Digg this topic Add to my del.icio.us Submit to SlashDot 2 Pages V   1 2 >  
Reply to this topicStart new topic
> Network Booting XP, With net(0)\windows!
Andy Tim
post Aug 5 2007, 05:39 PM
Post #1


Newbie
*

Group: Members
Posts: 8
Joined: 1-August 07
Member No.: 9,903


Canada


Hello everyone,

I've been messing around trying to see if I can boot Windows XP in full mode (not setup-mode or /MININT mode) entirely over the network. I've done it a million times with Windows XP PE (via BartPE). It's such an interesting process, the XP boot process...
  • The computer PXE-boots
  • A DHCP address is obtained from my Cygwin DHCPD
  • My DHCP server recommends STARTROM.N12 as a boot file
  • The computer downloads STARTROM.N12 from my Cygwin TFTPD
  • STARTROM.N12 runs and downloads NTLDR via TFTP
  • This is where we branch in different directions for BartPE and full XP, based on NTLDR. I am only discussing full XP in this post
  • The Windows XP Embedded NTLDR runs and downloads BOOT.INI via TFTP and gives the boot menu:
CODE
[boot loader]
timeout=30
default=ramdisk(0)\WINDOWS

[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional from Hard Disk" /fastdetect /sos /bootlog
ramdisk(0)\WINDOWS="ramdisk(0)\windows from net(0) HALAACPI" /fastdetect /rdpath=net(0)\foo.sdi /rdimageoffset=36352 /sos /bootlog /hal=halaacpi.dll
ramdisk(0)\windows="ramdisk(0)\windows from net(0) HALACPI" /fastdetect /rdpath=net(0)\foo.sdi /rdimageoffset=36352 /sos /bootlog /hal=halacpi.dll
net(0)\windows="net(0)\windows" /fastdetect /sos /bootlog
  • If we choose one of the ramdisk boots, NTLDR downloads FOO.SDI as a ramdisk, then starts loading the OS from it
  • If we choose the net(0)\windows option:
    • NTLDR starts loading the OS via TFTP!
      --- START OF GUESSWORK ---
    • When it's time to make the switch away from BIOS routines, the Kernel checks the ARC path which we were loaded from
      (You can use Sysinternals' [now Microsoft's] WinObj to see that ARC paths are shortcuts to filesystems)
    • The Kernel doesn't see a net(0) shortcut pointing to any filesystem
      --- END OF GUESSWORK ---
    • The Kernel displays a Blue Screen of Death with STOP 7B

Although it's guesswork, I think I might have learned something about the boot process that I never knew before... I always thought UNMOUNTABLE_BOOT_VOLUME had to do with not having a device (under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}) with a MatchingDeviceID of "gendisk" and not having a device (under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE, for example) with a ComptabileIDs including "GenDisk". Now I don't think so. Now I think this is what happens:
  • As .SYS files are being loaded (as seen with /SOS), each one has an initialization routine which is called
  • Microsoft's RAMDISK.SYS recognizes an available ramdisk loaded by NTLDR and associates that memory with a volume (like \Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750})
  • RAMDISK.SYS then creates a shortcut from ramdisk(0) to the volume, as can bee seen with WinObj
  • When the Kernel decides to switch from using BIOS routines, it checks the ARC path
  • The Kernel sees the shortcut from the ARC path of "ramdisk(0)" to "\Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}", so it uses the NTFS filesystem all the way through the MS Ramdisk Controller to access the volume

I could be wrong; it could be NTLDR who makes the ramdisk(0) ARC shortcut. Whatever.

If this is all true, and all you need is an ARC shortcut to your boot volume, perhaps someone could write a small .SYS file who will be loaded at boot time and make the "net(0)" shortcut point to "\Device\LanmanRedirector\Registry_stored_fileserver\Registry_stored_fileshare". Then maybe at the big switch, we wouldn't get a blue screen!

The point of all of this is to run full XP over the network, without using a ramdisk. Let me know what you think.
Go to the top of the page
 
+Quote Post
jaclaz
post Aug 5 2007, 06:46 PM
Post #2


Finder
***

Group: Advanced user
Posts: 1,622
Joined: 14-July 06
Member No.: 2


Italy


You have some interesting points raised. (IMG:http://www.boot-land.net/forums/style_emoticons/default/smile.gif)

Coincidentally, in this period I am trying to do some experiments with the innards of Recovery Console, and some points appear to be "common".

As a matter of fact, in both SETUPLDR.BIN and NTLDR there is VERY near to the text ramdisk(0) the text net(0) but if you look at the text of error messages further on, some messages:
QUOTE
RDMTFTPTIMEOUT =

RDMTFTPADDR =

Downloading Ramdisk using MTFTP.

ArcOpen(%s) failed:


(bolding is of course mine)

Since usually error messages are in the same order of the sequence of operations that may fail, it appears that the net(0)/TFTP "calls" the Ramdisk, so my guess is that some serious modifications to NTLDR itself are needed...(IMG:http://www.boot-land.net/forums/style_emoticons/default/dubbio.gif)

It is also well possible that one might nees a "less picky" NTDETECT.COM, like the modified Dietmar's one... (IMG:http://www.boot-land.net/forums/style_emoticons/default/unsure.gif)

Though with MS guys you never know, a few lines below there is this error message:
QUOTE
Sorry, wasn't talking to you!

(IMG:http://www.boot-land.net/forums/style_emoticons/default/roll1.gif)

Here are screenshots of Recovery Console MAP and MAP ARC commands when booted directly and through RAMdisk:
Attached File  RC_direct.bmp ( 151.9K ) Number of downloads: 109

Attached File  RC_ramdisk.bmp ( 151.9K ) Number of downloads: 84


That confirm that even in the "lower level" Recovery Console, Ramdisk(0) creates an ARCPATH to "\Device\Ramdisk{d9b257fc-684e-4dcb-ab79-03cfa2f6b750}"

jaclaz
Go to the top of the page
 
+Quote Post
Andy Tim
post Aug 5 2007, 07:36 PM
Post #3


Newbie
*

Group: Members
Posts: 8
Joined: 1-August 07
Member No.: 9,903


Canada


Er, um, would you mind sharing how you booted CMDCONS on a ramdisk? Thanks. (IMG:http://www.boot-land.net/forums/style_emoticons/default/mellow.gif)

By the way, my CMDCONS shows RAMDISK.SY_ in there, so it still could be NTLDR (or OSLOADER.EXE, SETUPLDR.EXE, SETUPLDR.BIN, CMLDR, etc.) loads the ramdisk, but RAMDISK.SYS handles filesystem calls to the volume once the switch from BIOS routines are made. Then again, my CMDCONS' SETUPREG.HIV doesn't have ramdisk as a service.

Thanks for the awesome reply.
Go to the top of the page
 
+Quote Post
windrv
post Aug 6 2007, 01:10 AM
Post #4


Advanced Member
***

Group: Developer
Posts: 73
Joined: 14-February 07
Member No.: 3,312


China


more simplified and superior approach and less headache:

http://windrv.net/viewthread.php?tid=18&extra=page%3D1
Go to the top of the page
 
+Quote Post
jaclaz
post Aug 6 2007, 08:19 AM
Post #5


Finder
***

Group: Advanced user
Posts: 1,622
Joined: 14-July 06
Member No.: 2


Italy


QUOTE (Andy Tim)
Er, um, would you mind sharing how you booted CMDCONS on a ramdisk? Thanks.


Yes, sure, I am putting together a complete howto, you'll have to wait a few days.

Briefly, it all began here:
http://www.boot-land.net/forums/index.php?...ic=2692&hl=

I first created a Recovery Console only .iso:
http://www.boot-land.net/forums/Recovery-Console-t2254.html

modifying slightly the batch to stop execution before making the .iso to give me time to put in the source directory the Server 2003 SP1 RAMDISK.SY_ instead of the XP SP2 one.

Then I made a bootsector invoking SETUPLDR.BIN:
http://www.boot-land.net/forums/index.php?showtopic=2362

Then I put a copy of the .iso and of the bootsector together with a NTLDR, SETUPLDR.BIN and NTDETECT.COM, a BOOT.INI with this line:
QUOTE
C:\SETUPLDR.BS="XP Setup Ramdisk through sector"

and a WINNT.SIF as follows:
QUOTE
[SetupData]
BootDevice = "ramdisk(0)"
BootPath = "\I386\"
OsLoadOptions = "/noguiboot /fastdetect /rdexportascd /rdpath=XPRC.ISO"


Lately I went a bit further:
http://www.boot-land.net/forums/index.php?...c=2362&st=7

I still have to try a ramdisk(0) setup for the latter, and I am experimenting with various (semi-random) ideas, including getting rid of all the non-normally-needed drivers....(IMG:http://www.boot-land.net/forums/style_emoticons/default/smile.gif)

QUOTE (Andy Tim)
Then again, my CMDCONS' SETUPREG.HIV doesn't have ramdisk as a service.

Just a guess, mind you, but would it be possible that the only difference between XPSP2 and SERVER 2003 SP1 files is the need for an entry in SETUPREG.HIV or, for the latter, the lack of this need?
Bilou_gateux reported that it is possible to use RAMDISK.SY_ from XP SP2 by adding some keys in the Registry and/or adding ramdisk.inf, but cannot say if it would work with SETUPREG.HIV:
http://www.911cd.net/forums//index.php?sho...19056&st=44

Also, see if you can find some sense in my blah blah here:
http://www.boot-land.net/forums/index.php?...c=1441&st=3


jaclaz
Go to the top of the page
 
+Quote Post
Andy Tim
post Aug 7 2007, 02:19 AM
Post #6


Newbie
*

Group: Members
Posts: 8
Joined: 1-August 07
Member No.: 9,903


Canada


Hey windrv, thanks for the reply, but I am actually trying to avoid purchasing a product like Ardence or NeoWare or DisklessAngel. Unless you are saying that map --mem and map --hook fool Windows even past the switch from using BIOS routines to using XP drivers to continue the boot process...? The big idea for me is to load full XP entirely over the network, without (permanently) using a ramdisk. If I have 256 MB RAM, I want full XP over the network to have access to 256 MB RAM.

Hey jaclaz, I totally forgot about /RDEXPORTASCD. I'll give that a try for some fun! I had read those other articles, it's all quite interesting stuff. I think I would like to find out some more about Dietmar's NTBOOTDD.SYS...
Go to the top of the page
 
+Quote Post
windrv
post Aug 7 2007, 06:35 AM
Post #7


Advanced Member
***

Group: Developer
Posts: 73
Joined: 14-February 07
Member No.: 3,312


China


QUOTE (Andy Tim @ Aug 7 2007, 02:19 AM) *
Hey windrv, thanks for the reply, but I am actually trying to avoid purchasing a product like Ardence or NeoWare or DisklessAngel. Unless you are saying that map --mem and map --hook fool Windows even past the switch from using BIOS routines to using XP drivers to continue the boot process...? The big idea for me is to load full XP entirely over the network, without (permanently) using a ramdisk. If I have 256 MB RAM, I want full XP over the network to have access to 256 MB RAM.

Hey jaclaz, I totally forgot about /RDEXPORTASCD. I'll give that a try for some fun! I had read those other articles, it's all quite interesting stuff. I think I would like to find out some more about Dietmar's NTBOOTDD.SYS...


Are you actually trying to roll out or introduce such a free product for us? (IMG:http://www.boot-land.net/forums/style_emoticons/default/thumbsup.gif)

At present, I think such free product exists for Linux. So if you want to run diskless workstation over network fileserver for free, then try Linux not Windows.
Go to the top of the page
 
+Quote Post
MedEvil
post Aug 7 2007, 09:29 AM
Post #8


Advanced Member
***

Group: .script developer
Posts: 1,822
Joined: 29-December 06
Member No.: 2,192



QUOTE (Andy Tim @ Aug 7 2007, 04:19 AM) *
The big idea for me is to load full XP entirely over the network, without (permanently) using a ramdisk. If I have 256 MB RAM, I want full XP over the network to have access to 256 MB RAM.

Wouldn't such an OS be terribly slow?

(IMG:http://www.boot-land.net/forums/style_emoticons/default/cheers.gif)
Go to the top of the page
 
+Quote Post
Andy Tim
post Aug 7 2007, 05:41 PM
Post #9


Newbie
*

Group: Members
Posts: 8
Joined: 1-August 07
Member No.: 9,903


Canada


Hey windrv,
Driver programming has always been something I have avoided. I don't have access to the MS DDK, just the open source alternatives available on the 'net. I have only just recently compiled Sysinternals' NATIVE.EXE NT "native-mode" exectuable, something like Autochk.exe or the PartitionMagic stuff you see when PM is busy changing things after a reboot.
I might try to get into it. I love skeleton projects of things. I'm going to keep investigating. If I figure it out, it'll definitely be open source since there are already such things for sale.

Hey MedEvil,
Actually I am looking at this for a large organization who plans on using Citrix anyway, where pretty well all processing will be happening centrally, so no, I don't think the OS would be terribly slow.
Another scenario where I would want the OS running entirely over the network is just for utilitarian purposes. Somebody's computer keeps BlueScreening, I tell my DHCP server to tell them to boot from the network instead of the local hard drive. They boot a standard image for their PC model, then they can access their files on the C: just to get them off, or I can remote control the PC and manually load the registry hives from the C: to get rid of the driver (maybe a virus) causing the problem. Or maybe I just re-image the C: remotely. I have found that a network-booted XP PE (like BartPE) is very handy for this sort of thing, but still limited. I'd rather have a real XP running. Then I can sell the idea to management and we can have absolute central control of every PC in the organization, as long as they're set to PXE-boot in BIOS.

I am thinking that I need to write a .SYS driver who makes an ArcName shortcut from net(0) to \Device\LanmanRedirector. This is what a network-booted BartPE has. An important thing I've noticed while messing around is that if the booted image has conflicting network adapters on top of the built-in setup network adapter, NDIS.SYS will cause a BlueScreen.

I am thinking that if I want the OS to run over the network wirelessly, a full-blown .SYS driver would have to be coded. As I mentioned in an ImDisk post, I envision the driver as something like an IDE or SCSI controller. It fakes a physical disk by redirecting I/O over the network using low-level network routines, maybe Ethernet, maybe IP. I also see it functioning something like EWF, storing the delta (changes) made to the image separately, so many clients can boot from the same image. The administrator chooses whether their changes are saved or discarded. I also see the ability to switch during run-time, once Windows networking gets started successfully, to using Windows' higher-level networking to continue accessing the datastore. There should be failover functionality so that if the datastore becomes unavailable, disk I/O becomes unavailable until it becomes available again maybe over another network connection, like wireless or VPN or another NIC.

This is only different from Ardence and NeoWare with the high-level networking switch and the failover features I'm talking about. Maybe Ardence or NeoWare will put these features in their next version!
Go to the top of the page
 
+Quote Post
Andy Tim
post Aug 8 2007, 01:59 AM
Post #10


Newbie
*

Group: Members
Posts: 8
Joined: 1-August 07
Member No.: 9,903


Canada


Hey everyone, I really hope this is considered OK to post, please let me know if it isn't.

I took a look at Ardence' product for network booting. A few details follow... While the Boot Sequence section is incomplete, it still shows some action. "LD" means driver was loaded, try to guess what "NL" stands for. The .SYS files without "---->" next to them I haven't checked. I will have to read up on why some drivers appear to be loaded apart from others in their group.

The files marked with asterisks to their right are part of the Ardence product.

A major difference with Ardence is that it loads NDIS stuff before Primary Disk, which is way earlier than a regular XP does. Is Primary Disk where we get UNMOUNTABLE_BOOT_VOLUME?

I will edit this post when I've completed the boot sequence listing.

CODE
Ardence Notes
~~~~~~~~~~~~~
vDisk:
The vDisk file is an HDD image with one extra sector at the beginning.  The first partition should be an offset of 64 sectors, then.

Boot Sequence as per NTBTLOG.TXT:
LD: \WINDOWS\system32\ntoskrnl.exe
LD: \WINDOWS\system32\hal.dll
LD: \WINDOWS\system32\KDCOM.DLL
LD: \WINDOWS\system32\BOOTVID.dll

[ Boot Bus Extender ]
LD: ACPI.sys -------> (Depends on WMILIB.SYS)
LD: WMILIB.SYS -----> (Dependency)
LD: pci.sys -------->
LD: isapnp.sys ----->

[ System Bus Extender ]
LD: compbatt.sys ---> (Depends on BATTC.SYS)
LD: BATTC.SYS ------> (Dependency & Service)
LD: intelide.sys ---> (Depends on PCIIDEX.SYS)
LD: PCIIDEX.SYS ----> (Dependency)
LD: pcmcia.sys ----->
LD: MountMgr.sys --->
LD: ftdisk.sys ----->
LD: PartMgr.sys ---->
LD: VolSnap.sys ---->

[ NDIS Wrapper ]
LD: NDIS.sys ------->

[ NDIS ]
LD: el90xbc5.sys --->
LD: bnns.sys -------> Network Intermediate Filter Driver (Depends on TDI.SYS) ******
LD: TDI.SYS --------> (Dependency)

[ Ardence ]
LD: bnistack.sys ---> Ardence Virtual HBA SCSI Disk Device (Depends on BNNS.SYS) ***
LD: bnsm.sys -------> Ardence SCSI Miniport Driver (Depends on SCSIPORT.SYS) *******
LD: SCSIPORT.SYS ---> (Dependency)
LD: bnsmdf.sys -----> Ardence SCSI Miniport Disk Filter Driver *********************

[ SCSI miniport ]
LD: atapi.sys ------>

[ SCSI Class ]
LD: disk.sys -------> (Depends on CLASSPNP.SYS)
LD: CLASSPNP.SYS ---> (Dependency)

[ FSFilter Infrastructure ]
LD: fltMgr.sys ----->

[ FSFilter System Recovery ]
LD: sr.sys --------->

[ Base ]
LD: KSecDD.sys ----->

[ File system ]
LD: Ntfs.sys ------->

[ Network ]
LD: Mup.sys -------->

[ !!!NO GROUP!!! ]
LD: BNPort.sys -----> Ardence PortBlocker Driver ***********************************
LD: bnnf.sys -------> Filter Driver for NDIS NIC ***********************************

[ PnP Filter ]
LD: agp440.sys ----->

[ Extended Base ]
LD: p3.sys --------->

[ !!!NO GROUP!!! ]
LD: CmBatt.sys ----->

[ Video ]
LD: ati2mtag.sys --->

[ Base ]
LD: usbuhci.sys ---->

[ Keyboard Port ]
LD: i8042prt.sys --->

[ Pointer Class ]
LD: mouclass.sys --->

[ Keyboard Class ]
LD: kbdclass.sys --->

[ System Bus Extender ]
LD: fdc.sys -------->

[ Extended base ]
LD: serial.sys ----->

[ PNP Filter ]
LD: serenum.sys ---->


LD: parport.sys
LD: ac97intc.sys
LD: audstub.sys
LD: rasl2tp.sys
LD: ndistapi.sys
LD: ndiswan.sys
LD: raspppoe.sys
LD: raspptp.sys
LD: msgpc.sys
LD: psched.sys
LD: ptilink.sys
LD: raspti.sys
LD: rdpdr.sys
LD: termdd.sys
LD: swenum.sys
LD: update.sys
LD: mssmbios.sys
LD: NDProxy.SYS
NL: NDProxy.SYS
LD: usbhub.sys
NL: lbrtfdc.SYS
NL: Flpydisk.SYS
NL: Sfloppy.SYS
NL: i2omgmt.SYS
NL: Cdrom.SYS
NL: Changer.SYS
NL: Cdaudio.SYS
LD: Fs_Rec.SYS
LD: Null.SYS
LD: Beep.SYS
LD: vga.sys
LD: RDPCDD.sys
LD: Msfs.SYS
LD: Npfs.SYS

[ Streams Drivers ]
LD: rasacd.sys

[ PNP_TDI ]
LD: ipsec.sys
LD: tcpip.sys
LD: netbt.sys

[ !!!NO GROUP!!! ]
LD: ipnat.sys
LD: wanarp.sys

[ TDI ]
LD: afd.sys

[ NetBIOSGroup ]
LD: netbios.sys

[ PCI Configuration ]
NL: PCIDump.SYS

[ Network ]
LD: rdbss.sys
LD: mrxsmb.sys

[ Pnp Filter ]
NL: Imapi.SYS


LD: Fips.SYS
LD: ndisuio.sys
NL: rdbss.sys
NL: mrxsmb.sys
LD: mrxdav.sys
LD: ParVdm.SYS
LD: srv.sys
NL: ipnat.sys
LD: TDTCP.SYS
LD: RDPWD.SYS
LD: wdmaud.sys
LD: sysaudio.sys
LD: splitter.sys
LD: aec.sys
LD: swmidi.sys
LD: DMusic.sys
LD: kmixer.sys
LD: drmkaud.sys
LD: HTTP.sys

Ardence changed the driver group load order from:
-------------------------------------------------
System Reserved
Boot Bus Extender
System Bus Extender
SCSI miniport
Port
Primary Disk
SCSI Class
SCSI CDROM Class
FSFilter Infrastructure
FSFilter System
FSFilter Bottom
FSFilter Copy Protection
FSFilter Security Enhancer
FSFilter Open File
FSFilter Encryption
FSFilter Compression
FSFilter HSM
FSFilter Cluster File System
FSFilter System Recovery
FSFilter Content Screener
FSFilter Continuous Backup
FSFilter Replication
FSFilter Anti-Virus
FSFilter Undelete
FSFilter Activity Monitor
FSFilter Top
Filter
Boot File System
Base
Pointer Port
Keyboard Port
Pointer Class
Keyboard Class
Video Init
Video
Video Save
File System
Event Log
Streams Drivers
NDIS Wrapper
COM Infrastructure
UIGroup
LocalValidation
PlugPlay
PNP_TDI
NDIS
TDI
NetBIOSGroup
ShellSvcGroup
SchedulerGroup
SpoolerGroup
AudioGroup
SmartCardGroup
NetworkProvider
RemoteValidation
NetDDEGroup
Parallel arbitrator
Extended Base
PCI Configuration
MS Transactions
-------------------------------------------------
To:
-------------------------------------------------
System Reserved
Boot Bus Extender
System Bus Extender
NDIS Wrapper
NDIS
Ardence
SCSI miniport
Port
Primary Disk
SCSI Class
SCSI CDROM Class
FSFilter Infrastructure
FSFilter System
FSFilter Bottom
FSFilter Copy Protection
FSFilter Security Enhancer
FSFilter Open File
FSFilter Encryption
FSFilter Compression
FSFilter HSM
FSFilter Cluster File System
FSFilter System Recovery
FSFilter Content Screener
FSFilter Continuous Backup
FSFilter Replication
FSFilter Anti-Virus
FSFilter Undelete
FSFilter Activity Monitor
FSFilter Top
Filter
Boot File System
Base
Pointer Port
Keyboard Port
Pointer Class
Keyboard Class
Video Init
Video
Video Save
File System
Event Log
Streams Drivers
COM Infrastructure
UIGroup
LocalValidation
PlugPlay
PNP_TDI
TDI
NetBIOSGroup
ShellSvcGroup
SchedulerGroup
SpoolerGroup
AudioGroup
SmartCardGroup
NetworkProvider
RemoteValidation
NetDDEGroup
Parallel arbitrator
Extended Base
PCI Configuration
MS Transactions
---
Go to the top of the page
 
+Quote Post

2 Pages V   1 2 >
Fast ReplyReply to this topicStart new topic

Members Who Viewed Topic Today ()

 

RSS Lo-Fi Version Time is now: 3rd March 2008 - 08:21 AM

MKPortal ©2003-2006 mkportal.it