Using 0PE 2017-03-06 as base for English Native XPPE

maanu · 发表于 2017-4-1 23:21:04

Hello Pseudo ,

first of all , i was able to get account on baidu , and downloaded your latest 0pe , it has really improved over the time , since i last used it in early 2012.  thank you for it.

secondly ,  i am trying use my English Native XPPE ( which you and hotdll helped me make back in 2011) as main PE  using 0PE as base. here is what i am doing.

1- take English system32 files , make a WIM and replace with XP.WIM>SYSTEM32.WIM .

2- replace explorer.exe and regedit.exe in wxpelse.7z which was found in your SYSTEM32.WIM .

3- 0pe boots fine , and mount XP.WIM ,NET.WIM  , but it hangs after it loads my SYSTEM32.WIM , and it does not give any error. it seems it can not find shell .

The reason why i want to use your 0pe as base , as it is the only NT5 PE , which can load my lenovo Flex 4 laptop without blue screen. i am attaching my PECMD.INI .

Thank you in advance.

Best Regards
Maanu from Pakistan

pseudo · 发表于 2017-4-2 17:13:27

本帖最后由 pseudo 于 2017-4-2 17:18 编辑

can you get into native shell without BSOD, seeing "You are now in Native shell..." ?
maybe all "i386" must be changed to "wxpe" in the config files of system32.wim, and it must be mounted to wxpe.

红毛樱木 · 发表于 2017-4-1 23:54:41

TEAM FIND Explorer.EXE,!SHEL %WinDir%\EXPLORER.EXE|WAIT 1669---->>SHEL %WinDir%\EXPLORER.EXE

邪恶海盗 · 发表于 2017-4-2 00:05:24

congratulations,have you used FbintTool 1.7?

maanu · 发表于 2017-4-2 00:07:55

红毛樱木发表于 2017-4-1 23:54
TEAM FIND Explorer.EXE,!SHEL %WinDir%\EXPLORER.EXE|WAIT 1669---->>SHEL %WinDir%\EXPLORER.EXE

thank you , i ll try with your suggestion .

but i guess , the reason may be , because chinese PE uses WXPE path and my native PE uses I386 , can it be the issue ?

红毛樱木 · 发表于 2017-4-2 00:32:35

native load xxxx
see here reg

maanu · 发表于 2017-4-2 00:37:21

邪恶海盗发表于 2017-4-2 00:05
congratulations,have you used FbintTool 1.7?

hahaha thank you my friend .

no , i have not yet used v 1.7 , i have no real use for it as of now. i am happy with previous version.

on topic.

tried with SHELL %WinDir%\EXPLORER.EXE suggestion , still hangs at same point . it is next screen after NATIVE MOUNT.

maanu · 发表于 2017-4-2 00:41:13

本帖最后由 maanu 于 2017-4-2 00:45 编辑

红毛樱木发表于 2017-4-2 00:32
native load xxxx
see here reg

hello , here is native files , that 0PE loads .

whereas my native.ini reads as

@echo off
scd \SRNP\nvpe.wim
if exist nvpe.wim mount nvpe.wim x:\i386
if exist x:\i386\system32\PECMD.EXE exit

红毛樱木 · 发表于 2017-4-2 00:44:30

maanu 发表于 2017-4-2 00:41
hello , here is native files , that 0PE loads .

英文不还好。我直接说中文了。
一级内核中有native.exe，注册表中指向native.exe加载的配置文件，把native.exe加载的配置文件贴上来看一下。

红毛樱木 · 发表于 2017-4-2 00:47:42

maanu 发表于 2017-4-2 00:41
hello , here is native files , that 0PE loads .

whereas my native.ini reads as

I see.
Here HKLM\SYSTEM\SETUP\CmdLine

maanu · 发表于 2017-4-2 00:47:49

红毛樱木发表于 2017-4-2 00:44
英文不还好。我直接说中文了。
一级内核中有native.exe，注册表中指向native.exe加载的配置文件，把nati ...

please see above post .i forgot to add attachment.

红毛樱木 · 发表于 2017-4-2 00:56:44

you should upload your pe.

红毛樱木 · 发表于 2017-4-2 00:58:29

本帖最后由红毛樱木于 2017-4-2 01:00 编辑

Try "LOAD FBWF" in native.ini
or in pecmd.ini
I can't see anything about fbwf

maanu · 发表于 2017-4-2 01:28:45

红毛樱木发表于 2017-4-2 00:58
Try "LOAD FBWF" in native.ini
or in pecmd.ini
I can't see anything about fbwf

i am running fbwf via RUN1.CMD  (in PECMD.INI)

RUN1.CMD consist of

hiderun /w FBWFCache.cmd 4 64 50 %
hiderun.exe /w cmd.exe /c md \"%USERPROFILE%\\Local Settings\\Temp\
hiderun.exe /w cmd.exe /C hiderun.exe /w packuser.exe -o%SystemDrive% -y

fbwfcache.cmd

@echo off
%1=MinSize %2=Reserv %3=Size %4=Unit
:: MinSize - The minimum size cache
:: Reserv -  It is reserved under system
:: The rigid size
if "%4"=="MB" (
  set "Size=%3"
  goto _1
)
:: Calculation of the size
for /f "usebackq skip=1 tokens=3 delims=: " %%i in (`RamStatus.exe`) do set size=%%i
set /a size=%size%/1024
set /a "size=(%size%-%2)*%3/100"
if %size% lss %1 set size=%1

:_1
if 128 lss %size% set size=128
set /a "cachethreshold=(%size%+50)*1024*1024"
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v PagedPoolSize /t REG_DWORD /d %cachethreshold% /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FBWF" /v WinPECacheThreshold /t REG_DWORD /d %size% /f
hiderun /w net start fbwf

i ll upload my system32.wim .

红毛樱木 · 发表于 2017-4-2 01:34:20

maanu 发表于 2017-4-2 01:28
i am running fbwf via RUN1.CMD (in PECMD.INI)

RUN1.CMD consist of

here Reg
hklm\system\setup\cmdline

maanu · 发表于 2017-4-2 01:49:28

本帖最后由 maanu 于 2017-4-2 01:52 编辑

红毛樱木发表于 2017-4-2 01:34
here Reg
hklm\system\setup\cmdline

here is my pe

http://pan.baidu.com/s/1kVofFD1

i am using NVPE.WIM as SYSTEM32.WIM with 0PE

红毛樱木 · 发表于 2017-4-2 01:51:13

hklm\system\setup\cmdline
这个注册表键值有改成i386吗？
只有明天下载研究了，在被窝里了

maanu · 发表于 2017-4-2 01:54:13

红毛樱木发表于 2017-4-2 01:51
hklm\system\setup\cmdline
这个注册表键值有改成i386吗？
只有明天下载研究了，在被窝里了

it is

PECMD.EXE MAIN %SystemRoot%\SYSTEM32\PECMD.INI

in my english pe

红毛樱木 · 发表于 2017-4-2 01:59:45

maanu 发表于 2017-4-2 01:54
it is

PECMD.EXE MAIN %SystemRoot%\SYSTEM32\PECMD.INI

前面的I386和这里的system32有没有关系？不知道你的具体情况，猜的

maanu · 发表于 2017-4-2 02:10:58

红毛樱木发表于 2017-4-2 01:59
前面的I386和这里的system32有没有关系？不知道你的具体情况，猜的

yes , my original pe has i386/system32 relation .

maanu · 发表于 2017-4-2 17:33:32

pseudo 发表于 2017-4-2 17:13
can you get into native shell without BSOD, seeing "You are now in Native shell..." ?
maybe all "i3 ...

yes i can get to the " You are now in Native shell "

what files need to changed from i386 to wxpe ?

please note , i am already using your SETUPREG.HI_ .

can you please download above english PE to see what is the issue . ?

it ll be big help.

Best Regards
Maanu

红毛樱木 · 发表于 2017-4-2 17:46:28

本帖最后由红毛樱木于 2017-4-2 17:52 编辑

maanu 发表于 2017-4-2 01:49
here is my pe

http://pan.baidu.com/s/1kVofFD1

I have download your pe, and run it in vmware,it works well.
I think the problem starts with pecmd.ini

pseudo · 发表于 2017-4-2 18:02:59

本帖最后由 pseudo 于 2017-4-2 18:17 编辑

maybe i386 has been hardcoded in some registration files of the config folder , it must be changed to wxpe.

maanu · 发表于 2017-4-2 18:04:16

yes , my PE works ok on its own , i want to use it with 0PE base , but it does not work with 0PE , should i upload 0pe package for you with my english system32.wim for testing ?

thank you

红毛樱木 · 发表于 2017-4-2 18:27:37

maanu 发表于 2017-4-2 18:04
yes , my PE works ok on its own , i want to use it with 0PE base , but it does not work with 0PE , ...

FBWF P20 L64 H128
INIT IU,3000
PATH %SystemDrive%\TEMP
CALL $SHELL32.DLL,DllInstall,#1,U
LOGS %CurDir%\PEMCD.LOG
SHOW -1:-1
TEAM ENVI W=%WinDir%|ENVI WS=%WinDir%\SYSTEM32|ENVI WSD=%WS%\Drivers|ENVI V0=HKLM\System\CurrentControlSet\Services
ENVI V2=PECMD.EXE
ENVI V3=SHELL32.DLL#
//EXEC =!%WinDir%\SYSTEM32\RUN1.CMD
PATH %USERPROFILE%\Local Settings\Temp //invalid
EXEC =%systemroot%\\packuser.exe -o%SystemDrive% -y
//EXEC =!%WinDir%\SYSTEM32\IMDISK.CMD
EXEC =rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 132 .\imdisk.inf
EXEC =!%WinDir%\SYSTEM32\7ZSET.CMD
REGI %V0%\USBHUB\ImagePath=%WSD%\USBHUB.SYS
REGI %V0%\USBCCGP\ImagePath=%WSD%\USBCCGP.SYS
REGI %V0%\USBEHCI\ImagePath=%WSD%\USBEHCI.SYS
REGI %V0%\USBOHCI\ImagePath=%WSD%\USBOHCI.SYS
REGI %V0%\USBSTOR\ImagePath=%WSD%\USBSTOR.SYS
REGI %V0%\USBUHCI\ImagePath=%WSD%\USBUHCI.SYS
REGI %V0%\HIDUSB\ImagePath=%WSD%\HIDUSB.SYS
REGI %V0%\MOUCLASS\ImagePath=%WSD%\MOUCLASS.SYS
REGI %V0%\MOUHID\ImagePath=%WSD%\MOUHID.SYS
REGI %V0%\KBDCLASS\ImagePath=%WSD%\KBDCLASS.SYS
REGI %V0%\KBDHID\ImagePath=%WSD%\KBDHID.SYS
REGI %V0%\CDROM\ImagePath=%WSD%\CDROM.SYS
//TEAM PATH %SystemDrive%\TEMP|INIT IU,3690|EXEC @PECMD.EXE CALL $SHELL32.DLL,DllInstall,#1,U
//FORX !\SRNP\NVPE.WIM,KK,1,TEAM FDIR PN=%KK%|ENVI PNTV=%PN%\WALL\|envi pn=
//%V1%随机换幅壁纸 F10,%V2%,exec =@setwp.exe %PNTV%,%V3%98
//FIND MEM>128,HOTK #121,%V2% exec =@setwp.exe %PNTV%
//exec =@setwp.exe %PNTV%
//WALL %CurDir%\img.jpg
CALL $%WinDir%\SYSTEM32\oleacc.dll,DllInstall,
CALL $%WinDir%\SYSTEM32\oleaccrc.dll,DllInstall,
CALL $oleacc.dll,DllInstall,
CALL $oleaccrc.dll,DllInstall,
RAMD ImDisk,L5,FAT,Y:,MAANU
REGI HKCR\lnkfile\IsShortcut
HOTK #112,NOTEPAD.EXE %WS%\HELP.TXT
HOTK Alt + T,PECMD.EXE TEMP @Delete
HOTK Alt + P,X:\I386\SYSTEM32\ppAppsgenPE
HOTK Alt + #0x53,PECMD.EXE SHUT S
HOTK Alt + R,PECMD.EXE SHUT R
HOTK Alt + E,PECMD.EXE LOAD %windir%\system32\SS.ini
//LOAD %CurDir%\ext.ini
PATH Y:\SRNTOOLS
FORX !\SRNP\COMN\TOOLS.WIM,TWIM,1,MOUN TWIM,Y:\SRNTOOLS,%TEMP%,1
WAIT 500
IFEX Y:\SRNTOOLS\LINKS.INI,! FORX \SRNP\COMN\TOOLS.WIM,TWIM,1,MOUN TWIM,Y:\SRNTOOLS,%TEMP%,1
IFEX Y:\SRNTOOLS\LINKS.INI, LOAD Y:\SRNTOOLS\LINKS.INI
//REGI HKCR\Drive\shell\ImDiskUnmount\=Unmount IMDISK Virtual Disc
//REGI HKCR\Drive\shell\ImDiskUnmount\command\=rundll32.exe imdisk.cpl,RunDLL_RemoveDevice %L
//REGI HKLM\SOFTWARE\Classes\Ultraiso\shell\ImDiskMountFile\=Mount With IMDISK
//REGI HKLM\SOFTWARE\Classes\Ultraiso\shell\ImDiskMountFile\command\=rundll32.exe imdisk.cpl,RunDLL_MountFile %L
//REGI HKLM\SOFTWARE\Classes\Winimage\shell\ImDiskMountFile\=Mount With IMDISK
//REGI HKLM\SOFTWARE\Classes\Winimage\shell\ImDiskMountFile\command\=rundll32.exe imdisk.cpl,RunDLL_MountFile %L
//FIND MEM<250,CALL ASK
//_SUB PAGEFILE_SET
//BROW Tag,*D:\,Select the partition to create PAGEFILE on
//FIND $%TAG%=,ENVI DRIVE=D:!FDRV DRIVE=%TAG%
//text Creating PageFile%DRIVE%
//PAGE %DRIVE%\SRNPE.sys 150 300
//_END
//_SUB ASK `Pagefile FOR SRNPE
//forx \pagefile.sys,pagefile,0,file %pagefile% `Pagefile is necessery for low systems....
//mess 穣our System has less then 300MB RAM\n \nFor creating pagefile press YES @Pagefile for PE #YN *10000 $N
//FIND $%YESNO%=YES,CALL PAGEFILE_SET
//_END
//TEAM FIND Explorer.EXE,!SHEL %WinDir%\EXPLORER.EXE|WAIT 1669
WALL %CurDir%\img.jpg
SHEL %WinDir%\EXPLORER.EXE
LINK %Desktop%\F1(HELP),%CurDir%\HELP.TXT
//SHOW -1:-1
//TEAM WAIT 900|KILL SMSS.EXE|KILL WINLOGON.EXE
//SEND #121
//EXEC =!%WinDir%\SYSTEM32\ppAppsGenPE.exe
//EXEC =!%WinDir%\SYSTEM32\RUN2.CMD
LOGS

复制代码

you can test pecmd.ini.

maanu · 发表于 2017-4-2 18:29:23

pseudo 发表于 2017-4-2 18:02
maybe i386 has been hardcoded in some registration files of the config folder , it must be changed ...

i caught 3 instances of I386 in system32.wim>config>Software

and changed to wxpe .

HKEY_LOCAL_MACHINE\sss\Microsoft\Windows\CurrentVersion\Setup, Installation Sources, X:\WXPE\SYSTEM32\DRIVERS X:\WXPE\SYSTEM32 X:\WXPE\INF

X:\WXPE\SYSTEM32\DRIVERS
X:\WXPE\SYSTEM32
X:\WXPE\INF

but still it hangs after finishing native screen.

maanu · 发表于 2017-4-2 18:49:35

红毛樱木发表于 2017-4-2 18:27
you can test pecmd.ini.

it failed . still hang at same point.

红毛樱木 · 发表于 2017-4-2 18:49:52

maanu 发表于 2017-4-2 18:29
i caught 3 instances of I386 in system32.wim>config>Software

and changed to wxpe .

去掉那些等待运行的命令，比如 exec =
的这些，问题在pecmd.ini里，那几个cmd可能有卡死的情况

maanu · 发表于 2017-4-2 18:52:16

红毛樱木发表于 2017-4-2 18:49
去掉那些等待运行的命令，比如 exec =
的这些，问题在pecmd.ini里，那几个cmd可能有卡死的情况

yes , i tried with your pecmd.ini too , but it again failed.

红毛樱木 · 发表于 2017-4-2 19:01:49

maanu 发表于 2017-4-2 18:52
yes , i tried with your pecmd.ini too , but it again failed.

FBWF P20 L64 H128
INIT IU,3000
PATH %SystemDrive%\TEMP
TEAM ENVI W=%WinDir%|ENVI WS=%WinDir%\SYSTEM32|ENVI WSD=%WS%\Drivers|ENVI V0=HKLM\System\CurrentControlSet\Services
ENVI V2=PECMD.EXE
ENVI V3=SHELL32.DLL#
REGI %V0%\USBHUB\ImagePath=%WSD%\USBHUB.SYS
REGI %V0%\USBCCGP\ImagePath=%WSD%\USBCCGP.SYS
REGI %V0%\USBEHCI\ImagePath=%WSD%\USBEHCI.SYS
REGI %V0%\USBOHCI\ImagePath=%WSD%\USBOHCI.SYS
REGI %V0%\USBSTOR\ImagePath=%WSD%\USBSTOR.SYS
REGI %V0%\USBUHCI\ImagePath=%WSD%\USBUHCI.SYS
REGI %V0%\HIDUSB\ImagePath=%WSD%\HIDUSB.SYS
REGI %V0%\MOUCLASS\ImagePath=%WSD%\MOUCLASS.SYS
REGI %V0%\MOUHID\ImagePath=%WSD%\MOUHID.SYS
REGI %V0%\KBDCLASS\ImagePath=%WSD%\KBDCLASS.SYS
REGI %V0%\KBDHID\ImagePath=%WSD%\KBDHID.SYS
REGI %V0%\CDROM\ImagePath=%WSD%\CDROM.SYS
WALL %CurDir%\img.jpg
MESS Now Will Start explorer.exe
SHEL %WinDir%\EXPLORER.EXE
LINK %Desktop%\F1(HELP),%CurDir%\HELP.TXT

复制代码

test this one.

		自动登录	找回密码
密码			注册

Using 0PE 2017-03-06 as base for English Native XPPE

点评

点评

点评

点评

点评

点评

点评

点评

点评

.

点评

点评

点评

点评

点评

点评

点评

点评

点评

点评

点评

浏览过的版块