XP Embedded

Jan 10, 2007

This describes:

Useful references

Booting from USB flash

The XPe SP2 Feature Pack 2007 is downloadable from Microsoft if you have purchased embedded XP. It contains a module usable in target designer called "USB Boot 2.0". It also contains a utility called ufdprep.

Use target designer and add USB Boot 2.0 to the embedded XP image. Use the ufdprep tool to format a flash drive. This also works on flash card reader/ writers. It will create a boot record and the XP embedded image can be directly copied onto the flash.

I tried booting embedded XP directly from flash, but it took about 40 minutes to boot the flash. There is an article on the Microsoft site called, "Let the First Boot Agent (FBA) Run on Disk When Using Compact Flash as a Storage for Your Device". This device should be very similar to the target device. See below for a USB script that boots into BartPE.

Note that BartPE with diskpart will not resize a parition to be a smaller size. It can only create, delete, and extend partitions. Some Linux tools are better, but support of NTFS is mostly limited at this time.

Boot.ini

The following is the boot.ini I used for flash when using the ufdprep tool. It can be used for testing during development.
[boot loader]
timeout=5
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Embedded" /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Embedded nogui" /fastdetect /noguiboot
If you get "Windows could not start because of a computer disk hardware configuration problem. Could not read from the selected boot disk", then the boot.ini configuration is wrong.

Other boot tools

HP has some flash utilities. Some of them may require dos. One place is www.freedos.org. See http://www.msfn.org/board/lofiversion/index.php/t69211.html.

HP Drive Key Boot Utility or HP Flash Drive Boot Utility
http://h18000.www1.hp.com/support/files/serveroptions/us/download/23839.html
cp006049.exe

HP USB Disk Storage Format Tool
http://h18000.www1.hp.com/support/files/serveroptions/us/download/20306.html
SP27213.exe

This is another interesting site. http://www.bootcd.info/

MbrFix is a nice tool for viewing partitions on flash.

Total commander for USB sticks looks interesting.

Cloning

Cloning can eliminate having to run the FBA process on every machine. Steps for cloning are: There are many options to cloning. One is that the clone tool can be run manually if the embedded image must be modified by hand. Another is that the dialog boxes that are displayed can be modified.

Message Boxes

The registry values "EnableDefaultReply", "EnableLogging" and "LogSeverity" in the "Error Message Instrument" key can be used to prevent user32.dll from displaying message boxes. The other key to look at is "Error Instrument". Another way to remove dialogs is to write something in a service that closes dialogs. This is the only way to catch all dialogs, since some dialogs won't be message boxes. There is an example service called "MessageBoxInstrument.

Making image registry tweaks

Most registry changes should be made in target designer. If this is not possible, the following can be done. The registry can be loaded from C:\Windows Embedded Images\Windows\System32\Config\System.sav using regedit. Use Load Hive from the HKEY_LOCAL_MACHINE to load to a temporary registry key. Then Use unload hive to save and unload it.

The "Settings/Extra Registry Data" in target designer can have Mounted Devices keys that perform C:/E: drive mapping. This allows the boot image to boot as E: and then reference things as C: The key looks like: "HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\" value name: "\DosDevices\C:" I think more information is in the development guide.

XPECMD hints

The online documentation seems sparse, but there is some help within the xpecmd script. At the xpecmd prompt, just type "help [command]". It is also possible to read the xpecmd.wsf file for more information. Search also for CMIExp.wsf for additional information.

Use the xpecmd tool to view dependencies. Windows script host is required. I tried for quite a while with different syntax to get this to work for primitives, but was never successful. Remember when looking at primitives to put 200 or less in Tools->Options->Advanced->Minimum Visibility.

    cscript xpecmd
    xpecmd>dbo .
    xpecmd>new c='comp:ACPI Fan'
    xpecmd>show c.ShowDependencies
    xpecmd>deptrace revdeps c
    xpecmd>deptree c
The following at the command line can be used to show the first instance that matches the show string.
   cscript xpecmd.wsf

   xpecmd>minvis 200
   xpecmd>show 'inst:sec'
The following script can be used to see properties of certain objects.
   set dbserver=.
   set xpecmd="C:\Program Files\Windows Embedded\bin\xpecmd.wsf"
   set targetbase=..\Source\TargetDesigner

   echo dbopen %dbserver% >xpe.txt

   rem echo load cfg "%targetbase%\SMU.slx" >>xpe.txt

   echo initcfg cfg >>xpe.txt
   rem echo cfg.Instances.Add 'inst:^Winlogon Sample Macro' >>xpe.txt

   echo dump /7 cfg >>xpe.txt
   echo exit >>xpe.txt

   cscript %xpecmd% xpeoutdump.txt
   del xpe.txt
The following shows how to modify the base properties after a database and config have been loaded. The properties can be seen using "show cfg.Properties" at the xpecmd prompt. To list components, use "list comp:[search_string]", for example, "list comp:Config'. It is also possible to use "show cfg" to make a neat list of components.
   echo cfg.Properties("cmiTargetBootDrive") = "D:"
   echo cfg.Properties("cmiTargetDocsAndSettings") = "D:\Documents and Settings"
   echo cfg.Properties("cmiTargetProgramFiles") = "D:\Program Files"
   echo cfg.Properties("cmiTargetWinDir") = "D:\Windows"
One interesting/strange thing is that some properties will not be displayed or modified using "new". It may be required to "get" the instance of the component instead of "new".
   get myinst cfg.Instances "Windows Logon (Standard)"
   show myinst.properties
   myinst.Properties("cmiLogonEnableFriendlyUI")=1

XPECMD Scripts

Importing components into the database.
   set dbserver=.
   set xpecmd="C:\Program Files\Windows Embedded\bin\xpecmd.wsf"
   set compbase=..\Source\Components
   set reproot="C:\Windows Embedded Data\Repositories"
   echo dbopen %dbserver% >xpe.txt
   echo dbimport "%compbase%\App\App_Shell.sld" %reproot% >>xpe.txt
   echo dbimport "%compbase%\Intel 865Chipset\Intel865G.sld" %reproot% >>xpe.txt
   echo dbimport "%compbase%\Intel PRO1000 CT Network Connection\LAN1000_e1000325.sld" %reproot% >>xpe.txt
   echo dbimport "%compbase%\Intel(R) PRO100 M Desktop Adapter\LAN100_e100b325.sld" %reproot% >>xpe.txt
   echo dbimport "%compbase%\NVidia\nv4_disp.sld" %reproot% >>xpe.txt
   echo dbimport "%compbase%\Realtek Audio Driver\RealtekAudio.sld" %reproot% >>xpe.txt
   echo exit >>xpe.txt
   cscript %xpecmd% 

Building the target.  The 2's can be 0 to 2 indicating amount of text output.  There
is a problem that the xpecmd command will not produce the same output as the target
designer since there doesn't seem to be a way to perform the "Upgrade Configuration"
step.  There is an Upgrade method in the Configuration
object that takes two arguments, but I don't know what they are.  It is something like
cfg.Upgrade "" or cfg.Upgrade 1,1.
   set dbserver=.
   set xpecmd="C:\Program Files\Windows Embedded\bin\xpecmd.wsf"
   set targetbase=..\Source\TargetDesigner
   set image=c:\Windows Embedded Images
   del /S /Q "%image%\*.*"
   rd /s /q "%image%\"
   md "%image%\"
   echo dbopen %dbserver% >xpe.txt
   echo load cfg "%targetbase%\App.slx" >>xpe.txt
   echo cfg.ResolveDependencies 2 >>xpe.txt
   echo cfg.CheckDependencies 2 >>xpe.txt
   echo cfg.Build 2, "%image%\" >>xpe.txt
   echo exit >>xpe.txt
   cscript %xpecmd% 


The following shows how to add and remove components in a script.  Note that
the syntax is very different between both commands.
   echo add cfg 'inst:Explorer shell' >>xpe.txt
   echo remove cfg "Automatic Logon" >>xpe.txt

Other Scripts

Modifying the boot.ini to add a boot logo.
   set bootini="\Windows Embedded Images\boot.ini"
   echo [boot loader] >%bootini%
   echo timeout=0 >>%bootini%
   echo default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS >>%bootini%
   echo [operating systems] >>%bootini%
   echo multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Embedded"
       /fastdetect /noguiboot /noexecute=AlwaysOff /bootlogo >>%bootini%
Modifying the registry
   set key=HKLM\x
   set hive="\Windows Embedded Images\Windows\System32\CONFIG\SYSTEM.SAV"
   reg load %key% %hive%
   if not %errorlevel%==0 goto error
   reg add %key%\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableStatusMessages /t reg_dword /d 1 /f
   if not %errorlevel%==0 goto error
   reg delete %key%\ControlSet001\Services\NVSvc /f
   if not %errorlevel%==0 goto error
   reg unload %key%
   exit
   :error
   pause Modify Registry Error!
Setting NTFS rights. If you use flash to copy the image, make sure to format the flash as NTFS if this is run on the source image. This allows SuperUser full control, but the NormalUser can only read and execute bin, and append to logs.

   set image=c:\Windows Embedded Images
   set xcacls=cscript ..\utilities\xcacls.vbs
   set appdir=Program Files\Company

   %xcacls% "%image%\%appdir%\Prog\bin" /R Users
   %xcacls% "%image%\%appdir%\Prog\bin" /E /G Administrators:F
   %xcacls% "%image%\%appdir%\Prog\bin" /E /G SuperUser:F
   %xcacls% "%image%\%appdir%\Prog\bin" /E /G NormalUser:R

   %xcacls% "%image%\%appdir%\Prog\logs" /R Users
   %xcacls% "%image%\%appdir%\Prog\logs" /E /G Administrators:F
   %xcacls% "%image%\%appdir%\Prog\logs" /E /G SuperUser:F
   %xcacls% "%image%\%appdir%\Prog\logs" /E /G NormalUser:B9865421
The following script will destroy all data, and split the disk into two partitions.
   if "%1"=="" goto parmerror
   pause THIS WILL DESTROY THE HARD DRIVE. Use Ctrl-C to abort.
   pause ARE YOU REALLY SURE? Use Ctrl-C to abort.
   echo select disk %1 >b:\partdata.txt
   echo clean >>b:\partdata.txt
   echo create partition primary size=40000 >>b:\partdata.txt
   echo active >>b:\partdata.txt
   echo create partition extended >>b:\partdata.txt
   echo create partition logical >>b:\partdata.txt
   diskpart < b:\partdata.txt
   del b:\partdata.txt
   pause
   exit
   :parmerror
   pause The first argument must be 0 for the first drive, 1 for second

USB memory stick dual booted to hard drive

The following script creates a neat dual boot system. The hard drive can be set up as a single boot for normal users. Then a service user can boot from USB and boot into the second hard drive partition, or boot onto the USB to run disk manipulation utilities.

Note that the ntldr program used here is from the XP Embedded disks. There are different versions in different places and some don't work. This one is 245 KB and dated 8/3/2004. The drive specification "C:" before peboot.bin is required.

The BIOS must support booting from flash. The Pheonix BIOS I am working with requires Hard Disk to be set as the first boot device, and that the hard drive boot order specifies the USB-HDD0 first. This cannot be set unless the USB was connected before the boot. If the USB is disconnected and booted from the hard drive, then the boot order will be switched automatically by the BIOS, so booting from flash requires that the BIOS hard disk order is changed again.

The ufdprep tool may be able to be replaced with the HP utility, but I have not tried it.


   pause Run pebuilder before running this.  Also make sure the paths in this file are correct.

   "%xpe%\utilities\ufdprep" %flashdrive%
   echo [boot loader] >boot.ini
   echo timeout=30 >>boot.ini
   echo default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS >>boot.ini
   echo [operating systems] >>boot.ini
   echo multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Hard Drive Partition 1" >>boot.ini
   echo multi(0)disk(0)rdisk(1)partition(2)\WINDOWS="Hard Drive Partition 2" >>boot.ini
   echo c:\peboot.bin="Utilities" /minint >>boot.ini

   copy boot.ini e:BOOT.INI
   del boot.ini

   copy "%pebuilder%\BartPE\i386\ntdetect.com" %flashdrive%\
   if errorlevel 1 goto _abort
   copy "%xpeimage%\ntldr" %flashdrive%\
   if errorlevel 1 goto _abort

   set _target=%flashdrive%
   set _base=%pebuilder%\plugin\peinst\
   set _source=%winsrc%
   rem this stuff was copied from peinst.cmd
   "%_base%mkbt.exe" -x -c %_target% %_target%\peboot.bin
   if errorlevel 1 goto _abort
   "%_base%nt2peldr.exe" %_target%\peboot.bin
   if errorlevel 1 goto _abort
   copy %_source%\i386\setupldr.bin "%_target%\peldr"
   if errorlevel 1 goto _abort

   mkdir %flashdrive%\minint
   xcopy /s "%pebuilder%\BartPE\i386" %flashdrive%\minint
   mkdir %flashdrive%\Programs
   xcopy /s "%pebuilder%\BartPE\Programs" %flashdrive%\Programs

   exit
   :_abort
   pause Error!

Security

To run a process as a user with admin privileges, the CreateProcessWithLogonW function can be used. This will return a 1060 (ERROR_SERVICE_DOES_NOT_EXIST) indicating some service does not exist. Well if you are good at guessing, you will find that it is the RunAs Service. An interesting point about starting an explorer, is that the explorer may not start. But a simple solution to this is to start the c:\program files\internet explorer\iexplore application and add an argument to start at the root "\" directory. This application exists even if the internet explorer component is not in the configuration. The iexplore program looks just like the explore program in this case.

Realtek devices

I had a machine that had a device listed as vendor 8086, device 27DE, and subsystem 4720414c. Searching online listed it as "82801G (ICH7 Family) AC'97 Audio Controller", and "Realtek ALC883 Audio Controller". This is somehow incorrect, because looking at the sound chip indicated it was a ALC650, which is an AC'97 device.

I downloaded the AC'97 audio codecs from realtek, and looked at the .inf files. There was one that matched the vendor and device, but not subsystem. I used the .inf with the most matches of vendor and device, and added a line for my system's subsystem. Then importing the .inf into component designer worked.

Some other components that may be desired for sound are "XP Sound Scheme", and "Audio Volume Control".

Hosted by www.Geocities.ws

1