ahmad2080 Posted April 12, 2009 Author Posted April 12, 2009 see it's absolutely of no use participating to this game. It has been fun while it lasted. So long and thanks for all the sectors.... jaclazMay be it can last......I still didn't restore the F11 function....AND I offer my assistant to make some experiments that may reveal the mystery of this partition.Also, I seem to be missing two things:the bootsector form your Recovery partition (16 sectors)the bootsector from the recovery partition of your friend (the first one) also 16 sectors.Here you are : http://rapidshare.com/files/220509011/Reco...ctorsr.rar.html
Snack Posted April 12, 2009 Posted April 12, 2009 (edited) Playing games I have no enought knowledge butlet's try more efforts to resolve issue, thinking the problem is worldwide...Applying WAUfix.bat from C:\hp\recovery\bin folder finally I can see F11 WBM window with three line menu. But the first one is "ramdisk option" instead of Recovery Manager. Do nothing of coarse. Little left to do...I suspect this menu item points to a Vista BCD file. Any idea?Ahmad8020 more things to be missing: * the MBR and bootsector __C:__ from your friend 16 sectors. * C:\boot\bcdAnd by the way have you pass through Complete Factory Restore? That should return your computer to be boot with F11 enabled and running without problem. Or I missed somewhat in discussions Edited April 14, 2009 by Snack
jaclaz Posted April 13, 2009 Posted April 13, 2009 Though I am now out of the game, I guess that the preliminary work and maybe some of the conclusions I got to might be of use to someone willing to take part in it.This post will be extremely long, and in some parts will be more similar to a RANT than to a valid technical post, please try forgiving my verbosity and my critical attitude.Let me state beforehand a few facts and personal opinions:I find HP has been for yesrs the best firm in the world for pocket calculators (in my life I bought several tens of them)I find HP has been for years the best firm in world for Laser printers (as well in my life I bought several tens of them)I find HP has been for years the best firm in the world for plotters (as well in my life I bought several tens of them)I find Compaq has been for years the best firm in the world for plotters (as well in my life I bought several tens of them - in the years 1992 up to 1995)I find current HP policies with software and particularly with OS simply appalling .HP was facing to be condemned for similar practices in a Class action and opted for a settlement:http://web.archive.org/web/20060402204440/...settlement.com/It seems like it is a common practice for HP to close with a settlement cases where they were accused to provide defective products and/or failed to give Customers satisfacting repairs/fixes:http://barrettgrider-v-hpcompaq.com/index.htmlIn Italy there are currently several cases opened against HP following its refusal to reimbourse customers that do not want Vista on their PC's (Italian):http://punto-informatico.it/1354479/PI/New...unciata-hp.aspxhttp://punto-informatico.it/2096808/PI/New...rso-dovuto.aspxhttp://punto-informatico.it/2341415/PI/New...-tribunale.aspxand an appeal to the Antitrust European Committee has been filed.(but the above bears no connection to the issue at hand)Let's get back to topic.From what I have seen and understood from the reports, the "Softthinks" MBRINST.EXE ( in some cases renamed to MBR.DLL) is a MBR installing utility that works roughly this way:writes a "special" MBRanalyzes the partitions on the hard diskif a partition with certain (unknown at the moment) settings/data is found, THEN:adds to the partition bootsector the word "RECOVERY"changes some data in the MBR accordinglyThe above procedure is NOT repeatable, i.e. once the "RECOVERY" partition is made, the MBRINST.EXE does not recognize it as "RECOVERY" anymore.Additionally, a bit seems like being set in the MBR if, even once, the MBR is booted and the "Recovery" partition is not found. (to be more exact byte 1B4h changes from 01 to 00)Of course by disassembling or reverse engineering the MBRINST.EXE it should be possible to find out which checks are made, and thus being able to re-create the conditions where MBRINST.EXE recognizes the partition, but this procedure is out of the scope of the thread/board. (at least as I see it)On the other hand, no Law prohibits trying to find how the thing works. Some notes:There are several versions of the MBRINST.EXE file.I was able to find/examine three of them:147,456 bytes in size dated 30-09-2005159,744 bytes in size dated 12-03-2008165,248 bytes in size dated 16-10-2008They are all the same thing, but with "added options".#1 has 4 options for "While counting display": nothingDigitDotsQplay#2 has 7 options for "While counting display":nothingDigitDotsQplay HPQplay GWHP F11 NTFSHP F11 BITL#3 has 8 options for "While counting display":nothingDigitDotsQplay HPQplay GWHP F11 NTFSHP F11 BITLHP F11 BL;QPNow again my personal opinion:the tool was initially programmed "properly" (in a version before the first one listed)then it was "customized" and options were added to it (in the "wrong place", it simply makes no sense to have options in "While counting display"in my opinion this is the result of lazy programmers that do quick and dirty hacks instead of doing properly somethingThe app contains a number of different MBR's and also a few bootsectors.For the curious ones, I wrote a small batch that, using gsar and dumphex, can extract these sectors from the app and "divide" them in three categories:MBR'sBS'sUNKNOWN's (most probably parts of a multisector MBR)Here it is. You will need in the same directory of the batch, besides MBRINST.EXE, gsar and dumphex:gsar:http://home.online.no/~tjaberg/dumphex:http://rbach.priv.at/DumpHex/@ECHO OFFSETLOCAL ENABLEEXTENSIONSSETLOCAL ENABLEDELAYEDEXPANSIONCD "%~dp0"IF "%~nx1"=="" GOTO :NofileECHO All files in current directory with extension .sec and .dmp will be deleted.ECHO to abort press Ctrl+C NOW!PAUSEDel *.secDel *.dmpPAUSESet Source="%~dpnx1"Set /A Counter=0FOR /F "tokens=3 delims=:" %%A IN ('gsar -b -s:x00:x00:x55:xAA %Source% ^|FIND /V "found"') DO (SET /A Counter=!Counter!+1SET /A FoundOffset=%%ASET /A Offset=!FoundOffset!-508IF !Counter! lss 10 (SET Number=0!Counter!) ELSE (SET Number=!Counter!)dsfo %Source% !Offset! 512 !Number!_!FoundOffset!.sec)Del *.dmpFOR /F %%? IN ('DIR /B *.sec') DO (ECHO %%?CALL :Dorename %%?CALL :Checktype !NewName!.sec)GOTO :EOF:DorenameFOR /F "tokens=2,3 delims=: " %%B IN ('dumphex -s1B6 /l2 /nc %1 2^>nul') DO (SET NewName=%~n1_%%B%%CREN %1 !NewName!.sec)GOTO :EOF:CheckTypeFOR /F "tokens=2,3 delims=: " %%D IN ('dumphex /l1 /nc %1 2^>nul') DO (SET Type=UNKNOWNIF /I %%D==33 SET Type=MBRIF /I %%D==E9 SET Type=BSSET NewerName=%~n1_!Type!REN %1 !NewerName!.secdumphex /o!NewerName!.dmp !NewerName!.sec)GOTO :EOF:NofileECHO you must supply a target file!ECHO example %~nx0 MBRINST.EXEPAUSEGOTO :EOFResult will be a number of "couples" of files, named in the form:(progressive number)_(Offset within_MBRINST.EXE)_(value of bytes 1B6h&1B7h)_(Type of sector).sec(progressive number)_(Offset within_MBRINST.EXE)_(value of bytes 1B6h&1B7h)_(Type of sector).dmpThe .sec files are the binary sectors, the .dmp files are dumps, that you can open in Notepad or any tect editor.Bytes at offset 1B6h&1B7h appear to be a way to "categorize the different MBR's.Another interesting thing to do with the file is running BinText against it:http://www.foundstone.com/us/resources/proddesc/bintext.htmAn interesting number of things can be found from reading the output, most noticeably the text description of the various MBR's (which is often truncated in the text box when running the tool):0001D394 0041D394 0 unknown MBR0001D3A0 0041D3A0 0 Special D*OEM MBR0001D3B4 0041D3B4 0 MBR1STD (one sector, standard MBR, boot active partition)0001D3F0 0041D3F0 0 MBR1STD0001D3F8 0041D3F8 0 MBR1STH (one sector, force Stealth mode on "SMIMG ")0001D430 0041D430 0 MBR1STH0001D438 0041D438 0 MBR1sNSd (one sector, RP anywhere, dotted count)0001D46C 0041D46C 0 MBR1sNGWQP: one sector, RP anywhere, Gateway, QuickPlay, quiet)0001D4AC 0041D4AC 0 MBR1sNHPBLQP: one sec, RP any, HP F11, NTFS, QuickPlay, quiet, standard boot (BitLocker))0001D508 0041D508 0 MBR1sNHPBL: one sector, RP anywhere, HP F11, NTFS, quiet, standard boot (BitLocker))0001D560 0041D560 0 MBR1sNHPNT: one sector, RP anywhere, HP F11, NTFS, quiet)0001D59C 0041D59C 0 MBR1sNHPQP: one sector, RP anywhere, HP, QuickPlay, quiet)0001D5D8 0041D5D8 0 MBR1sNqC: one sector, RP anywhere, quiet count)0001D608 0041D608 0 MBR1sNSq (one sector, RP anywhere, quiet)0001D634 0041D634 0 MBR1sNS (one sector, RP anywhere, numbered count)0001D668 0041D668 0 MBR1s0Bd (one sector, RP on start of disk, dotted count)0001D6A4 0041D6A4 0 MBR1s0qC (one sector, RP on start of disk, quiet count)0001D6DC 0041D6DC 0 MBR1s0Bq (one sector, RP on start of disk, quiet)0001D710 0041D710 0 MBR1s0B (one sector, RP on start of disk, numbered count)0001D74C 0041D74C 0 MBR1sIUd (one sector, RP in UP, dotted count)0001D77C 0041D77C 0 MBR1sIqC (one sector, RP in UP, quiet count)0001D7AC 0041D7AC 0 MBR1sIUq (one sector, RP in UP, quiet)0001D7D4 0041D7D4 0 MBR1sIU (one sector, RP in UP, numbered count)0001D804 0041D804 0 MBR8s (full featured eight sector MBR)And some info about WHO actually wrote the tool:0001DA00 0041DA00 0 MBRInst. Programmed for SoftThinks ©2001-2006,2008...00022148 00467148 0 XSS; Ulf Loesche...00022212 00467212 0 LegalCopyright00022246 00467246 0 XSS 2001-2006,2007,2008...00022300 00467300 0 www.xss.com0002231E 0046731E 0 ProductName00022338 00467338 0 XSS Preinstall Environment MBR installationFinding of other interesting strings is left to the reader.I guess that people suffering from the problem may want to try contacting the author, Ulf Loesche through his site http://www.xss.com/ to either:ask him for help in solving the mattershow him their appreciation for the programA last bit of text in the .exe, that as I see describes the whole stuff very well :0001DD90 0041DD90 0 ALLES GROSSE SCHEISSE!!!! jaclaz
ahmad2080 Posted April 14, 2009 Author Posted April 14, 2009 (edited) Of course, I did not understand anything from jaclaz's previous post AND I actually don't need to @SnackAfter some little MBR experiments, my computer became unbootable. I did SUFFER to make it bootable again. [EDIT: Using something that I can't mention here!! ]However, I do not attend to participate in other MBR and boot sectors experiments....so if you are seeking more about MBRs and boot sectors and HP recovery partitions, you'll be on your own, sorry. @ALLTHANKS AGAIN Edited April 15, 2009 by ahmad2080
Snack Posted April 15, 2009 Posted April 15, 2009 (edited) Congratulations Ahmad2080! You just won a junior award from MSFN!To wake up your Vista try to run a "Windows Vista Recovery Disc" (about 120Mb) it contain a starting part of vista instalation disk with Starup Repair option. http://www.neosmart.net/blog/2008/windows-...-disc-download/Warning:For lucky owners of HP PC'sIf you are not in face with booting problem - use F11 or F8 option to repair your instalation.Not even try to use above mentioned disc "Startup Repair" in that 100% legal utility from Microsoft to make some repair on HP computers because of those "advanced" HP software developers that don't take into account existence of any other soft (MS !!?) exept of theirs. You will lose the recovery F11 & F8 ability!!! I went no further than I was a week ago. However my experience grow up anyway.Even with the disks created succesfully along with a "unbelievable" help from HP I am not able to perform factory restore.It have to be healthy before creating restore disk!!! So the disks I made got wrong (they say).What than is the purpose of restore partition? Get profits and save money on plastic disk?* When I try to boot in D: (from advises I found across the web ) with a damaged BCD it hung or reboot. * While booting from those DVD's by pressing ctrl + Backspace keys it displays a screen of unusefull options:"Clear the partition table.""Erase the Master Boot Record of drive.""wipe all sectors of drive.""write a DMI to drive1."....and goes boot Vista normally after any key was pressed Solution:The problem is missing boot.sdi file from directory SMINST\BOOTDISK\BOOT\ (in this directory must be two files: boot.sdi and a bcd). Files used by CD creator program to make a bootable image on DVD. Thats why the system should be healthy . B) wise guys... B) Edited April 21, 2009 by Snack
Tripredacus Posted April 15, 2009 Posted April 15, 2009 That's a weird option there, the DMI to drive 1... because the DMI is actually in the CMOS so thats pretty confusing to me.
Snack Posted April 15, 2009 Posted April 15, 2009 (edited) From HP site:Preparing the hard drive for recovery using the recovery discs (Manufacturer Menu) NOTE: Please be aware that using your system's recovery discs may take two hours, and that using discs ordered directly from HP may take four to six hours and include several restarts. 1. Insert recovery disc 1 into the notebook and restart. 2. When the PC restarts, it reads from the Recovery CD/DVD, and displays a screen of options (typically R, F, and Q.) 3. Press and hold the ctrl key, and press the Backspace key. The Manufacturer Menu is displayed. 4. Select option 4, "Clear the partition table." The following message appears: No Operating System Installed or Partition Corrupted Press "R" to perform a full system recovery. 5. Do not press R. Instead, press and hold down ctrl , then press Backspace to bring up the Tools Menu. 6. Select option 5, "Erase the Master Boot Record of drive." The following message appears: No Operating System Installed or Partition Corrupted press "R" to perform a full system recovery. NOTE: If there are no partitions, the following message appears: No MBR or master boot record found. Continue using these steps . 7. Do not press R. Instead press and hold down ctrl , then press Backspace to bring up the Tools Menu. 8. Select option 6, "wipe all sectors of drive." An Erasing Hard Drive progress bar will appear. This process may take longer than one hour to complete, depending on the size of the hard drive. When the hard drive is completely erased, the following message is displayed: No Operating System Installed or Partition Corrupted Press "R" to perform a full system recovery. 9. Press R to begin the automatic System Recovery process._____________I have no "...screen of options (typically R, F, and Q.)..." while booting from DVD. Simple press the key combination above on black screen with cursor blinking on top left corner. Edited April 15, 2009 by Snack
ahmad2080 Posted April 15, 2009 Author Posted April 15, 2009 @SnackIt's sad to hear that the recovery disks you made cannot restore your system to factory.I still didn't burn my recovery disks to tell if they work or not. Why didn't I burn them?!! Actually, I wanted to be sure that everything is OK, then burn the disks.And this is the problem......"EVERYTHING IS OK"!!! After restoring my Vista OS, I wanted to make a full recovery to see if the F11 function works after recovery or not.To make a full recovery there are three ways: F8 boot menu and then choose Repair my computerSet the recovery partition as Active and rebootUsing the F11 functionNONE of the three methods were capable of doing a full recovery.Both options 1 & 2 give me the error message A disk read error occured Press Ctrl+Alt+Del to restartand sometimes by altering the recovery partition boot sectors I get an error saying that the boot manager has failed because of a missing or corrupted device and give an erro code something like : 0x00000212Somehow, I was able to run BCDEDIT.exe and capture the results :NOTE: The recovery partition in the attachment is C.So, is there a way to do a full recovery? can I access the recovery partition using the Bootable USBStick by adding some codes like those for vista1 and vista2??
Snack Posted April 15, 2009 Posted April 15, 2009 All of those errors are from Windows Boot Manager that uses BCD (startup OS Cofigurations Base instead of boot.ini) and not an MBR messages.So the problem is incorrect booting into WinRE image (witch is placed on Recovery D:) using this messed configurations files/registry entries.That's why I would like try import a working branche of registry HKLM\BCD or C:\boot\bcd itself. I think that is hardware independent and can be copyed from any working HP computer running Vista.In fact Jaclaz is right - there are many of undewater stones and some trics from HP in MBR. But on the other hand F11 routine from MBR working and stops in this BCD brushwood.
ahmad2080 Posted April 16, 2009 Author Posted April 16, 2009 I'll try to upload a working BCD from both C: and D: soon. [not from my notebook of course]In the meanwhile, I'll try some BCD programs to fix this booting problem.
Snack Posted April 16, 2009 Posted April 16, 2009 (edited) This topic win a popularity award also!! Ahmad2080 I found two of them freeware: VistaBootPRO 3.3 and EasyBCD 1.7.2 and bulletin from Microsoft From Acronis.com can be dowloaded Acronis Disc Director v2.161 that is for Vista (previous versions does not!!) to resize partitions and retreview contents even of HP recovery hidden section directly from Windows.Solution:Safe way to resize and create partitions on HP PC's is using Vista disc managenent. Acronis and many others when resizing change bootsectors and replace it with a standart (warning for D: - you can lose a RECOVERY stamp and see in this case "...not found" message while trying to start recovery or CD creator) Edited April 21, 2009 by Snack
ahmad2080 Posted April 16, 2009 Author Posted April 16, 2009 (edited) mmm, I've tried BCD programs already but.....no results obtained.The whole problem now is in the BCD.......I have the BCD file in C from my friend's notebook but I can't open it to read......Is there a software to do so?I've just figured out what does HPRM-BCDFix.cmd in C:\programfiles\SMINST do.....It adds the option "Repair your computer" in the "Advanced boot menu" when F8 is pressed at startup.But when I choose that option I get the Boot loader error message.So the link between the "Repair your computer" option and the recovery partition is still missed Edited April 16, 2009 by ahmad2080
Snack Posted April 16, 2009 Posted April 16, 2009 (edited) Hi ahmad2080!All you have to do is just copy this file to USB drive and post it. To put it in place need to reboot from disc with WinPE environment, renaming existent one to bcd.old. Because this file is a part of Registry and couln't be modified instead of regedit or special soft posted above. note:Those programs can't open a standalone file. Only make backup and some cosmetic changes that not siutable for "chosen" HP users. I'm not sure but if you rename a BCD file to xxx.bcd and then try to restore backup with VistabootPRO from this one would it be a solution?? edit:It seems like EasyBCD has this ability only for viewing and editing but not for import as current.Another way is open regedit from cmd and export/import NKLM\BCD section into a .reg file to/from USB drive.Warning:Editing BCD is a dangerous game - don't use utilities unles you have to. Edited April 21, 2009 by Snack
ahmad2080 Posted April 16, 2009 Author Posted April 16, 2009 I've done alot of work here and got nothing...I need some experience with BCD...I've used bcdedit.exe and created a logical BCD......but it doesn't workCan anybody here point me to the right direction?
Tripredacus Posted April 16, 2009 Posted April 16, 2009 OK, all you guys that want to try something out to restore the F10 or F11 or whatever key functionality to your partitions can try this. I cannot garauntee that this will work!First, you need to have access to Windows or a PE environment. Otherwise you won't be able to do this.1. Make a folder on your C drive to put your files in. ie: c:\mbrtools2. Download PARTINFO from Terabyte Unlimited. Extract it into c:\mbrtools.3. Download MBR Utility from Terabyte Unlimited. Extract it into c:\mbrtools.4. Open a command prompt (elevated if need be) and switch to the c:\mbrtools folder.5. Run the following command: "partinfw > partinfo.txt". This will make a text file in c:\mbrtools. Open it up and you will get something like this:PARTINFW 1.11Copyright (c) 1996-2008 TeraByte, Inc. All rights reserved.Run date: 01/09/2006 0:52==================================================================== MBR Partition Information (HD0 - 0x488BBB22) (CHS: 1022/254/63) (WCHS: 9729/255/63)+====+====+=============+====+=============+===========+===========+| 0: | 80 | 0 32 33 | 7 | 1023 254 63 | 2048 | 127426560 || 1: | 0 | 1023 254 63 | 17 | 1023 254 63 | 127428608 | 28870656 || 2: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 || 3: | 0 | 0 0 0 | 0 | 0 0 0 | 0 | 0 |+====+====+=============+====+=============+===========+===========+ BOOT SECTOR INFORMATION-------------------------------------------------------------------------------File System ID: 0x7 LBA: 2048 Total Sectors: 127426560 ID: 0x1 Jump: EB 52 90 OEM Name: NTFS Bytes Per Sec: 512 Sec Per Clust: 8 Res Sectors: 0 Zero 1: 0x0 Zero 2: 0x0 NA 1: 0x0 Media: 0xF8 Zero 3: 0x0 Sec Per Track: 63 Heads: 255 Hidden Secs: 2048 NA 2: 0x0 NA 3: 0x800080 Total Sectors: 0x07985FFF MFT LCN: 0x0C0000 MFT Mirr LCN: 0x07985FF Clust Per FRS: 0xF6 Clust Per IBlock: 0x1 Volume SN: 0x72B4864EB48614AF Checksum: 0x0 Boot Flag: 0xAA55-------------------------------------------------------------------------------File System ID: 0x17 LBA: 127428608 Total Sectors: 28870656 ID: 0x2 Jump: EB 52 90 OEM Name: NTFS Bytes Per Sec: 512 Sec Per Clust: 8 Res Sectors: 0 Zero 1: 0x0 Zero 2: 0x0 NA 1: 0x0 Media: 0xF8 Zero 3: 0x0 Sec Per Track: 63 Heads: 255 Hidden Secs: 127428608 NA 2: 0x0 NA 3: 0x800080 Total Sectors: 0x01B887FF MFT LCN: 0x0C0000 MFT Mirr LCN: 0x01B887F Clust Per FRS: 0xF6 Clust Per IBlock: 0x1 Volume SN: 0x785C98125C97C8F0 Checksum: 0x0 Boot Flag: 0xAA55The above code is from my testing Recovery partition project. The first drive has a File System ID of 0x7, which is NTFS. The Second partition has a file system id of 0x17. The 7 still means NTFS, but the 1 before it means it is hidden. NOTE: If both your System and Recovery partitions have the same File System ID, this may not work!6. Run the following: mbr 0 /install selm 10 11 "Press F11 for Recovery" 0x7 0x17Here is a run down of the options in the above command:mbr = the program name0 = the disk ID (Disk 0 should be your boot hard drive)/install selm = the command needed, do not change this.10 = timeout in seconds. This is the length of time the keypress message will stay on the screen. I use 5 seconds myself.11 = The function key number. I use the F11 key for testing, so this number is 11. If you want to use a different function key, type in a different number here."Press F11 for Recovery" = Make sure to use the quotes around this. This is the message that appears prior to booting the system partition. You can make it say anything you want.0x7 = the type of partition the recovery partition will be changed to. This must match the file system that is currently on it.0x17 = references the recovery partitions File System ID that PARTINFO displayed. This is designed presuming you only have 1 partition of this type on the computer. There are some additional caveats to using this method. The primary one is that after you hit F11 and it boots into the recovery partition, your PC will not be able to go back into Windows unless you run another command. If you can gain access to the command prompt in the recovery partition, you can do this, or if you have a WinPE on a USB or CD you can do it also, but you need to put the MBR.EXE onto that media! You may be able to access the MBR.EXE on the C drive where you saved it, but it would be safe to have it elsewhere as well. After booting into the recovery partition, you need to run the following:MBR 0 /resetThis resets the Master Boot record changes that pressing F11 changed. If you cannot do this from the recovery partition, you can boot to a WinPE CD and run the command that way. So you need to run this before you can get back into Windows. If PARTINFO does not show that your Recovery Partition is hidden (ie starts with 0x1) you could try to hide it with MBR.EXE. However, this will hide it from Windows and you cannot unhide it using Diskpart. Diskpart will not show that it is hidden! That command is:MBR 0 1 /Hor to unhide:MBR 0 1 /UHIf you hide your recovery partition (so that PARTINFO says 0x17) then you can use the command to add in the F11 key. You can even run this command from within Windows, but the changes will not be in effect until a reboot when the PC reads the MBR again. Only other issues is that if your BIOS has its Boot Sector Virus detection turned on, it may give you a warning on your reboot. So if your PC has this option, turn it off during testing. I doubt Ahmad had this since it would have given him an error with all the testing he has done so far. And lastly, I will add again that I do not have access to an HP or its recovery software as they do it. So I can't be very specific on a case to case basis.
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now