Detecting windows mode during setup

NTDEV
1

Hi,

During Windows setup I see that it goes through 3 modes/sessions between reboots:

  1. WinPE mode where you choose the disk/partition to install, copy files and it reboots
  2. Intermediate mode where it shows ‘Preparing Devices’ and then reboots again
  3. Final mode where you set the password and subsequently login into the installed OS

Is there any way to detect if I am in (2) above from kernel mode?

I think I can read the “HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinPE” key to check if I am in (1).
However I cannot find anything that can differentiate (2) from (3).

I have noticed that in (2) I get the string “We are running at normal mode” that doesn’t come in (3) or any subsequent OS boots. So in other words, I need the logic/DDI/global variable that tells when to print that string.

Regards,
Suresh

2

Why do you think you need to differentiate? The setup process can and does change, drivers that try to tie behavior to specific implementation is a fragile proposition

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Sunday, February 19, 2017 9:28 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Detecting windows mode during setup

Hi,

During Windows setup I see that it goes through 3 modes/sessions between reboots:
1) WinPE mode where you choose the disk/partition to install, copy files and it reboots
2) Intermediate mode where it shows ‘Preparing Devices’ and then reboots again
3) Final mode where you set the password and subsequently login into the installed OS

Is there any way to detect if I am in (2) above from kernel mode?

I think I can read the “HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinPE” key to check if I am in (1).
However I cannot find anything that can differentiate (2) from (3).

I have noticed that in (2) I get the string “We are running at normal mode” that doesn’t come in (3) or any subsequent OS boots. So in other words, I need the logic/DDI/global variable that tells when to print that string.

Regards,
Suresh

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

3

Thanks Doron. I was wondering if there is any definitive way like:

  1. InitSafeBootMode variable to differentiate between safe boot and normal boot
  2. The “HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinPE” key to check if we are in WinPE

Looks like then there is none.

4

Why do you need to check? Repeating your question without answering mine is a waste of both our time.

Bent from my phone

From: xxxxx@lists.osr.com on behalf of xxxxx@yahoo.com
Sent: Sunday, February 19, 2017 10:01:40 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Detecting windows mode during setup

Thanks Doron. I was wondering if there is any definitive way like:
1) InitSafeBootMode variable to differentiate between safe boot and normal boot
2) The “HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinPE” key to check if we are in WinPE

Looks like then there is none.

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

5

Sorry, I should have made it clear earlier.
I am using a coinstaller to decide whether to load my driver for an adapter or let that adapter be owned by an existing driver. This works correctly in WinPE but this selection does not stay persistent by the time the OS loads into normal mode.

While debugging this I noticed that in the ‘intermediate mode’ that I mentioned in my question, my driver is getting loaded and then the coinstaller also gets loaded!
I actually have this another question here, that why does the coinstaller gets loaded ‘after’ the driver (seen only in this mode). Or even, why does it get loaded at all. Isn’t that supposed to get loaded only for a new device detection?

I am then looking to detect this mode in my driver so that I do not adversely change any device state, and if needed, can be a no-op driver altogether. Thanks.