Additional guidance for devices using Secure Boot to address CVE-2023-24932

For those who might still be following this, I tested out some steps for upgrading Windows PE after revocations are put in place.

Before you read any further, I'm just going to point out that this is for the real geeks out there and for completeness in this thread. Most people may not care about this stuff

For those that don't care, I will just appeal to you to test any Win PE based media once you get to the point where you have applied revocations. You want to make sure that any such media works properly (that it can be booted successfully) after the revocations are applied to your system.

The procedure below has two options:

1) How to Update the Windows PE Add-on to Address the BlackLotus UEFI Bootkit Mitigation

This option applies if you installed Win PE onto your system. After you update Windows PE, any programs that create Windows PE based boot media will have all of the updates, assuming that they are pulling the Windows PE files from your installed copy of Windows PE.

In my testing, when I tried to create a Macrium Reflect boot disk, it did NOT pull files from my installed copy of Windows PE. Instead, it downloaded Windows PE from Microsoft and then built the media from that download. That is where Option 2 comes into play:

2) Apply Updates to Existing Windows PE Media (Macrium Reflect, Acronis software, etc.)

This will update media that has not already been patched that was created using Windows PE.

Enough intro. Here is the procedure that I worked out that is working for me:

--------------------------


This document contains 2 procedures:

OPTION 1: How to Update the Windows PE Add-on to Address the BlackLotus UEFI Bootkit Mitigation
OPTION 2: Apply Updates to Existing Windows PE Media


OPTION 1: How to Update the Windows PE Add-on to Address the BlackLotus UEFI Bootkit Mitigation

IMPORTANT: Before you perform this procedure, you should make sure that you first have the May 9, 2023 Path Tuesday updates (or newer) applied to Windows.

Since the goal of this procedure is to update the Windows PE add-on, it is assumed that you already have Windows PE installed. If not, please install the Windows ADK and the Windows PE add-on. When installing the ADK, you will have the option to install a number of components. The only item needed is the Deployment tools option.

After installing the ADK, install the Windows PE add-on.

On your Windows drive (assumed to be C:), create folders for this project using these commands:

md c:\Project md c:\Project\Mount md c:\Project\LCU md c:\Project\SSU md c:\Project\temp

IMPORTANT: The DISM command will often fail when dismounting an image if antivirus software interferes with it. I strongly suggest doing one of the following:

1) Disable real time antivirus scanning until you have finished this procedure.
2) Create an antivirus exception for c:\Project and all files and folders contained therein until you have finished this procedure.

From the Microsoft Update Catalog, download the Latest Cumulative Update. Here is a sample search term to find the LCU for Windows 11 22H2 as of May 2023. Include the quotes as shown:

"Windows 11" version 22H2 2023-05

Make sure to download the x64 version of the update and not the arm64-based update.

After downloading, right-click the update file, select properties, check the Unblock box and then click on OK.

Place that file in the c:\Project\LCU folder.

Start the Deployment and Imaging Tools Environment as an administrator. You can find this by going to Start > All apps > Windows Kits.

Run all of the following commands from that command prompt.

You will get a command prompt with a very long path shown. Run the command below (include the quotes):

cd "..\Windows Preinstallation Environment\amd64"

Mount Windows PE with this command:

DISM /Mount-Image /ImageFile:"en-us\winpe.wim" /index:1 /MountDir:"C:\Project\Mount"

The Latest Cumulative Update (LCU) may possibly also contain an SSU (Servicing Stack Update). Run the following to extract the SSU if one is present. If an SSU is not present, no worries, this won't harm anything:

expand "C:\Project\LCU\*.MSU" /f:"SSU*.cab" "C:\Project\SSU"

Check the SSU folder to see if a file is present. If a file is present, run the following command. If no file is present, skip that command. This command will apply the SSU:

DISM /Add-Package /Image:"C:\Project\Mount" /PackagePath="C:\Project\SSU"

Apply The LCU with this command:

DISM /Add-Package /Image:"C:\Project\Mount" /PackagePath="C:\Project\LCU"

Lock the updates:

DISM /Cleanup-Image /Image:"C:\Project\Mount" /StartComponentCleanup /Resetbase /ScratchDir:C:\Project\temp

Copy boot files back to the Win PE add-on installation with these two commands:

Xcopy "C:\Project\Mount\Windows\Boot\EFI\bootmgr.efi" "Media\bootmgr.efi" /Y Xcopy "C:\Project\Mount\Windows\Boot\EFI\bootmgfw.efi" "Media\EFI\Boot\bootx64.efi" /Y

Unmount the Win PE image and commit the changes:

DISM /Unmount-Image /MountDir:"C:\Project\Mount" /Commit

This concludes the process. Any images or media that you now create that uses the Windows PE add-on will now have updated Windows PE files.


Option 2: Apply Updates to Existing Windows PE Media

IMPORTANT: Before you perform this procedure, you should make sure that you first have the May 9, 2023 Path Tuesday updates (or newer) applied to Windows.

IMPORTANT: The copy of Windows PE that you are updating should be of the same version as the updates being applied. My suggestion is that you regenerate the Windows PE based media using your current version of Windows before you proceed.

This procedure requires tools from the Windows ADK. If you do not already have the ADK installed, please install it now. When installing the ADK, you will have the option to install a number of components. The only item needed is the Deployment tools option.

On your Windows drive (assumed to be C:), create folders for this project using these commands:

md c:\Project md c:\Project\Mount md c:\Project\LCU md c:\Project\SSU md c:\Project\temp md c:\Project\WinPE md c:\Project\WinPE_NEW

Start by copying boot.wim from your media to C:\Project\WinPE. This file should be in a \Sources folder.

IMPORTANT: The DISM command will often fail when dismounting an image if antivirus software interferes with it. I strongly suggest doing one of the following:

1) Disable real time antivirus scanning until you have finished this procedure.
2) Create an antivirus exception for c:\Project and all files and folders contained therein until you have finished this procedure.

From the Microsoft Update Catalog, download the Latest Cumulative Update. Here is a sample search term to find the LCU for Windows 11 22H2 as of May 2023. Include the quotes as shown:

"Windows 11" version 22H2 2023-05

Make sure to download the x64 version of the update and not the arm64-based update.

After downloading, right-click the update file, select properties, check the Unblock box and then click on OK.

Place that file in the c:\Project\LCU folder.

Start the Deployment and Imaging Tools Environment as an administrator. You can find this by going to Start > All apps > Windows Kits. Run all of the following commands from that command prompt.

You will get a command prompt with a very long path shown. Run the command below. This will shorten that annoyingly long path and make it easier to see what you are doing:

CD\

Mount Windows PE:

DISM /Mount-Image /ImageFile:"c:\Project\WinPE\boot.wim" /index:1 /MountDir:"C:\Project\Mount"

The Latest Cumulative Update (LCU) may possibly also contain an SSU (Servicing Stack Update). Run the following to extract the SSU if one is present. If an SSU is not present, no worries, this won't harm anything:

expand "C:\Project\LCU\*.MSU" /f:"SSU*.cab" "C:\Project\SSU"

Check the SSU folder to see if a file is present. If a file is present, run the following command to apply the SSU, if not, skip that command:

DISM /Add-Package /Image:"C:\Project\Mount" /PackagePath="C:\Project\SSU"

Apply The LCU:

DISM /Add-Package /Image:"C:\Project\Mount" /PackagePath="C:\Project\LCU" DISM /Cleanup-Image /Image:"C:\Project\Mount" /StartComponentCleanup DISM /Unmount-Image /MountDir:"C:\Project\Mount" /Commit DISM /Export-Image /SourceImageFile:"C:\Project\WinPE\boot.wim" /SourceIndex:1 /DestinationImageFile:"C:\Project\WinPE_New\boot.wim"

Copy the boot.wim from c:\Project\WinPE_New to your media, replacing the boot.wim in the \Sources folder. If you like, you can first make a backup of the original boot.wim file by copying it to another location just in case there is a problem with the newly updated file.

This concludes the process of updating Windows PE on existing media.

UPDATE:

Second Deployment This phase starts with updates released on July 11, 2023, which adds additionally support mitigating the issue.

thecaretaker said:

I'm a novice. Reading this scares the hell out of me. I honestly don't understand what it is asking everyone to do.

I use Macrium Reflect 8.1 with the Windows boot manager with Macrium on a spare internal SSD drive and the backups on another. I also have the rescue media on a USB drive.

Are they saying Macrium boot media will not work unless I do something? What have I got to do? Panic....

Click to expand...

Currently...

AMD fTPM 2.0 and Secure Boot are on, revocations not done. Macrium bootable rescue media is PE version and boots fine.
Macrium version 8.0.6635

Ghot said:

Macrium bootable rescue media is PE version and boots fine.

Click to expand...

And it will continue to work until MS slaps the revocations on secure boot users automatically. It's all a mystery in the making.

glasskuter said:

And it will continue to work until MS slaps the revocations on secure boot users automatically. It's all a mystery in the making.

Click to expand...

Hopefully, they'll have an updated ADK by then. :/
As usual MS seems to be doing this backwards. Revocations before the updated associated needed software.

MS: "Yes, the aircraft carrier is on fire, but we plugged that half inch hole below the water line. Aren't we awesome?"

Ghot said:

Hopefully, they'll have an updated ADK by then. :/
As usual MS seems to be doing this backwards. Revocations before the updated associated needed software.

MS: "Yes, the aircraft carrier is on fire, but we plugged that half inch hole below the water line. Aren't we awesome?"

Click to expand...

But it's easy to update the ADK on your own

Okay, I lie. I should say that it is easy if you use my batch file. Yes, I spent way too much time geeking out on this issue.

hsehestedt said:

But it's easy to update the ADK on your own

Okay, I lie. I should say that it is easy if you use my batch file. Yes, I spent way too much time geeking out on this issue.

Latest on the BlackLotus Bootkit Mitigations - Includes Instructions and Batch Files

EDIT: Batch files have been tweaked and updated on Jul 27, 2023. Please also note that this was tested with the US English version of Windows. It's possible that some adjustments may be needed for other locales but I have not looked into that. Use this information as a reference. There was a...

www.elevenforum.com

Click to expand...

Bookmarked.
I'm not even gonna attempt that without a good night's sleep.

I'm so tired right now, I can't even "read" all that.

Ghot said:

I'm not even gonna attempt that without a good night's sleep

Click to expand...

I don't think a good night's sleep would be enough for me. It may be too far over my head. For now, I'm leaving secure boot off. If Macrium doesn't give some answers soon I was thinking about trying to sweet talk @hsehestedt into making me a copy of his. I mean, I do have an edge over the rest of you. We Texans have a special bond, don't cha' know. We're like our own secret society, bound by Smith & Wesson and the Colt 45, secret handshakes and all.
Just kidding...sorta...maybe not.

After reading all the articles, I have only ONE question. Why is Microsoft leaving the steps to perform to the average user.? Could Microsoft help users with an automatic step?. I guess it can, but doesn't want to.....
I'm going to take my time.

I stumbled at the first hurdle. What's an ADK?

MiguelAngel11 said:

After reading all the articles, I have only ONE question. Why is Microsoft leaving the steps to perform to the average user.? Could Microsoft help users with an automatic step?. I guess it can, but doesn't want to.....
I'm going to take my time.

Click to expand...

Cause after applying the update - most "average users" - wouldn't be able to use a back-up or reinstall windows in case they ran into some issues. It's been awhile since the release and there's still no updated Win 11 ISO - you have to integrate the update manually.

neves said:

to Microsoftafter applying the update - most "average users" - wouldn't be able to use a back-up or reinstall windows in case they ran into some issues. It's been awhile since the release and there's still no updated Win 11 ISO - you have to integrate the update manually.

Click to expand...

Got your point, but I was adressing the revocations steps to Microsoft for automating the process

MiguelAngel11 said:

Got your point, but I was adressing the revocations steps to Microsoft for automating the process

Click to expand...

From here:

How is a normal user meant to know about any of this? They will just rely on MS update and will be mystified if the update process breaks something.

Honestly the user side of implementation is pretty easy which is why I did it to my machines when it first became available. You can copy and paste the instructions into the command console and be done with it. Works the same with both Intel and AMD pc's.

MiguelAngel11 said:

Got your point, but I was adressing the revocations steps to Microsoft for automating the process

Click to expand...

Was talking about same thing. As in... if Microsoft did just that now (an update which automatically applies the revocations for everyone using Windows) - and a user (or thousands of them) - would run into an issue which requires a reinstall or booting from a back-up (which was made on a Windows - that doesn't have this revocations integrated) - the ones in question won't be able to boot from any media- let alone reinstall it. The workaround is supposedly an easy one (disable Secure Boot) - but there's millions of average users who don't know that (since this step was never needed before). Yet, the many thousands who know how to install Windows - but are unaware of this detail - would think it's an hardware issues (since that's usually the case - if your system can't boot). Which in turn can turn to a huge fiasco for Microsoft, maybe even lawsuits. This update will be applied automatically in 2024 - so by then - they expect their users to learn about it and have a proper back-up/install media prepared. So far - even the downloadable Windows from Microsoft oficial download page (using the Media Creation Tool) - doesn't have this update integrated. That too will change this year - so by 2024 one would be able to make a bookable media with the official latest version - and use that to boot and install Windows - in case they didn't make one themselves.

The thing is - this is not just an Update for Windows, it's mainly an update for Secure Boot - which applies even to other Operating Systems (Linux and co.).

Great, I can not update BIOS, because it causes a constant BSOD due to invalid signature, most likely secure boot misconfiguration.

neves said:

So far - even the downloadable Windows from Microsoft oficial download page (using the Media Creation Tool) - doesn't have this update integrated.

Click to expand...

Media Creation Tool was updated shortly after the "revecations" came out. It's the only media I can boot to without turning off Secure Boot with revocations applied.