Winload Bootmgr Options (Reverse?)

Discussion in 'Windows 8' started by KNARZ, Sep 25, 2013.

  1. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    879
    457
    30
    #1 KNARZ, Sep 25, 2013
    Last edited by a moderator: Apr 20, 2017
    I'm interessted if anyone know some way to may reverse engineer which bcd-entries get checked within winload.exe. It's more about what may else is possible?

    E.g.
    Code:
    bcdedit /set {globalsettings} custom:16000067 true
    removes the Bootlogo from Win8 (at least with BIOS mode, UEFI Unknown) but this entrie is undocumented and was kind of reverse engineer by me, but the initial input was from some Windows Embedded Tool/Component/Package. So it was kind of public/provided.

    There are a couple of other custom entries... and with some brute-force script I was able to destroy the system (only black screen in the end).
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. KNARZ

    KNARZ MDL Addicted

    Oct 9, 2012
    879
    457
    30
    only for the record: Winaero (hb860) created the tool based on my script.

    And I still could need someone who is able to manipulate 1 (kernel-)protected registry key OR can manipulate the loaded ram data (don't know if possible in any way) - the best way would be some kind of rootkit. It's tricky but worth it and so on --> No more activation, no limitations.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Mr Jinje

    Mr Jinje MDL Expert

    Aug 19, 2009
    1,773
    1,089
    60