[Released] XP RAID 5 Hack

[rikgale]

Hi All

I have created an addon to replace the files needed for the XP RAID 5 hack as mentioned at TomsHardware Guide.

I've only been able to test in VMWare, but I have had a RAID-5 software array up and running and also a mirrored RAID-1 software array as well.

This should work whether you have the update packs intergrated or not, but you will need to have SP2 slipstreamed first. Also I have only run this update pack using the latest intergrater, and no nLite, but should work using nLite.

The addon can be found here: Rikgale_XPRAID5_addon_v1.cab
MD5 Hash: DBC21C273E107C842DEDED46BF2E328E

[larciel]

wow very nicE!

[rikgale]

Thanx, larciel.

I should also thank RyanVM as well, as it was d/ling his hacked files that made me realise how simple it would be to add the XPRAID files. The HEX edting was a P.I.T.A., I dislike Hex editors and Hex in general., but it was a means to an end.

[orcoxp]

Can I put these on a CD and install to a single drive setup with no RAID?

[rikgale]

Yep

It just adds the ability if you have enough drives to do mirroring (RAID 1) and Parity (RAID 5), thru software.. It does not affect anything else, it just adds functionality.

Normally XP can only do spanning and stripping of dynamics discs, these hacks, allow as I said mirroring and parity.

Only two things to note sofar.

1) You can't install to a software RAID 5/RAID 1 setup.
2) For some unexplicable reason when there is a RAID 5 array present this line in My RunOnceEx.cmd fails to work (its part of my MSAntiSpyware install).

Code: Select all

REG ADD %KEY%\007 /V 7 /D "%systemdrive%\Progra~1\Micros~1\gcasDtServ.exe /regserver" /f

Simple work around is to remove the array discs (all of them), install uAXP and add the array discs back in and actiavte the array. Probably safer anyway not to have the array present during an install anyway.

I've found the software based RAID5 setup to be very robust. When I get the money I'll be setting up a system using this, as a backup system.

Hope this helps

[yusenda1]

rikgale,

can you add the hash for your file?

Thanks mate, nice work!

[rikgale]

Yep

I'll do it when I return to my computer tomorrow.

Rik

[rikgale]

MD5 Hash added
rikgale

[yusenda1]

Rikgale,
thanks for the hash!
One more request:
I got trouble from here connecting to http://www.thethirdrow.plus.com/ , is it possible for you to mirror it somewhere else, probably rapidupload or something ?

[rikgale]

Not sure why you cant access it, as I can get to it fine.

Here is a rapidshare link

http://rapidshare.de/files/10324004/Rik ... 1.cab.html

rikgale

[twig123]

I have a really stupid question....
I have never setup a software RAID, only Hardware...
...What is the process to setup a RAID array through windows????

[Denney]

@twig123:

Google is your friend: http://www.pcstats.com/articleview.cfm? ... 830&page=5

Here's a better guide... good old Tom's Harware....

http://www.tomshardware.com/2004/11/19/ ... page3.html

[twig123]

Thanks guys

[ViVa]

*bump*

[Zacam]

Firstly, my apologies, this is going to be a long one. Grab a sandwich and some coffee before reading this one through.

So, in looking at the toms hardware guide on how this (the XPRAID5 Hack)was done, I examined the results.

Frankly, I was confused. Sure, it works, but it does mangle a few things. I have to wonder if the person who brought this to THG's attention (and why nobody in THG bothered) actually looked at these files with a disassembler. The fix should have and could have been a little cleaner.

Allow me to illustrate using excerpts from the dmboot.sys and dmconfig.dll files.
I'll try and make this make sense. For reference, I use tiny hexer and PE Explorer.

Here's a code snippet of DMBOOT.SYS (the original) at the location to be changed:

Code: Select all

 0002107A						   SSZ0002107A_WINNT:
 0002107A  57494E4E5400				  db	'WINNT',0
 00021080  0000						  Align	2

 00021082						   SSZ00021082_SERVERNT:
 00021082  5345525645524E5400			db	'SERVERNT',0
 0002108B  000000						Align	2

Let's see what PE Explorer Disassembler says about the recommended HEX edit chage (Hacked DMBOOT.SYS, same location):

Code: Select all

 0002107A						   L0002107A:
 0002107A  53					   		db	53h;   'S'
 0002107B  45					   		db	45h;   'E'
 0002107C  52					   		db	52h;   'R'
 0002107D  56					   		db	56h;   'V'
 0002107E  45					   		db	45h;   'E'
 0002107F  52					   		db	52h;   'R'
 00021080  4E					   		db	4Eh;   'N'
 00021081  54					   		db	54h;   'T'

 00021082						   SSZ00021082_WINNT:
 6CAC5D4C  57494E4E5400					  db	'WINNT',0
 00021088  00					   		db	00h;
 00021089  00					   		db	00h;
 0002108A  00					   		db	00h;
 0002108B  00					   		db	00h;
 0002108C  00					   		db	00h;
 0002108D  00					   		db	00h;

Guh. Granted, it works. Switching their position changes the relocations that are called, which I'll list here (these relocations are the same between the original and the hacked, with two slight differences):

Code: Select all

 000210F2						   L000210F2:
 000210F2  FF75FC						push	[ebp-04h]
 000210F5  8B353C5D0400				  mov	esi,[ntoskrnl.exe!_stricmp]
 000210FB  687A100200					push	SSZ0002107A_WINNT
*******This is how the above line looks in the hacked file*************
 000210FB  687A100200					push	L0002107A
*******End Difference One**************************************
 00021100  FFD6						  call	esi
 00021102  85C0						  test	eax,eax
 00021104  59							pop	ecx
 00021105  59							pop	ecx
 00021106  750B						  jnz	L00021113
 00021108  8B4508						mov	eax,[ebp+08h]
 0002110B  C70001000000				  mov	dword ptr [eax],00000001h
 00021111  EB39						  jmp	L0002114C

 00021113						   L00021113:
 00021113  FF75FC						push	[ebp-04h]
 00021116  6882100200					push	SSZ00021082_SERVERNT
*******This is how the above line looks in the hacked file*************
 00021116  6882100200					push	SSZ00021082_WINNT
*******End Difference Two**************************************
 0002111B  FFD6						  call	esi
 0002111D  85C0						  test	eax,eax
 0002111F  59							pop	ecx
 00021120  59							pop	ecx
 00021121  750B						  jnz	L0002112E
 00021123  8B4508						mov	eax,[ebp+08h]
 00021126  C70002000000				  mov	dword ptr [eax],00000002h
 0002112C  EB1E						  jmp	L0002114C

So, it's essentially faking it out. Swapping the relocation pointers for WINNT to assume the abilities of SERVERNT and leaving SERVERNT to do god knows what (what WINNT would do in the original, pressumably).

But what if we take a closer look at 2 lines in particular and then swap their hex code:

Code: Select all

 000210FB  687A100200					push	SSZ0002107A_WINNT
....
 00021116  6882100200					push	SSZ00021082_SERVERNT
*****swap-o-matic******
 000210FB  6882100200					push	SSZ00021082_SERVERNT
....
 00021116  687A100200					push	SSZ0002107A_WINNT

Without HEX swapping WINNT and SERVERNT at the begining of the file.

Just in case you don't want to do the mental gymnastics, here's the complete patched sequence:

Code: Select all

 0002107A						   SSZ0002107A_WINNT:
 0002107A  57494E4E5400					  db	'WINNT',0
 00021080  0000							  Align	2

 00021082						   SSZ00021082_SERVERNT:
 00021082  5345525645524E5400				db	'SERVERNT',0
 0002108B  000000							Align	2
------------
 000210F2						   L000210F2:
 000210F2  FF75FC						push	[ebp-04h]
 000210F5  8B353C5D0400				  mov	esi,[ntoskrnl.exe!_stricmp]
 000210FB  6882100200					push	SSZ00021082_SERVERNT
 00021100  FFD6						  call	esi
 00021102  85C0						  test	eax,eax
 00021104  59							pop	ecx
 00021105  59							pop	ecx
 00021106  750B						  jnz	L00021113
 00021108  8B4508						mov	eax,[ebp+08h]
 0002110B  C70001000000				  mov	dword ptr [eax],00000001h
 00021111  EB39						  jmp	L0002114C

 00021113						   L00021113:
 00021113  FF75FC						push	[ebp-04h]
 00021116  687A100200					push	SSZ0002107A_WINNT
 0002111B  FFD6						  call	esi
 0002111D  85C0						  test	eax,eax
 0002111F  59							pop	ecx
 00021120  59							pop	ecx
 00021121  750B						  jnz	L0002112E
 00021123  8B4508						mov	eax,[ebp+08h]
 00021126  C70002000000				  mov	dword ptr [eax],00000002h
 0002112C  EB1E						  jmp	L0002114C

WINNT is now pointing to (pushing, being pushed by, whatever) the section that was once labled for SERVERNT, which means it now goes through all it's subsequent routines as the spirit of the hack intended.

The same holds true of the DLL.

Original:

Code: Select all

 6CAC5D40						   SSZ6CAC5D40_LANMANNT:
 6CAC5D40  4C414E4D414E4E5400				db	'LANMANNT',0
 6CAC5D49  000000							Align	4

 6CAC5D4C						   SSZ6CAC5D4C_SERVERNT:
 6CAC5D4C  5345525645524E5400				db	'SERVERNT',0
 6CAC5D55  000000							Align	4

Hacked:

Code: Select all

 6CAC5D4C						   SSZ6CAC5D4C_WINNT:
 6CAC5D4C  57494E4E5400					  db	'WINNT',0
 6CAC5D52  00					   		db	00h;
 6CAC5D53  00					   		db	00h;
 6CAC5D54  00					   		db	00h;
 6CAC5D55  00					   		db	00h;
 6CAC5D56  00					   		db	00h;
 6CAC5D57  00					   		db	00h;

 6CAC5D58						   L6CAC5D58:
 6CAC5D58  53					   		db	53h;   'S'
 6CAC5D59  45					   		db	45h;   'E'
 6CAC5D5A  52					   		db	52h;   'R'
 6CAC5D5B  56					   		db	56h;   'V'
 6CAC5D5C  45					   		db	45h;   'E'
 6CAC5D5D  52					   		db	52h;   'R'
 6CAC5D5E  4E					   		db	4Eh;   'N'
 6CAC5D5F  54					   		db	54h;   'T'

Sure enough, same relocation swapping occuring:

Code: Select all

 6CAE415D                           L6CAE415D:
 6CAE415D  FF75FC                    		push	[ebp-04h]
 6CAE4160  8B35B811AC6C              		mov	esi,[msvcrt.dll!_stricmp]
 6CAE4166  68585DAC6C                		push	SSZ6CAC5D58_WINNT
*******This is how the above line looks in the hacked file*************
 6CAE4166  68585DAC6C                		push	L6CAC5D58
*******End Difference One**************************************
 6CAE416B  FFD6                      		call	esi
 6CAE416D  85C0                      		test	eax,eax
 6CAE416F  59                        		pop	ecx
 6CAE4170  59                        		pop	ecx
 6CAE4171  750B                      		jnz	L6CAE417E
 6CAE4173  8B4508                    		mov	eax,[ebp+08h]
 6CAE4176  C70001000000              		mov	dword ptr [eax],00000001h
 6CAE417C  EB39                      		jmp	L6CAE41B7

 6CAE417E                           L6CAE417E:
 6CAE417E  FF75FC                    		push	[ebp-04h]
 6CAE4181  684C5DAC6C                		push	SSZ6CAC5D4C_SERVERNT
*******This is how the above line looks in the hacked file*************
 6CAE4181  684C5DAC6C                		push	SSZ6CAC5D4C_WINNT
*******End Difference Two**************************************
 6CAE4186  FFD6                      		call	esi
 6CAE4188  85C0                      		test	eax,eax
 6CAE418A  59                        		pop	ecx
 6CAE418B  59                        		pop	ecx
 6CAE418C  750B                      		jnz	L6CAE4199
 6CAE418E  8B4508                    		mov	eax,[ebp+08h]
 6CAE4191  C70002000000              		mov	dword ptr [eax],00000002h
 6CAE4197  EB1E                      		jmp	L6CAE41B7

We do the same swap-o-matic:

Code: Select all

 6CAE4166  68585DAC6C			push	SSZ6CAC5D58_WINNT
....
 6CAE4181  684C5DAC6C			push	SSZ6CAC5D4C_SERVERNT
*****swap-o-matic******
 6CAE4166  684C5DAC6C			push	SSZ6CAC5D4C_SERVERNT
....
 6CAE4181  68585DAC6C			push	SSZ6CAC5D58_WINNT

and we get this:

Code: Select all

 6CAC5D4C                           SSZ6CAC5D4C_SERVERNT:
 6CAC5D4C  5345525645524E5400        		db	'SERVERNT',0
 6CAC5D55  000000                    		Align	4

 6CAC5D58                           SSZ6CAC5D58_WINNT:
 6CAC5D58  57494E4E5400              		db	'WINNT',0
 6CAC5D5E  0000                      		Align	4
...............
 6CAE415D                           L6CAE415D:
 6CAE415D  FF75FC                    		push	[ebp-04h]
 6CAE4160  8B35B811AC6C              		mov	esi,[msvcrt.dll!_stricmp]
 6CAE4166  684C5DAC6C                		push	SSZ6CAC5D4C_SERVERNT
 6CAE416B  FFD6                      		call	esi
 6CAE416D  85C0                      		test	eax,eax
 6CAE416F  59                        		pop	ecx
 6CAE4170  59                        		pop	ecx
 6CAE4171  750B                      		jnz	L6CAE417E
 6CAE4173  8B4508                    		mov	eax,[ebp+08h]
 6CAE4176  C70001000000              		mov	dword ptr [eax],00000001h
 6CAE417C  EB39                      		jmp	L6CAE41B7

 6CAE417E                           L6CAE417E:
 6CAE417E  FF75FC                    		push	[ebp-04h]
 6CAE4181  68585DAC6C                		push	SSZ6CAC5D58_WINNT
 6CAE4186  FFD6                      		call	esi
 6CAE4188  85C0                      		test	eax,eax
 6CAE418A  59                        		pop	ecx
 6CAE418B  59                        		pop	ecx
 6CAE418C  750B                      		jnz	L6CAE4199
 6CAE418E  8B4508                    		mov	eax,[ebp+08h]
 6CAE4191  C70002000000              		mov	dword ptr [eax],00000002h
 6CAE4197  EB1E                      		jmp	L6CAE41B7

Sadly, not much can be done about the EXE. No matter what, it's going to do this:

Code: Select all

 01002830							   SSZ01002830_winnt:
 01002830  77696E6E7400						  db	'winnt',0
 01002836  00						   		db	00h;
 01002837  00						   		db	00h;
 01002838  00						   		db	00h;
 01002839  00						   		db	00h;
 0100283A  00						   		db	00h;
 0100283B  00						   		db	00h;

So, the question is this: Is it the order that they're referenced to or listed in? DMADMIN.EXE has (prior to editing it) nothing related to WINNT, only SERVERNT and LANMANNT. Obviously, just changing the EXE alone wouldn't work, pressumably because of what the relocation pointers in the SYS and DLL do when calling WINNT, they don't accomplish the desired result. (and obviously, as WINNT isn't being called by the EXE, the WINNT sections won't work right leaving the EXE to call to them under the guise of SERVERNT).

Can switching the PUSH's so that calls to WINNT now execute what SERVERNT was responsible for be enough? (for the astute observers: the DLL and SYS list each of the three initially in reverse order of each other. SYS lists WINNT, SERVERNT, LANMANNT; DLL lists LANMANNT, SERVERNT, WINNT. For whatever that's worth.)

If anyone has the capability and willingness to test differently modified files, PM me or respond here, as I'd really like to find out if these changes to the SYS and DLL (with the original change to the EXE of course) are enough, but lack the resources/equipment to do so. (I can verify that the modified files DO work as normal under a regular XP Pro install and do not introduce any problems). Even better if you can tell me if it won't work and can explain (prove-ably) why the method currently in use is the only operable one.

(A note: The original "Hack" doesn't modify the PE Checksum of either the SYS or DLL, only the EXE. The method used here changes the PE Checksum of all three, so if you use this information to change your own files, don't forget to update those.)

*edit: realized I confused the examples and posted code from the SYS into the sections for the DLL. Corrected.*

Cab'd for i386, no integrator INI yet.
https://www.sharemation.com/Aeenzawthi/ ... niq=40a2tk

[Zacam]

Corrected post information, added link to cab'd files for testing purposes.

[Zacam]

Okay, so I got someone to loan me a 400gb hdd, and I did a VMWare test with the new files after I created 3 non-associated partitions of 100gb (usable space) a piece (to match the 100gb OS drive).

Okay, technically, I spaced out 2 50gb allocations to leave 3 100gb unallocated partitions.

Orignal patch vs modified patch produced the same working results, though the benching I got on the newer files was a tich faster. Doesn't mean much, since it was physically a single disk, overall performance was a tich slower than the THG test.

I should be adding this to the >Definitive Collection< as soon as I work a few other things out so I can do a single update release post.

[ViVa]

Good job Zacam!

[glowy]

But what if we take a closer look at 2 lines in particular and then swap their hex code:

and how exacly do you do that?

[newsposter]

Why not just spend $15 or so for a PATA or SATA raid 0/1/0+1 controller?

Yes, they are that cheap.

[Zacam]

1: Availability.
2: In my testing example I set up a software raid using one physical HDD. While that may not seem like a whole lot of benifit, I'd like to see a card do the same thing.
3: Because this solution is always available, see #1.
4: If you have a system with room for the drives but no room for additional cards.
5: If you have a system where the card in question is not compatable. (It can happen, trust me.)
6: Availability.

@Glowy: Using a hex editor (mirkes.de Tiny Hexer specifically) and PE Explorer to find out where I needed to change what. This addon is now part of the "System File Patches" for the Integrator, link can be found in my signature.

[RyanVM]

What exactly is the point of a single disk RAID array?

[nolook]

What exactly is the point of a single disk RAID array?

...for testing purposes.

I believe Zacam only wanted to test out the functionality of the software RAID (both with the original and modified patches). The THG article covers the benefits of a software vs. hardware based system. For those who don't want to read the whole thing, here is a summary from the article:

There was definitely some amazement at THG's storage test lab, since handling a RAID 5 array under WindowsXP proved to be extremely doable. Relocating the RAID administration from controllers to the operating system may not be a powerful solution, but it enables a level of flexibility that is not common in the storage area. Any WindowsXP system is technically capable of running RAID arrays, as long as the desired amount of hard drives can be attached. It does not matter what hardware you are using. For RAID 5, merely three files need to be altered.

Our drive failure simulation passed with flying colors, as the rebuild process can be initiated easily even by less experienced users. In addition, it took about the same time that hardware-based RAID solutions would require. Yet we need to mention Windows security as an important issue, since access to the disk management will enable everybody to wipe out the whole array within seconds.

Another advantage of our WindowsXP RAID 5 approach is its unbeatable price point. Besides that hard drives one obviously needs to get, all you need is an adequate amount of storage ports on your motherboard or the controllers used. Buying expensive RAID controllers is no longer necessary here.

At the end of the day there is one downside left: Windows RAID 5 by far does not work as fast as hardware-based solutions. However, file servers do not always need to be as quick as possible. If you need to set up a redundant file server for occasional access and little traffic, a Windows RAID should definitely be an option to consider. But be careful: Once the RAID is rendered, you cannot transfer it to any of the hardware RAID controllers. Changing your mind this will always require reinstalling the whole array.

In short, if you would like a fat amount of space using ports you already have available, this is one way to do it for free (plus the separate drives of course). You will also benefit from the RAID5's ability to maximize the space and availability of your data. Speed benefits are minimal vs. a hardware solution.

nolook

[FlyingGleek]

nolook,

that is a good summary, but what I also remember of that article is that this 'hack' gives the user the ability to take those drives used for RAID 5 and put them on any other system (in any install/cabling order too) with this hack and windows just sees the drive(s) - no problems!

I think for a lot of people this is the most valuable feature: to be able to take your data and without worrying of install/cabling order just pop the drives into a new computer and carry on working.

Try to do that with a failed/failing hardware based solution (I have... oh my head) without matching the exact same hardware and in my case bios (SX6000) you not only cannot 'see' your valuable data, but you can also possibly lose it permanently too.

I include this 'hack' for every install I do - a definate 'must-have'.

Thank You once again rikgale and Zacam, truly appreciated!

Cheers,

FlyingGleek.

[5eraph]

this 'hack' gives the user the ability to take those drives used for RAID 5 and put them on any other [hacked] system

..

Try to do that with a failed/failing hardware based solution...

That's an unfortunate downside to hardware-accelerated solutions--Hardware-specific dependency. I do wish the RAID spec wasn't so vague in the implementations. The only solution for a controller failure is an identical replacement.

[newsposter]

The only solution for a controller failure is rel;iable and tested backup/restore procedures.

[theodoresdr]

Hmm, I'm posting to a five years old thread...

Well, I would like to ask if someone could create a new nlite addon for this RAID5 Hack as the one by rikgale is for XP with SP2 and I haven't found any similar addon for SP3...

I've seen Zacam's one, but it's for integrator and not nlite.

I've found the files needed here: http://addto.it/Software-RAID-0-1-5-or- ... XP-Pro-SP3 but I cannot create the addon myself so I'm asking for your help.

Thanks everyone in advance and have a nice day!

[mr_smartepants]

We all use Zacam's patches. Try his RAID-5 patch here: http://www.ryanvm.net/forum/viewtopic.php?t=2274

[theodoresdr]

As I'm not familiar with integrator, can I use nlite as I normally do and when I finish (updates, addons, remove components etc.), then use integrator and Zacam's patch or am I going to mess up the final installation cd?

[dumpydooby]

Probably not.

[=[FEAR]=JIGSAW]

7 yrs ??

[mooms]

It's a spammer.