Re: EWF and Remote Boot
From: Slobodan Brcin \(eMVP\) (sbrcin_at_ptt.yu)
Date: 06/30/04
- Next message: Nik Giachino: "DISK EWF Flash drive questions--Please give me a hand!"
- Previous message: Chuck Chopp: "Re: Windows XP Embedded and Virtual PC"
- In reply to: Yasutaka Nakamura: "Re: EWF and Remote Boot"
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 30 Jun 2004 16:02:21 +0200
Few more question and I'm out of ideas.
Where did you run FBA?
And I could now find in previous posts, what type of Flash Disk are you using?
If you run FBA of HDD and then copy image of HDD to Flash, make sure to disconnect HDD from your target machine when using flash
disk.
Your remote boot image probably execute something during the boot that changes DiskID, or you have two Disks in your target device
with same ID. (It that case I have no idea what will Windows DO)
Regards,
Slobodan
"Yasutaka Nakamura" <anonymous@discussions.microsoft.com> wrote in message news:239d601c45ea5$c97a5970$a401280a@phx.gbl...
> Hi KM-san and Slobodan-san,
>
> I traced Flash Disk XPe's registry which KM-san mentioned
> at each points.
> As KM-san said, there are difference in registry at
> before and after of remote boot(See bellow).
>
> ### before remote boot ###
> [HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]
> "\\??\\Volume{2c7bd920-ca7e-11d8-b7c7-806d6172696f}"
> =hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
> "\\DosDevices\\C:"=hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
>
> ### after remote boot ###
> [HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]
> "\\??\\Volume{2c7bd920-ca7e-11d8-b7c7-806d6172696f}"
> =hex:cc,35,1c,e7,00,7e,00,00,00,00,00,00
> "\\DosDevices\\C:"=hex:bb,63,10,85,00,7e,00,00,00,00,00,00
> "\\??\\Volume{1a9cbcd0-ca80-11d8-a46b-806d6172696f}"
> =hex:bb,63,10,85,00,7e,00,00,00,00,00,00
>
> XPe of Flash Disk recognizes the Flash disk as defferent
> flash disk.
> So, I analyzing boot sector of flash disk at before and
> after of remote boot. There are 4 byte difference in it
> (offset 0x1B8, 0x1B9, 0x1BA and 0x1BB).
> These area specifies Disk signature.
>
> So, I tryed bellow process, I confirmed that RAM EWF
> works correctly.
>
> 1) Back up the boot secter(512MB).
> 2) Do ewfmgr -commitanddisable and resart.
> 3) Do remote boot.
> 4) After remote boot and shutdown, pull flash disk from
> target device and write back back up boot secter data.
> 5) Plug flash disk to target device and boot from the
> flash disk.
>
>
> But there is a thing to which it can not be convinced yet.
> This strange phenomenon occur at 512MB Flash disk only
> not at 256MB Flash Disk in spite of same manufacture's
> priducts. Why?
>
> Regards,
>
> ---
> Yasutaka
>
> >-----Original Message-----
> >Yasutaka,
> >
> >Even though the XPe docs state "If all volumes are
> protected by RAM overlay,
> >the EWF volume is minimal in size, less than 32 KB.",
> the size of the EWF
> >partition may vary and may be more than 32K (I don't
> know exact limits,
> >though).
> >To prove that (beside your own investigation), you can
> just analyze the
> >FBAlog.txt on page
> >http://msdn.microsoft.com/library/en-
> us/xpehelp/html/xerefprotectedvolumeconfiguration.asp. I
> >don't know the actual algorith how EWF size is
> calculated but it seems it
> >has to do with the disk size it gets created on.
> >
> >It is hard to think this time of the day (night,
> actually) but I think you
> >are right that EWF fails in your case after the Flash
> Disk is detected as
> >new hardware (after remote boot).
> >You can try analyzing [HKLM\SYSTEM\MountedDevices] reg
> key at all the steps
> >you do (on your running Flash disk image, just before
> the EWF
> >commitanddisable, at the remote boot image time, after
> the remote boot). It
> >may also help reviewing the key offline to find out at
> which stage it gets
> >changed.
> >
> >Also check
> >[HKLM\ControlSet001
> \Services\EWF\Parameters\Protected\Volume0],"VolumeID"
> >value on your Flash disk image before and after the
> remote boot. It is
> >probably going to be the same value in contrast to to
> the MountedDevices
> >VolumeID's changed.
> >
> >KM
> >
> >> Hi KM and Slobodan,
> >>
> >> I am sorry to be late for you reply.
> >> I tested according to your adivece. (I am sorry too
> long
> >> and poor English text...)
> >>
> >> 1.EWF Config Partition
> >> I checked FBALOG.TXT file to get EWF config partition
> >> start address. So I found difference between 256MB
> Flash
> >> and 512MB Flash.
> >>
> >> 1)256MB Flash's FBALOG.TXT
> >> XX:XX:XX PM Allocating EWF in PRIMARY partition
> >> start=0x0..0F300000, len=0x0..08000
> >> XX:XX:XX PM Created EWF partition on Disk=0,
> >> partition=2,size=0x0..08000
> >>
> >> 2)512MB Flash's FBALOG.TXT
> >> XX:XX:XX PM Allocating EWF in PRIMARY partition
> >> start=0x0..01e744000, len=0x0..0fc00
> >> XX:XX:XX PM Created EWF partition on Disk=0,
> >> partition=2,size=0x0..0fc00
> >>
> >> If my understanding for EWF config partition is right
> >> (always 32KB), is EWF partision size correct?
> >>
> >> 2. EWF partion compare.
> >> 1) I read EWF config partition before
> execute "commitand
> >> disable".( I call this "EWFContent.0".)
> >>
> >> 2) I read EWF config partition after "commitanddsiable"
> >> and shutdown.(I call this "EWFContent.1".)
> >>
> >> Thre was some differents ammong above two content. I
> >> compared two contents using "fb /b" and result is
> bellow.
> >> >fc /b EWFContent0.bin EWFContent1.bin
> >> 000004CC: 00 02
> >> 000004D0: 00 01
> >>
> >> 3) Next I plug flash disk to target device and remote
> >> boot it and shutdown. After that I read EWF config
> >> partition(I call "EWFContent.2"), but there was no
> >> defference bettween EWFContent1 and EWFContent2.
> >>
> >> 4) After 3) procedure, I boot target device from flash
> >> disk. I found XPe image found new hardware and require
> >> reboot to use new device(I could not find what device
> was
> >> found). At this time EWF did not works correct.
> >>
> >> 5) I reboot devaice again, EWF status is "enable"(!)
> and
> >> ewfmgr.exe return error at using with parameter
> >> "-disable" and "-nocmd" ("commit"
> and "commitanddisable"
> >> is returned no error).
> >>
> >> 6) I restart target device several times, but above
> >> condition did not changed.
> >>
> >> 3. EWF in remote boot
> >> My remote boot image does not include EWF components,
> so
> >> I did not test.
> >>
> >> 4. Minlogon/Winlogon and way of restart.
> >> 1) My image baed on -
> >> Flash Disk XPe image : Winlogon based
> >> Remote Boot image: Minlogon based
> >>
> >> 2) I restart target device from my application by using
> >> Windows API "ExitWindowsEx".
> >>
> >> 5. advice from Slobodan
> >> >- Commitanddisable.
> >> >- Reboot again in flash XPe.
> >> >- Check if RAM EWF is disabled.
> >>
> >> EWF is disabled (OK!)
> >>
> >> >- Reboot in remote image.
> >> >- Reboot back in XPe and check EWF state.
> >>
> >> Flash disk image notify that found bew hardware and
> >> require restart. At this time ewfmgr.exe return
> >> code "error 1".
> >> Restart again, EWF is enabled(!). This is same
> phenomenon
> >> above result I tryed.
> >>
> >>
> >> I guess that some sector might be changed at remote
> boot
> >> and XPe on Flash Disk detect Flash Disk as new
> hardware.
> >> At this time EWF did not works correctly. After that
> EWF
> >> incorrect-operates after that.
> >>
> >> How dou you think?
> >>
> >> Regards,
> >>
> >> ---
> >> Yasutaka
> >>
> >>
> >> >-----Original Message-----
> >> >Yasutaka,
> >> >
> >> >1. Since you are using RAM EWF and commitanddisable
> you
> >> can configure it trough registry only. (This will
> >> eliminate possibility for
> >> >problem that Konstantin would like that you test).
> >> >
> >> >2. On your current state try:
> >> >- Commitanddisable.
> >> >- Reboot again in flash XPe.
> >> >- Check if RAM EWF is disabled.
> >> >- Reboot in remote image.
> >> >- Reboot back in XPe and check EWF state. (If EWF
> >> partition is trashed this is something for MS).
> >> >
> >> >3. You should use commands Konstantin mentioned for
> >> reboot, but they are not relevant. EWF is here to
> protect
> >> you against power
> >> >loses so this would not explain this problem.
> >> >
> >> >Regards,
> >> >Slobodan
> >> >
> >> >
> >> >"KM" <konstmor@nospam_yahoo.com> wrote in message
> >> news:eaBQv2NXEHA.2852@TK2MSFTNGP12.phx.gbl...
> >> >> Yasutaka,
> >> >>
> >> >> I know this may sound silly but ...
> >> >> Have you tried exploring EWF config volume content
> >> offline? (you mentioned
> >> >> "configured RAM EWF through additional partition").
> >> >>
> >> >> When you do "commitanddisable" on Flash, shutdown
> the
> >> device, plug-in the
> >> >> flash card in to another machine and read sectors
> out
> >> of the EWF config
> >> >> partition. Save the sectors in a file (32K size
> file,
> >> let say EWFContent.1).
> >> >> Then plug the card back in to the target device,
> >> remote boot it, shutdown
> >> >> again and capture the EWF config partition content
> >> again (EWFContent.2).
> >> >> Do a binary comparison of the EWFContent.1 and
> >> EWFContent.2 files. If there
> >> >> were no infuence of the Remote Boot image on the EWF
> >> Config partition, you
> >> >> won't see any difference.
> >> >>
> >> >> Also, if you include EWF (disabled all time!)
> >> component (EwfMgr, Ewf API) in
> >> >> to the Remote Boot image and read the state of EWF
> on
> >> the Flash while
> >> >> network booting, what do you see? (supposedly, you
> >> should see "Disabled").
> >> >>
> >> >> And one more point to check... What is your images
> >> based on -
> >> >> Minlogon/Winlogon? How do you do the device
> >> restart/shutdown? What the
> >> >> command you use? Try using "fba -reboot", or, if
> xpepm
> >> included,
> >> >> "xpepm -reboot".
> >> >>
> >> >> KM
> >> >>
> >> >> > Hi Slobodan,
> >> >> >
> >> >> > Please refer to the following reply.
> >> >> >
> >> >> > >1. In your RAM boot image you do not have EWF
> >> component,
> >> >> > >right? (If you have remove it.)
> >> >> > [Yasutaka Nakamura]
> >> >> > I don't have EWF components(Enhaced Write Filter,
> EWF
> >> >> > NTLDR, Enahnced Write Filter API and EWF Manager
> >> Console
> >> >> > Application) in RAM boot image.
> >> >> >
> >> >> > >2. Are you using RAM or Disk overlay?
> >> >> > [Yasutaka Nakamura]
> >> >> > I am using RAM overlay in Flash Disk XPe image.
> >> >> >
> >> >> > >3. If RAM EWF is it configured trough registry or
> >> trough
> >> >> > >additional partition.
> >> >> > [Yasutaka Nakamura]
> >> >> > I configured RAM EWF through additional
> partition. I
> >> >> > configured 512MB flash disk to about 510MB for
> system
> >> >> > partition and about 2MB empty patition for RAM
> EWF.
> >> >> >
> >> >> > >4. What version of XPe are you using?
> >> >> > [Yasutaka Nakamura]
> >> >> > I am using WIndows XP Embedded with SP1
> >> >> >
> >> >> > >5. What EWF QFE version are you using?
> >> >> > [Yasutaka Nakamura]
> >> >> > I am using "Enhanced Write Filter - Hotfix
> Q823025".
> >> >> >
> >> >> > >6. What are you doing to your flash image from
> >> network
> >> >> > >booted XPe?
> >> >> > [Yasutaka Nakamura]
> >> >> > Currently I do not do anything, network boot XPe
> >> image
> >> >> > only detect Flasg Disk and restart.
> >> >> >
> >> >> > >7. Why do you commitanddisable EWF before remote
> >> boot?
> >> >> > [Yasutaka Nakamura]
> >> >> > I plan to pull the flash disk image by remote
> boot.
> >> So I
> >> >> > need EWF commitanddisable function to apply flash
> XPe
> >> >> > image settings before remote boot.
> >> >> >
> >> >> > >8. Have you tried to see if commitanddisable
> >> actually
> >> >> > >has been done, by booting to XPe from flash again
> >> before
> >> >> > >remote boot. (This should be done if you are
> using
> >> >> > >dskoverlay).
> >> >> > [Yasutaka Nakamura]
> >> >> > I test above your advice already, As long as I
> >> checked,
> >> >> > If I boot device from flash againbefore remote
> boot,
> >> EWF
> >> >> > commitanddisable works actualy.
> >> >> >
> >> >> >
> >> >> > >-----Original Message-----
> >> >> > >Hi Yasutaka,
> >> >> > >
> >> >> > >> Do you have any opnion about this phenomenon?
> >> >> > >
> >> >> > >Except that this is a phenomenon, I have no idea
> >> based
> >> >> > on this info, but you can do few tests.
> >> >> > >
> >> >> > >In one case I have seen problems with RAM EWF
> >> commit and
> >> >> > commitanddisable. (They did not write any data
> during
> >> >> > graceful shutdown
> >> >> > >with any of functions).
> >> >> > >But this would not explain that on second boot
> EWF
> >> state
> >> >> > correct itself.
> >> >> > >
> >> >> > >Now few questions:
> >> >> > >1. In your RAM boot image you do not have EWF
> >> component,
> >> >> > right? (If you have remove it.)
> >> >> > >2. Are you using RAM or Disk overlay?
> >> >> > >3. If RAM EWF is it configured trough registry or
> >> trough
> >> >> > additional partition.
> >> >> > >4. What version of XPe are you using?
> >> >> > >5. What EWF QFE version are you using?
> >> >> > >6. What are you doing to your flash image from
> >> network
> >> >> > booted XPe?
> >> >> > >7. Why do you commitanddisable EWF before remote
> >> boot?
> >> >> > >8. Have you tried to see if commitanddisable
> >> actually
> >> >> > has been done, by booting to XPe from flash again
> >> before
> >> >> > remote boot. (This
> >> >> > >should be done if you are using dskoverlay).
> >> >> > >
> >> >> > >Best regards,
> >> >> > >Slobodan
> >> >> > >
> >> >> > >"Yasutaka Nakamura"
> >> >> > <anonymous@discussions.microsoft.com> wrote in
> >> message
> >> >> > news:21ba401c45b24$c3cdc810$a401280a@phx.gbl...
> >> >> > >> Hi Slobodan,
> >> >> > >>
> >> >> > >> My information is not enough and I will give
> you
> >> more
> >> >> > >> information about this.I build two XPe image
> for
> >> my
> >> >> > >> device.
> >> >> > >>
> >> >> > >> 1) XPe image for Flash Disk.
> >> >> > >> I add EWF components (EWF, EWF NTLDR and so on)
> >> to this
> >> >> > >> image. This image works good on Flash disk.
> >> >> > >>
> >> >> > >> 2) XPe image for Remote Boot.
> >> >> > >> I add ramdisk driver component and few registry
> >> >> > settings
> >> >> > >> to detect Flash Disk. This image boot and
> detect
> >> Flash
> >> >> > >> disk correctly.
> >> >> > >>
> >> >> > >> Using above two XPe image,
> >> >> > >> 1) I execute ewfmgr.exe with "-
> commitanddisable"
> >> on
> >> >> > Flash
> >> >> > >> Disk XPe Image and restart, but the device does
> >> not
> >> >> > boot
> >> >> > >> from Flash Disk, boot from network with XPe
> image
> >> for
> >> >> > >> Remote Boot.
> >> >> > >> 2) After network booting is comlete, restart
> >> device
> >> >> > again
> >> >> > >> and device boot from Flash Disk.
> >> >> > >>
> >> >> > >> In this case EWF status of Flash disk XPe is
> not
> >> >> > correct
> >> >> > >> (EWF is Enable) in spite of EWF "-
> >> commoianddisable".
> >> >> > >> When I restart device once more gain from Flash
> >> Disk,
> >> >> > EWF
> >> >> > >> status become correct.
> >> >> > >>
> >> >> > >> Do you have any opnion about this phenomenon?
> >> >> > >>
> >> >> > >> regards,
> >> >> > >>
> >> >> > >> ---
> >> >> > >> Yasutaka
> >> >> > >>
> >> >> > >> >-----Original Message-----
> >> >> > >> >Hi Yasutaka,
> >> >> > >> >
> >> >> > >> >Could you give me more info. If you want to do
> >> remote
> >> >> > >> boot them you are following wrong doc pages.
> >> >> > >> >You don't need EWF, but you will need ramdisk
> >> driver
> >> >> > >> component.
> >> >> > >> >And few other things to set in registry.
> >> >> > >> >
> >> >> > >> >What is relation of Flash Disk to remote boot?
> >> >> > >> >
> >> >> > >> >Use following search:
> >> >> > >> >http://groups.google.com/groups?
> hl=en&lr=&ie=UTF-
> >> >> > >> 8&q=ramdisk+slobodan&btnG=Search&meta=group%
> >> >> > >> 3Dmicrosoft.public.windowsxp.embedded.*
> >> >> > >> >
> >> >> > >> >Regards,
> >> >> > >> >Slobodan
> >> >> > >> >
> >> >> > >> >
> >> >> > >> >"Yasutaka Nakamura"
> >> >> > >> <anonymous@discussions.microsoft.com> wrote in
> >> message
> >> >> > >> news:20ea301c45a90$d07dc3b0$a601280a@phx.gbl...
> >> >> > >> >> Hi all,
> >> >> > >> >>
> >> >> > >> >> I am developping XPe with SP1 device. My
> >> device uses
> >> >> > >> two
> >> >> > >> >> different size falsh disk as boot disk
> (256MB
> >> or
> >> >> > 512MB)
> >> >> > >> >> which are configured RAM based EWF(other H/W
> >> spec
> >> >> > and
> >> >> > >> XPe
> >> >> > >> >> image are complete same).
> >> >> > >> >> At our device, I do bellow operarion and
> >> experienced
> >> >> > >> >> different phenomenon between 256MB and 512MB
> >> disk
> >> >> > >> >> constantly.
> >> >> > >> >>
> >> >> > >> >> 1. Execute ewfmgr.exe with parameter "-
> >> >> > >> commitanddisable"
> >> >> > >> >> and restart device.
> >> >> > >> >> 2. Remote boot by XPe Remote Boot Service.
> >> After
> >> >> > >> Booting,
> >> >> > >> >> Boot image only detect Flash Disk and do
> >> nothing to
> >> >> > >> that.
> >> >> > >> >> After this device restart automatically.
> >> >> > >> >> 3. This time, device boot by Flash Disk.
> >> >> > >> >>
> >> >> > >> >> --- Result after above operation---
> >> >> > >> >> case 1: Device with 256MB Falsh Disk
> >> >> > >> >> There was no probrem, Flash Disk image was
> >> commited
> >> >> > >> >> certainly.
> >> >> > >> >>
> >> >> > >> >> case 2: Device with 512MB Flash Disk
> >> >> > >> >> This case seems strange!
> >> >> > >> >> - EWF is stiil enabled and My application
> can
> >> not
> >> >> > >> >> recognize EWF type(RAM or DISK).
> >> >> > >> >> - If restart device once more, EWF is
> >> disabled and
> >> >> > my
> >> >> > >> >> application can get EWF type(RAM) and Flash
> >> Disk
> >> >> > image
> >> >> > >> >> was commited certainly.
> >> >> > >> >>
> >> >> > >> >> If I don't remote boot operation at 512MB
> >> device,
> >> >> > above
> >> >> > >> >> phenomenon do not occur and EWF is correct
> >> (Disable,
> >> >> > RAM
> >> >> > >> >> and commited).
> >> >> > >> >>
> >> >> > >> >> If remote boot image detect disk which is
> >> stored EWF
> >> >> > >> >> command, are there any influence to the
> disk?
> >> >> > >> >>
> >> >> > >> >> Do you have any opinions or suggestions?
> >> >> > >> >>
> >> >> > >> >> Regards,
> >> >> > >> >>
> >> >> > >> >> ---
> >> >> > >> >> Yasutaka
> >> >> > >> >
> >> >> > >> >
> >> >> > >> >.
> >> >> > >> >
> >> >> > >
> >> >> > >
> >> >> > >.
> >> >> > >
> >> >>
> >> >>
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >
- Next message: Nik Giachino: "DISK EWF Flash drive questions--Please give me a hand!"
- Previous message: Chuck Chopp: "Re: Windows XP Embedded and Virtual PC"
- In reply to: Yasutaka Nakamura: "Re: EWF and Remote Boot"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
