Hacker News Reader

Comment by pmalynin | Hacker News Reader

Reading the headline made of think of installing Windows via the command-line (say via imagex). Which is actually very useful in certain tricky situations when you mess up an install.

Once I didn't have enough space on a flash drive to install Windows via an ISO...but I did have a liveboot ubuntu system and 2 spare drives. Interestingly enough imagex and WIM tools were ported to linux, and it was a surprisingly easy experience.

View on HN

Probably a nitpick but wimlib isn't a port. It's a separate implementation based on reverse engineering the Windows tools and format.

Just a note, ImageX is superceded by DISM, and both of them utterly fail at keeping extended attributes (despite the command line flags). So what you restore won't be the same thing as what you backed up. (I don't know of any tool that handles all of EAs, reparse points, etc. correctly.)

Do you have any examples of failures? I’d like to know what specifically is not working.

Extended attributes? That is the specific example. Create a file with EAs and see if you can back up and restore it with the same EAs.

Where are the NTFS EA used, if that's what you're writing about? I can't find anything except:

https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html

"Used to implement the HPFS extended attribute under NTFS."

Is your complaint is that the tools that are used to make the image of the installation files of the Windows don't include that? I assume that $EA entries don't exist in the installation files of Windows, for which the DSIM tool is used (and it's surely not an universal backup tool).

And how do you read or write these? And what do you use them for? I was able to find only ZwSetEaFile and ZwQueryEaFile which are documented for kernel-mode drivers? Are there any plain user-level API's? https://attack.mitre.org/techniques/T1096/ I also find: "it may (be) worth noting that Windows does not contain any api that can be used to remove extended attributes."

WSL uses them for one (so good luck backing up WSL installations) https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-sys...

Other stuff does too, e.g. https://docs.microsoft.com/en-us/windows-hardware/drivers/if...

Those are user-level APIs as well, though usually called via NtQueryEaFile and NtSetEaFile.

And (part of) my complaint is that DISM's /EA flag is broken.

I did that too! The world certainly has changed now that installing Windows is easier to do from Linux!

I'm also looking towards using the winre partition to store wins and some kind of iterative snapshots for PITR recovery.

Any suggestion is welcome!

There was a tool called Unattended [1], built to install Windows from Linux via PXE booting. I've used it a couple of times, but it left off at Windows XP (and Server 2003), which is a bit too far beyond for me now. Anyway, I think Windows 7, and definitely Windows 10 are easy to boot from USB, which is almost as good as a network boot.

[1] http://unattended.sourceforge.net/advanced.php

Windows has always been easier to install than Linux lol. Also wmi's have existed forever. Most Windows specific knowledge is found closed with enterprise sysadmins and not shared out in the open- who should be blamed is your choice. I blame ms

Reply on news.ycombinator.com