Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2678 Thanks!
[Music]
thanks everybody for being here uh in
the shade I hope it's uh not too hot uh
so let's get let's get started with the
talk um so yeah uh boot L crimes
building disposable Windows VMS uh what
is this all about so bit of motivation
why why why are we even doing this so uh
you know I use Arch by the way on on the
desktop even uh but yeah as mentioned
sometimes you know you cannot get around
windows right um maybe you have some
application that you know you cannot run
in wine it doesn't work right or you
maybe don't even want want to run it on
your you know main system because it's
some uh you know not very trusted
software and you just want to analyze it
poke at it or you have some proprietary
software or Hardware that requires
Windows software that you maybe want to
reverse engineer and make make work on
on Linux um this this happens to me and
I think you know at at Camp you know it
probably happens to to most people but
only sometimes you know you don't need
it every day but you know every so often
once every few weeks or months even um
but then you know sure use a use a VM
right we have the right tools but you
know I guess maybe show fans who has you
know Windows VM that just lies around
that they you know haven't booted in a
while or yeah and you know when you boot
it is it a is it a you know keep a hand
up if it it's a pleasant
experience yeah yeah the one guy one guy
in the back he has it all figured out um
so yeah you boot it and then you know it
wants to update or I don't know some new
features have been pushed that you know
you now have to to deal with or you know
activation has expired or generally
something else has broke and you know uh
sure you know you you can you know keep
windows V around and you know if this is
maybe your day job and you know you
maintain it or you know have lots of
snapshots whatever this might be
pleasant but you know for occasional use
maybe not so much so you know sure just
do a fresh install right uh but you know
that for occasional use you know it's a
lot of quick clicking waiting you need
to configure all the all the things you
know install all your tools software
again you know enable you know file EX
exensions you know we've probably all
been there uh and you know declutter you
know remove what whatever you know
useful features Microsoft added in the
meantime uh but you know we're hackers
so you know when and doubt automate
right and so this is uh what this is all
about so there there are some existing
installations right people have uh
instrumented or you know um automated uh
Windows deployments you know there's
open source uh more or less open source
Solutions you know there's box starter
which is some tool that you can you can
put on a Windows machine that is already
installed and it will continue set up uh
your environment uh hashy Packer it's
used for you know Building images for
for vagrant if you if you're heard of
that uh it can provision Linux but they
also have some very nice uh templates on
on provisioning Linux uh you could you
know remaster an ISO and put some answer
files in there so it installs itself uh
yeah as mentioned answer fils uh anable
has support for it so you could write
some playbooks or you know foran uh
deployment solution also does it uh but
you know I looked at all of these and
some of these they have some nice
concept but you know now of these really
worked for me so you know obligatory you
know xkd reference you know already so
much stuff but you know we need we need
more and Surly this will fix all at
least my problems and yeah so let's see
so some design goals right so I want it
to be really easy to use you know I
don't want to write yaml or or Json or
whatever I just want to use a website
right so I can send it to someone and
they can use it without you know
installing any any software or cloning a
g repo right I want to import all the
all the settings you know select some
some check boxes about features maybe
you know configure my username time zone
whatever and maybe even save and you
know load a preset or even share a
preset with a friend um yeah targeting
so I've been working on this project on
and off for a while so initially you
know maybe it was window 710 these days
it's 11 because you know it's a the
latest release and the one that will be
supportive for the longest and Hy is
yeah I work with virtual blocks qo but
you know surely it it should run on all
of them really um so the question is how
do we do this
um um we could just build an image on a
server right have a have a bey be server
server that can uh create create an
image provision it and then we download
the final final image right that's maybe
fine for myself but it it runs into some
some issues right so there's obviously
IP copyright troubles if I offer
finished windows image there's you know
intellectual property by Microsoft you
know they might not be so happy with me
Distributing that um also it it doesn't
scale right it's rather re resource
intensive you know I need a lot of
resources to provision VMS on my server
the images I will ship will incur a lot
of traffic so that's not ideal if I want
to you know have many people use it so
the idea is here just run it locally but
you know have it provision itself
locally but you know how do how do how
do we do that so um the first step this
we can do in your browser right so you
fill out some form and you know from
that will will generate some
configuration file and then we'll just
inject that into a very tiny like 15
megabyte um disk image you know just
copying it in there with an array
operation and we'll also get the
generate this ovf like manifest file
it's an XML with some you know your vm's
name and memory size whatever and then
we'll just throw these into a AR and
that generates an OVA file which is just
this uh you know Appliance container and
you can import it and I think you know
virtual box um uh VM also has support in
it or you know alternatively you could
just get the the dis image out of there
again and maybe lose some of the
metadata and this we can all do in the
browser um on the client we don't even
need server code we can just you know
serve some static files you know few
megabytes and then you get this OVA okay
but
what is in there so you boot it and this
is the initial state of the disc so you
see we have like this little boot
partition it has a bunch of stuff in it
and we have like an empty NTFS partition
so there's a kernel in there we can boot
it with some boot loaders just Linux in
this case and in this case it's just
some stock uh Alpine kernel pre-compiled
for for VMS you could do your own with
build rout and make it even smaller but
you know taking binaries from you know
Alpine is uh just sufficient and we
remake it a bit there's an uh initial
Ram dis image in there that's very tiny
it's just busy box and uh and curl
essentially and some other configuration
files and you know shell scripts and you
can see highlighted your user
configuration that we injected in the
browser so uh that is the only part that
is unique and so yeah you boot this and
you know you see okay it's a very
minimal Linux thing thing booting
there's some tiny user space and it
drops you into a it automatically
executes a shell script into does some
things okay so what does it do um yeah
so it does some DHCP sets up networking
sets up you know your basic uh stuff
that you need to run uh drivers uh
devices monster diss whatever and first
things first well we need to get a
Windows installation right we didn't
want to ship that so we need to get it
from somewhere um thankfully Microsoft
has a um evaluation image for well these
days Windows 11 but I think they also
have it for for Windows 10 even still
online and you can just freely download
that if you know the URL so we just
fetch that with curl and put it on our
into our scratch space right and we can
then also like validate the check some
to see that it's
legit so in the next step we we start to
mount it we extract some things so you
can see on the left we extract some uh
boot files and the install file so the
install file is basically what what
contains the data we need for our
Windows installation and the boot files
are kind of this live installation
environment
so you can see these are in in wiim
files so so what are wiim files really I
mean maybe if you've dealt with
provisioning windows before you you've
seen these um so Microsoft uses these
for uh installing and deploying
operating systems since Vista so they
saw you know copying hundreds of
thousands of small little files from
install media to the disk is cumbersome
let's just package it somehow um so the
title says you know it's an Imaging
format you know it's not like youd a dis
it's not um you know just blocks from
from a block device but it is filed so
it's rather more like a a zip or a tar
really but it has some additional
features right it has all the metadata
you know all the windows security
descriptors uh whatever um fancy NTFS um
file special file types whatever that
can all be persisted into a whim uh and
you can have multiple images right so
maybe if you have installed media that
has different versions of of Windows
right uh um you can all package them
into one wiim file but you can D
duplicate files because these versions
they will have a lot of the files that
are identical so you know it'll just be
pointers to the same data essentially
and you know you can compress it in
various ways you can also split it you
know I guess if you want to keep your
whims on fat 42 or whatever and or your
another file system that doesn't support
arbitrarily large uh files um you can
split them up um also you can boot them
uh you know the installer or if you have
a recovery system uh you can directly um
tell a boot loader or one of Microsoft's
boot loaders to find some find the right
files in this whim and then uh boot into
it and yeah you can manipulate it on
Linux for example with whim Li Microsoft
in in Windows also has some uh yeah uh
tools for it and I think you know if you
have a on Linux if you have a package
manager uh then you can you can likely
also use that yeah in the end it's it's
really a fancy zip file more or less um
so okay now we have these whim files on
disk uh we need to do a bit more you
know we have the user configuration and
some templates so from these templates
we generate some more files that I used
you know the answer file and maybe a
Powershell script that I used later
during the
install and uh then we fed Wim boot this
is from the I pxc guys and uh that it's
basically a open source boot loader that
we can use to uh as mentioned previously
we can boot wiim files so this is a yeah
component that we can use to boot into
this boot.wim from the X4 partition even
and yeah there's some other files in
there we have an in and a butt file
which are used in the next stage where
we actually boot into that um that
installation
environment yeah so we tell s Linux hey
don't go to the kernel anymore go to go
to go to um Wim boot instead and uh
please boot these files that we dropped
on the X4 partition and we end in the up
in the windows so-called winp windows
installation environment this is you
know if you pop in install media what
you see and instead of the installer you
just get a shell and the shell script we
we have in there gets gets run so what
do we do in that shell script so we
continue the installation process
because we now rely on a few tools that
are uh just available from from
Microsoft need to be run in a in a
Windows environment right so essentially
we're now have switched after after
rebooting from the live Alpine in into a
live uh Windows environment right so
first thing is we get rid of that X4
partition uh we did boot from it but now
we're running from memory so it doesn't
matter you can do it with dis dis part
it's like f disk but you know for for
Windows or for Microsoft uh command line
partition
editor we create a new uh partition uh
uh for our final installation so it's
only occupying half the space of the of
the image right now because you know we
still have our scratch partition we we
create a file system and then mounted uh
so you know mounted under under W like
Windows and then we start uh do doing
the deploy right so with this dim you
say apply image and that is essentially
you know unpacking right it just takes
all the all the data that is in install
whim and just shovels it on on the
partition right and you can see the the
typical directories appearing um that
you would have in a Windows
installation and yeah we also copy copy
our answer files over uh so they reside
on there
and yeah we can delete the scratch
partition and then grow the grow the
other partition and now we're
essentially in a stage where we have
yeah the dis almost ready to use it's
you know correctly partitioned we have
one giant windows partition um and MBR
partition table uh for for Windows uh
and yeah all is well well this is not
not really a bootable system yet right
so if you just drop some files on a on a
partition you know your computer will be
like oh that's fine but you know
I don't know how to run this um so how
does this usually work with Windows
right so we have the the like modern day
the you know ufi way and the you know
Legacy way and you know somehow the the
firmware of your of your main board runs
or your system runs and you know we need
to somehow load the kernel right and how
does that happen so with uh ufi it's
comparatively easy right you have a EFI
partition it's it's fat there's a p file
on there you know uh this this one file
it it'll get it'll get run and then it
can you know it loads another load file
and then eventually load some stuff and
loads the kernel it references this BCD
database which is you know boot boot
configuration data right so it's um kind
of like a Windows registry Hive but you
know comparable you know to your grab
config right there's some if you want to
boot in safe mode or you know disable um
I don't know certain features like uh
driver signing or boot Windows in we had
special modes that is where you would
configure that um but we're not using
that right we're on a in a a VM and uh
you know we don't we don't have EFI
setup it's just a normal VM and you know
we don't have an EFI partition we just
have one giant NTFS partition you know
we want to boot with with bios how do
how do we do that uh so you can do this
command so BCD boot uh this will install
a bunch of things it will install the
the boot manager to disk um and also
populate the the BCD uh configuration on
your on your windows partition okay so
we have that set up and we have another
command boot sect and uh this will
basically set up the earlier stages
right it will write the MBR which is at
the very beginning of dis and it's
rather tiny and it will also put uh
secondary uh loaders into the uh
partition itself right the the volume uh
boot record or partition boot record
whatever you want to call it but this
resides in in some free space in the
NTFS partition that we have and this
will get populated by this command and
yeah we just call them in our
pre-installation environment and then we
have a bootable system right so
Microsoft we just reboot and Microsoft
calls this the outof boox experience
right it's the first time you boot the
system will reboot a couple of times um
uh do some do some setup and yeah get
you going um so now our XML answer Files
come into play um usually you have these
uh uh these dialogues uh we don't you
know we don't want to create an online
account whatever but the answer file
bypasses all that you know we picked a
keyboard layout we created a local user
set up a host name whatever and at the
end we'll invoke invoke the Powershell
script uh in the Powershell script uh
what can we do well you know just some
examples right the we can configure all
the annoying things and it does things
as instructed to by the web application
so it's sources the the configuration
you put in in the browser and sets some
things up um yeah there's some links to
things you can install software with
chocy whatever and at the end of the day
you'll end up at the desktop this takes
about you know 10 to 15 minutes
depending on the internet connection if
you have to ISO locally it's faster if
you choose to install updates and it has
to reboot a bunch of times it can take
quite a bit longer but you know 10 15
minutes is is a good uh a good estimate
uh but you don't have to do anything
during that
time so why why is this you know
bootloader crime and it truly curs
install so as mentioned we're installing
Windows 11 but we are you know doing
Legacy brute right we we don't have an
EFI we don't have secure boot we don't
even have a TPM as mentioned it's a you
know a classic partition table it's not
a uh GPD par B um we don't we might even
not have you know more uh 4 GB of RAM
which is the I think the minimum uh or
you know compatible processor why is
that you know Well turns out you know
the project it started time ago and I
was trying it with Windows 7 and that
worked just fine and then I switched it
to Windows 11 and it continued working
and like huh that's that's interesting
okay so yeah some more uh it seems
really the installer enforces lot of
stuff and there's tutorials on how to
bypass these checks in the installer um
but we don't even use the installer
right we just boot into a live
environment and unpack the files
normally um so yeah uh further other
than also the install media is uh EFI
only so it won't boot on on on Legacy
boot but it doesn't matter we use S
Linux and Wim boot so we bypass that uh
and very interestingly the boot tool
still has MBR support so I guess you
know not entirely sure why but I guess
you know Microsoft is strong on
backwards compatibility so they probably
left it in it's useful if you want to
use uh Windows uh uh 11 tools to maybe
repair Legacy install of an older
version uh yeah and yeah as far as you
know the the whole boot loader chain uh
I mean the kernel the hand over it's
it's mostly you know it seems the the
format remain compat compatible in the
end you know it's just a PE file that's
massively simplifying it but um it it
seems both boot chains the the Legacy
and the the EFI ones still work so of
course this opens up wild speculations
that I won't get into uh into here in
this talk um you know surely some of the
this you know parts of this is a
technical decisions you know things like
C boot um having a TPM makes sense uh if
you want to run this in production uh
don't run this in production right run
this for research VM or whatever um
maybe some of it was also business de
decision um uh yeah so there's some
future work quickly to get to get into
um uh yeah need to test this on on more
hypervisors and yeah enhance how you can
configure it how you can customize it
maybe a lot user to insert some hooks uh
in the in the web applications to do
more more advanced stuff um also in
theory you know you can do this on bare
metal right you could uh put it onto
some flash drive and uh uh yeah have it
um uh not install on its own block
device but on some other block device
that's just you know minor tweaks it
would be really cool to make this an
even more weird install to enable the
pre-installation environment entirely
either you you know run dism in wine or
maybe use even wiim lip to to deploy uh
some of to deploy the files and then
figure out how to install the boot
loaders um maybe also install updates
from the pre-installation environment so
it's quicker uh also maybe even going to
ufi and a GPT disc just you know MBR
discs they have limits in size you know
if you want really large discs for your
research VMS you're kind of limited by
that right now and yeah with the bare
metal thing you know find some really
obscure Hardware to to make this to make
this run on and have some fun with it um
yeah that's it uh that's the GitHub Rao
where the the code lives and um uh it's
not up there right now but I'll be sure
to to push it you know later in the in
the day or the following days and um uh
yeah you can hopefully then then try it
out directly there I'll put a link in to
try out the the UI Online and yeah if
you want to reach me I'll be around on
on Camp or you know you can get all my
contact details
online that's it hope you enjoyed
it yeah many thanks Philip for this
interesting talk unfortunately there's
no more time for questions left so thank
you
[Applause]
again