS part version can be older, the UEFI kon-boot part gets updated and locked to the USB drive on installation.

Kon-Boot does not, per se, support Secure Boot...

However, we can make a E2B+agFM USB Flash drive which can Secure Boot and break into Windows without needing a user password (as long as they don't use a Domain account and have USB Booting enabled in the BIOS settings).

I have included full details of how to make a Secure Boot version of Kon-Boot on an E2B+agFM USB drive in version 1.4 of eBook #4. So just use your confirmation email link to download the new version of the PDF.

Tip: You know it has worked if it takes 1-2 minutes to boot to Windows after this message!

If it boots very quickly then it hasn't worked (check there were no error messages displayed).

If you get a red 'Guru meditation' text screen, then you are not using the correct USB drive that you originally licensed - see FAQ.

P.S. I find that using a hacked Windows system can sometimes cause security issues with some apps and browsers, etc. So whether I use Kon-Boot or the UtilMan XML hack in Easy2Boot, once I get into Windows the first thing I do is make a new Admin account and then reboot (and undo any hack if required). I then have full admin access on an unhacked (unmodified) Windows system. The new Admin account can be removed after I have finished fixing the system or retrieving files, etc.

agFM v1.38 is now available

If you boot on a Secure Boot UEFI64 system, you may sometimes get a Secure Boot error when booting certain ISOs - e.g. Parrot OS.

The way to avoid this is to use the F4 Settings menu and 'Install override security policy' just before you boot from the ISO...

The latest version of E2B's agFM now does this for you automatically when you select the (partnew/Easy2Boot) or (map) boot options.

Parrot OS can thus be given the .isodef file extension and it should secure boot without needing to use F4 - Install override security policy first.

Update agFM

To update to the current released version of agFM, run the .cmd file on the agFM partition:

DrWeb LiveDisk (with non-persistent updates!)

I have updated the blog for DrWeb here and also provided a downloadable .imgPTN23 image file which can be used by E2B and agFM for UEFI64 booting. It seems however that the updates are not persistent even using a flash drive made with their utility!

eBook #4 PDF on agFM has now been revised

Download the latest version using the URL in your confirmation email from Payhip.

As well as some typos, it has updated and added information to be consistent with the latest version of agFM.

agFM v1.37 available with Ukrainian language + updates and new agFM video uploaded

I have uploaded a new video demonstrating agFM v1.37 and the best way to add ISOs for AV, Windows Install, WinPE, Linux, etc.

1. Latest agFM build
2. Update languages - add Ukrainian uk_AU
3. Change bootup message
4. Add \agFM_version.txt file to hold agFM version number
5. Update the SAMPLE_startup_menu.txt file and add in new variables
6. Add .isowin type
7. Add sample .cfg files for DLCBoot and nbrt.
8. Fix UEFI not booting as drive 0 issue

Download from Alternate Downloads area for a1ive grub2 File Manager.

Don't know why, but the volume is fine before I upload it to YT, but then it's always too quiet when streaming from YT - it's very annoying!

agFM v1.35 with updated German, Spanish, Hebrew and Polish languages

agFM v1.35 has updates for German, Spanish, Hebrew and Polish translations.

To update, just extract the files to your FAT32 2nd partition and overwrite the existing files.

See previous blog post on how to easily modify any of the language strings.

Many thanks to the translators who have contributed so far.

Call for help with agFM translation - it's easy!

As you may have noticed, the a1ive grub2 File Manager supports different languages, however many words and phrases have not yet been translated. This is where you can help...

You can easily add or revise a translation using the crowdin app. This is a web-based app which allows you to simply type in the translation for each word or phrase used by the agFM menu system.

To translate

1. First create a new crowdin account. You can sign-in in a number of different ways. Don't forget to confirm your email address when the request is emailed to you (check you Spam folder if it does not appear).

Crowdin

2. Click the language you would like to translate. e.g. French

3. Click "fm.pot" and start translation. (e.g. https://crowdin.com/translate/grub2-filemanager/8/en-fr)

4. Select each word or phrase from the left-hand side and type in the translated word or phrase (1) and save it (2). Do this for each entry (there may be more than one page).

5. Once translated, the crowdin bot will create a pr automatically (https://github.com/a1ive/grub2-filemanager/pull/126)"

I will then compile a new version of agFM after a few days.

E2B eBook #4 updated

I hope you are well and have not suffered seriously from Corona.

One of my neighbours, a lovely old lady called Irene, sadly died yesterday, so please make sure you look after your vulnerable family members and friends during these difficult times.

eBook #4 on agFM and UEFI-booting

I have just updated eBook #4 to v1.2. So please use the URL you were sent to get the latest version.

You could also check that you have the latest versions of the other eBooks too.

Since you may be self-isolating now due to Corona, it might be a good time to actually read the eBooks and maybe get your multiboot USB fully working with all your payload files?

E2B eBooks

P.S. eBook #4 is still at the reduced price of $7 (RRP $10) and you can get 10% off ALL the eBooks when you purchase more than one.

E2B v2 YouTube video is up

agFM v1.34 now released

This version has a few small bugfixes...

• F1 now shows true Secure Boot status
• En-us language added to F4 Language menu
• Fix clover UEFI32 bug in \e2b\alive grub2 filemanager.mnu

To UEFI32 boot to Clover, you will need to update the alive grub2 filemanager.mnu file in your E2B \_ISO\MAINMENU folder. The previous version sometimes boots to UEFI64 instead of UEFI32!

To update. you can click on "\e2b\Update agFM\Download and update agFM.cmd" to download the latest release version and then extract it to the root of the FAT32 agFM partition #2.

Look at the date of the README.md file to see what version you have.

P.S. eBook #4 on agFM has been updated to v1.1.


P.S. This latest Bangood Special Offer made me smile...

False alarm! grubfm does not corrupt UEFI firmware.

A user reported that after UEFI64-booting grubfm, his UEFI firmware (Lenovo B40 30 laptop) was corrupted  and he could no longer get into the BIOS Setup menu system.

Since he blamed A1ive's grubfm and the UEFI Kaspersky Shim for this, I added a warning to the agFM web page on the E2B site.

However, now he has confirmed that the firmware corruption was due to booting to Ubuntu and was not by agFM itself.

It was an issue with the linux kernel. If you remember during release of Ubuntu 17.10 there was an issue of bios corruption ? it was a similar issue. Though it happened with the latest linux kernel 5.3.0.40

Detailed in a bug report on Canonical's Launchpad platform, the issue is serious: Installing Ubuntu 17.10 on selected Lenovo, Acer, and Toshiba laptops can cause corruption in the UEFI firmware which presents itself as an inability to make any changes post-corruption. In serious news for systems without a built-in optical drive, the corruption also disables the ability to boot from a USB storage device.

Tracked down to the Intel Serial Peripheral Interface (SPI) kernel module, prevention is straightforward: Disabling the intel-spi-* kernel driver family prevents the corruption without any other apparent impact on the system. For those who have already had their UEFI firmwares corrupted, however, there appears to be no easy fix yet available.

So I have now removed the warning but you may need to watch out for this serious Ubuntu bug!

First YouTube video of E2B v2.00 (but in Portuguese!)

Well, it seems it took less than 24 hours after release, for someone to post a You Tube video on E2B+agFM!

Only problem is - it's in Portuguese!

I do plan to make my own YT video soon (if you want to hear about it from the horses mouth).

Meanwhile, feel free to get eBook #4 which is all about agFM and comes complete with instructions on how to add MBR+UEFI bootable AV ISOs, Linux ISOs+persistence, popular WinPE ISOs and Windows Install ISOs + unattended installs.

Easy2Boot v2.00 released

V2.00 is now released.

https://www.fosshub.com/Easy2Boot.html

The main change is that when you make a new drive, it will now download the agFM files and copy them to the second FAT32 partition (if present). This allows UEFI-booting to the agFM grub2 File Manager system. All thanks to 'a1ive' for developing his grub2 branch and agFM.

• Make_E2B.exe and Make_E2B_USB_drive.cmd - downloads agFM if 2nd FAT32 partition is made. If drive is <128Gib then 2nd FAT32 partition of approx 500MB is automatically made. Allow user to define sizes in GB of ptns1, 2 and 3 if Gear Wheel button used. If drive >128GB it always prompts user for partition 1, 2 and 3 sizes and type even if AUTO selected.
• New default wallpaper.
• .isoPE extension now updates the WinBuilder .ini files (e.g. for Gandalf ISOs) - use .isoPE extension if you get a yellow warning triangle on desktop.
• \_ISO\docs\Wincontig folder can now be copied to any volume\folder - e.g. copy to partition 3 so it will make all files on that partition contiguous.
• Update SDI_CHOCO scripts and add chocolatey.nupkg for offline install of chocolatey.
• Add support for windows ISOs on ptn3 in qrun.g4b so can have Windows Install ISOs on ptn3 or ptn2 or ptn1 and use a .mnu file, add $$Install_Win10_from_Ptn2or3.mnu sample mnu file
• Switch_E2B.exe now looks for auxiliary *. files on other volumes at \(path), then \_ISO, then \ - e.g. ptn1:\_ISO\WINDOWS\WIN10\Win10.imgptn23 and ptn3:\_ISO\WINDOWS\WIN10\Win10.
• Bugfix - Latest grldr with bugfix for non-contiguous files
• Bugfix - Fix EXTOFF variable not working in MyE2B.cfg (file extension always displayed in the menu).

Read more: https://www.easy2boot.com/download/e2b-version-history/

E2B eBook #4 on agFM is now available

The first revision v1.00 is now available here for the introductory price of $7 (RRP will be $10).

I hope to release E2B v2.00 in a few days. Please test the Beta versions of E2B v2 and agFM v.1.32 and inform me of any issues ASAP!

Please feedback any comments on the eBook and use the eBook download link that you will be emailed when you complete the purchase, to download any later revisions for free.

agFM v1.32 and Easy2Boot v2.00 Beta now available

agFM v1.32 now includes Clover boot files, so you can now UEFI-boot from the E2B Legacy menu.

Clover does have problems on some systems though, so it is of limited use!

Use the new copy of /e2b/a1ive grub2 filemanager.mnu and copy it to the \_ISO\MAINMENU folder.

The latest agFM version can be found here.

E2B is now v2.00a Beta. 

Changes (Version History) can be found under the Downloads tab on the E2B website.

https://www.easy2boot.com/download/e2b-version-history/
https://www.easy2boot.com/download/agfm-history/

P.S. The new eBook #4 on agFM is almost finished!

agFM v1.31 Beta now available

This version has some bug fixes and I have tidied up the folder structure (now has an \e2b folder).
I have found the AT keyboard scan code maps to cause issues - if you have a non-responsive keyboard then remove the terminal_input at_keyboard and keymap lines in your startup_menu.txt file!

You may need to modify your startup_menu.cfg file for the new folder structure.

I have included a sample submenu for the use Startup menu to show you how you can add more submenus to the first Startup menu.

I have also included a new example .cfg file for installing 64-bit Windows 10 ISO.

WIN10_64_INSTALL_Choose_UNAME_PCNAME_PRODUCTKEY_XML_AgFM.cfg

The sample file should be copied to any folder on the E2B drive (same partition as the ISO) and can be renamed. When run, it will ask you to choose a product key (Edition), an XML file, a user name and a PC name.

It will modify a copy of the chosen XML file  (in memory) for you.

Many thanks to Phong for reporting an issue and providing a sample .cfg file which I based this version on.

If you want the username and PC name and Product Key substitution to work, all the XML files that you include in your menu choices will need to include UNAME, PCNAME and ASKME-ASKME-ASKME-ASKME-ASKME in the relevant fields.

This could be used with Win10_Pro_US_UNAME_PCNAME_SDI_CHOCO_ASKME.xml for instance. Using this with a modified .cfg file, you will choose the Edition (Home/pro, etc), Computer Name and User Name. You will then create and format the install partitions manually on the target system using the standard Setup dialogue. The installation will then proceed unattended and if you have set up your SDI_CHOCO config and SNAPPY driver folders correctly, it will install all missing drivers and install your desired apps automatically (internet Ethernet connection required if using online app choco installs). You can use the same process for MBR\Legacy or UEFI installs.

If you use an XML which also wipes and creates partitions, the process can be fully automated but you will need one XML for UEFI GPT partitions and a different XML for MBR\Legacy partitions.

More details on XML files can be found in eBook #3.

agFM v1.29 Beta available with keyboard selection

I have added keyboard map files to agFM so that you can use AZERTY and QWERTZ and other keyboards.

The latest agFM version can be found here.

P.S. Using the console set to at_keyboard seems to stop the keyboard from working on some systems! I suggest you don't use this unless you have to!

agFM v1.28 Beta available

This version fixes a bug where the UEFI agFM menu is left on the screen and the Windows Setup form is displayed on the wrong screen so you cannot see it.

The Windows ISO appears to boot correctly and then you just see a blank agFM menu...

The Windows Setup is actually running but it is displayed on an alternate screen. In the case of my IdeaPad 300, this issue occurred randomly about 1 in every 2,3,4 or 5 boots to the Windows Install ISO!

I have now added a 'known issues' list to the end of the agFM page on the E2B website.
Please let me know if you find any more.

Windows could not update the computer's boot configuration

P.S. If you ever see this issue when installing Windows to a clean hard disk, please let me know:

I think this issue may be caused by Windows Setup not liking the BCD file on the FAT32 partition of the USB hard drive you are installing from!

I have noticed that the date&time stamp of the \EFI\Microsoft\Boot\bcd file on the USB drive has changed after Windows Setup stage 1 runs if you UEFI-boot from an E2B USB Hard drive. Setup seems to load the USB drive's bcd to see if it is the 'system' bcd??? It does not seem to change it's contents. My guess is that if it cannot load and parse it successfully the install will fail with this error message.

I started to get this error very consistently at the end of the file copy phase in Windows Setup, when installing to a blank disk in a VM and a real system (UEFI install). I tried for hours to find out what was causing it and then the error magically disappeared - probably after I used BootIce to look at the BCD file on the USB drive's FAT32 partition - but I can't be sure. This error seems to have stumped a number of people on the internet who had the same problem but I could not find anyone who had reliably identified the cause...

Latest Easy2Boot v.1.B9 and agFM Betas - call for feedback

I am thinking of releasing the next version of E2B soon.

I will rename Beta E2B v1,B9m and agFM v1.27 as Easy2Boot v2.00.

The Make_E2B utility will prompt the user to add the agFM files after downloading them.

Please can you send me a quick email with any feedback on E2B+agFM (latest versions).

In particular, I would like to know:

1. Type of E2B USB used: Removable or Fixed/HDD
2. Version tested: E2B and agFM
3. Windows Install tests: UEFI64 Windows install from ISO works OK? XML files work?  WipeDisk+SDI_CHOCO.xml files work?
4. Any issues with any particular payloads? Please give details on how I can reproduce the issue.
5. Any other feedback welcome.

Please email me at steve @ easy2boot.com  with your observations.

Note that Make_E2B.exe will only make the second agFM partition + files if you are using Windows 10 OR you are using any Windows OS plus a Fixed-disk USB drive.  i.e. If you are using Windows 7 or Windows 8 AND a Removable USB drive, then the agFM partition will not be made (because those versions of Windows cannot access a 2nd partition on Removable flash drives).

The more feedback I get, the sooner it can be released.
Thanks
Steve

agFM v1.25 available with UEFI Secure Boot from Windows Install ISOs

Todays version is v1.25 and a1ive has worked some magic and it now seems to be able to boot Windows Install ISOs even in Secure UEFI64-boot mode! (I haven't tested Secure UEFI32 as I don't have a suitable UEFI32 computer).

No more 0xc000000f BSOD errors and we don't have to create dual FAT32+NTFS .imgPTN files to Secure Boot to large Windows Installers!

By adding your own .cfg file, you can also auto-install directly from a Windows ISO in Secure Boot mode using a suitable XML file and even install Drivers and Apps automatically. If you use the Win10 1909 x64_UNAME_PCNAME.cfg config file, you can specify the Computer Name and User Name before the build starts.

Please let me know if it works for you by using the checkboxes below.

Note: If you have any problems UEFI64 booting and installing Windows directly from a Windows ISO, please let me know,

A1ive has also added an option to recognise Kaspersky ISOs and UEFI-boot to them.

Norton Bootable Recovery Tool - nbrt.iso - no EFI boot files, use the nbrt.grubfm sample file provided for UEFI booting.

agFM v1.24 now available (with support for UEFI64 boot from krd.iso)

Todays version fixes the issue of user input not accepting [BACKSPACE] which made it difficult to type in a string if you make a mistake (e.g. when specifying the computer name or user account name).

It also fixes an issue when trying to UEFI64-boot to the krd.iso Kaspersky Rescue Disk.

All credit should go to a1ive who has made the required changes to grub2 and helped with suggestions.

Note: agFM now supports krd - there is no need for a .grubfm file.

The krd.grubfm filecan be added. Just copy it from the \Menu Files to copy to payload volume folder to the \_ISO\ANTIVIRUS folder where your krd.iso is located.

When you UEFI64-boot to the agFM menu system, select the krd.iso file and then pick the 'User menu' entry.

agFM v1.23 now available with support for modifying XML files

Todays version uses the latest build of a1ive's grub2 and grubfm (the ipxe part is in Beta status, i.e. may have bugs).

The main changes in todays release are:

1. Bugfix in Win10 1909 x64.cfg - due to a change in the a1ives grubfm scripts, this now needed modifying.
2. New Win10 1909 x64_UNAME_PCNAME.cfg config file

The new Win10 1909 x64_UNAME_PCNAME.cfg file allows the user to modify the contents of any XML file.

a1ive kindly helped me with the lua script which was needed for this.

This new .cfg file means that you can use an automated install XML file but change the User Name and Computer Name before Setup runs. This is useful for computer shops who often install the same Windows Edition but need a different user account name and computer name.

The example version uses an XML file which has the user name and computer name set to UNAME and PCNAME. The script will then allow you to change those strings.

Instructions