Issue with disabling firewall

[Vortex]

Hello,

I am receiving the following error message while trying to disable the firewall of WinPE :

X:\>wpeutil DisableFirewall
The command failed with status 0x800706d9.

I am working on the TightVNC integration with LiveSystem Pro. Vnc is a good option for remote access.

Version of LSPMultiPE : 1.1.6.7
Windows 10 version to build WinPE : Windows 10 version 2004 64-bit ( Windows 10 2020 H1 )

[CD-RW]

Hi

How did you integrate the program in WinPE?
Do you want to use it as a server or a viewer?

[Vortex]

Hello,

Copied the files from a TightVNC installation to my LiveSystem Pro setup :

hookldr.exe
screenhooks64.dll
TightVNC64.reg
tvnserver.exe
tvnviewer.exe

TightVNC64.reg contains the settings of the VNC server including the access password.

A batch file to start the VNC service :

reg Import TightVNC64.reg

tvnserver.exe -install -silent

tvnserver.exe -start

With this method, the WinPE built with LSPMultiPE should function as VNC server but the firewall should be disabled with the wpeutil command.

[Noel-Blanc]

Hi,
Perhaps i can help....
@vortex, can you take a capture with procmon ? Only around the "wpeutil disablefirewall" command. And save "all" events (no filters).
And i can compare with my winpe...
Best regards.
Noel

[Noel-Blanc]

Hi,
I had obtained a W11 version produced by LSP. So it's not the same version of winpe.
What I see on the version in my possession:
1 - the command "wpeutil.exe disablefirewall" generates the error: 0x800706d9
2 - procmon does not show any activity of the firewall services
3 - some observations:

• the command "sc qc MPSSVC" shows that the MPSSVC service is "disabled"

• the MpsSvc service depends on 3 services: MPSRDV, BFE, NSI

• the "net start MPSRDV" command indicates that the MPSRDV driver has already started

• the "net start NSI" command indicates that the NSI service has already started

• the "net start BFE" command reports the error "1083" that you can read in english with "net helpmsg 1083"
  "translated from fr: the program in which this service is to run does not implement the service"

4 - the reading of the SYSTEM hive shows:
system\CurrentcontrolSet\services\BFE\imagepath = %systemroot%\sytem32\svchost.exe -k LocalServiceNoNetwork -p
system\CurrentcontrolSet\services\MPSSVC\imagepath = %systemroot%\sytem32\svchost.exe -k LocalServiceNoNetwork -p
5 - in my Winpe where this command works correctly, REGEDIT shows:
system\CurrentcontrolSet\services\BFE\imagepath = %systemroot%\sytem32\svchost.exe -k LocalServiceNoNetworkFireWall -p
system\CurrentcontrolSet\services\MPSSVC\imagepath = %systemroot%\sytem32\svchost.exe -k LocalServiceNoNetworkFireWall -p
6 - you can can verify in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
LocalServiceNoNetwork = DPS PLA NcdAutoSetup CoreMessagingRegistrar
LocalServiceNoNetworkFirewall = BFE mpssvc

In the W11 version winpe I have and built with LSP, the firewall is disabled during construction.
If this is also the case for your version, then TightVNC should be OK
if firewall is not disabled during construction :
I cannot say that replacing the values of "BFE\imagepath" and "MPSSVC\imagepath" will be effective for your version,
but you can try it.

Hope this help.

[Vortex]

Bonsoir Noel,

Thanks for your efforts. Could you provide more information about BFEimagepath and MPSSVCimagepath?

[Noel-Blanc]

Bonsoir Vortex,
In my winpe (w11) :
- the firewall is enable and works very well
- in the 2 services keys, Bfe and MpsSvc, the value imagePath use a parameter "-k LocalServiceNoNetworkFireWall"
In the winpe (w11) built with LSP in my possession :
- the firewall is disabled : when i enable it, i get a new error ( bfe ...1083)
- in the 2 services keys, Bfe and MpsSvc, the value "imagePath" contains the command line with the parameter "-k LocalServiceNoNetwork"

Perhaps too many details from my part but i don't what it needed :
Services.exe looks at the "imagePath" value in registry and launchs the program : svchost.exe.
the comand line contains all the parameters : "-k ... -p"
the parameter "-k ..." is read by svchost when it starts.
Each instance of Svchost can share its "space" with more than one service.
I don't know how services.exe give the name of the service to svchost.exe.
the instance containing the target service can be already running ( if one service in the group is already started).
So service.exe don't always launch the process svchost.exe but it communicates with it.
i know that svchost needs the parameter "-k" to identify the group of services running in the same "space".
"space" is not the good word but i don't know the good one.
if the instance of svchost for the group in which the target service is contained is not already started :
svchost reads the value (!!!not the key!!!) hklm\software\...\svchost\ [name of group] = [name list of servcices]
If the target service is not in the list, you get error 1083.
This entry hklm\software\...\svchost\ contains also a key [name of group] which contains the parameters of the "space" for svchost process. Be carrefull and don't mix.
I think there is somewhere a better description of the svchost mecanism.
I write this lines with a procmon trace under my eyes ( net start camsvc ).
For BFE and MPSVC, the "-k ...." parameter is not the good in the boot.wim that i received last week.
So i never said it's the good solution for you.
I hope you can understand what can be your test ( enable MPSSVC, modify the -k param for these 2 services)....if all needed files are present, perhaps it will be good for you.
note: i think the API which reply "firewall is enable or disable" uses the service MPSSVC. So if TightVNC use this API, the MPSSVC must be enabled to disable the feature "firewall" with "wpeutil disablefirewall".
I hope i don't say wrong things. If not, i beg your pardon ( my memory is not so good and my knowlegde is old and not perfect).
Noel

[CD-RW]

Hello

For Tight VNC is a new script available. See post from 18.12.21

viewtopic.php?f=22&t=41

@Vortex
Please test it and give feedback

Kare
--

[Vortex]

Hi CD-RW,

Thanks, I will test the script.

[Vortex]

Hi CD-RW,

After rebuilding the LSP-Merge iso file with the TightVNC script, here are the test results :

Code: Select all

X:\>sc query tvnserver

SERVICE_NAME: tvnserver
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 1077  (0x435)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

Investigating the reason why the TightVNC service is not active :

Code: Select all

X:\>reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tvnserver /v ImagePath

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tvnserver
    ImagePath    REG_EXPAND_SZ    "X:\Program Files\TightVNC\TightVNC\tvnserver.exe" -service

The path to the executable is not correct. It should be X:\Program Files\TightVNC

Correcting the path and restarting the service, the VNC client installed on another computer ( vncviewer.exe ) reports the following :

Code: Select all

Server not configured properly.

Testing wpeutil :

Code: Select all

X:\>wpeutil DisableFirewall

The command completed successfully.

Source to build the Merge PE project : Windows 10 64-bit Version 2004

Hi Noel,

Thanks for the info. You can check CD-RW's TightVNC script, here is a portion of the code :

Code: Select all

if,%WIM_BUILD%,=>,10240,then
  Regwrite,HKLM,0x2,PE-SYSTEM\ControlSet001\Services\BFE,ImagePath,#$pSystemRoot#$p\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
  Regwrite,HKLM,0x4,PE-SYSTEM\ControlSet001\Services\BFE,SvcHostSplitDisable,1
  Regwrite,HKLM,0x4,PE-SYSTEM\ControlSet001\Services\mpssvc,Start,2
  System,SetPEInit,A,Startup,Run||x:\Windows\system32\wpeinit.exe
End

[Vortex]

Hello,

I managed to rebuild the iso file with the updated TightVNC script. Accessing the computer running LSP MergePE with the VNC viewer, I see only a black window. The VNC server reports the following error messages :

Code: Select all

Application crashing - Do you want save debug information?

Code: Select all

Cannot create file to save a debug information

[Noel-Blanc]

Hi Vortex,
Kare knows that i am too lazy to build myself. I get some free time this week. Please, if it is possible for you, put on a temporary share (one day and delete) your boot.wim (and the client in a directory if needed) and i look at...
Personnaly, i use mstsc for a long time in winpe and it works for me ( but yes, the administrator account is limited for a coming connection into winpe )
Noel

[Vortex]

Bonsoir Noel,

OK, I will upload the iso file. I will let you know about details. Could please send an email to vortice202121@gmail.com? I will send you a link to the iso file.

[Vortex]

Bonsoir Noel,

Gmail reported delivery failure, I cannot send messages to your account. Kindly, could you please provide an alternate email account? Thanks.

[Noel-Blanc]

Bonsoir Vortex,
I received the link and I responded with what I believe to be the origin of the anomaly in your file.
In my opinion, this is the absence of DWM files.
I disabled DWM on my winpe and I get the following behavior with TightVNC: black screen but active mouse/keyboard.
I'll let you do the test by adding the DWM files to your Boot.wim file.
Tell me if it works for you.

[Vortex]

Hello Noel,

Thanks. Could you provide the list of the files of Desktop Window Manager? ( Dwm )

[Noel-Blanc]

Hi Vortex,
I send you two emails from my two emails accounts. Did you receive them ?
I collecte the file names ....

[Noel-Blanc]

i see these files are not present in your boot.wim in system32 :

in system32 :
dwm.exe
dwmcore.dll
dwmghost.dll
dwminit.dll
dwmredir.dll
udwm.dll

note : dwmapi.dll is present and it's normal

and their .mui in your language folder system32\en-us\ :
dwm.exe.mui
dwmapi.dll.mui ( i had not verify for this one in your boot.wim)
dwmcore.dll.mui
dwminit.dll.mui
dwmredir.dll.mui
uDWM.dll.mui

One more time, as i explained in my emails, i didn't add these files in your boot.wim : i can't be affimative that it's the origine of the "bug".
But i delete dwminit.dll in my boot.wim ( which disables DWM ) and i get the same "black screen" with mouse/keyboard active, and the same error messagebox.
Hope this help

[Vortex]

Hi Noel,

Thanks, I received your messages. In a free time, I will try again.