WireSock WinPE support

[wolfiecz]

Hi,

I was wondering whether thre is a possibility of running WireSock in Windows Preinstallation Environment (WinPE).

The scenario I am trying to achieve is following:

– install customized windows iso over internet with iPXE (UEFI). Unlike linux(both LiveCD and installations), which I achieved without any major issues (thanks to squashfs files), windows cannot handle instalation without unc path or net drive that is connected (drive: \\localnetwork\shared_foder).

So plausible way would be : in WinPE initiate VPN to the ipPXE server, map shared drive and run from this shared drive setup.exe to install Windows. I achieved this with OpenVPN as a small PoC, but the speed is too slow comparing to WireGuard/WireSock and I would prefer to use WireGuard/WireSock connection.

Issue:

I tried to use WinSock with boot.wim with different wayz.

first I tried via batch file to a clean boot.wim:

wpeinit
ipconfig

certutil.exe -addstore -f “TrustedPublisher” “cert_ev.cer”
certutil.exe -addstore -f “TrustedPublisher” “cert_ip.cer”

devcon install wiresock.inf wiresock

Output of this says: “Drivers installed succesfully” and I can see with “devcon listclass net” three adapters:

MS Kernel Debug Network Adapter

Intel PRO/1000 MT Desktop Adapter (physical NIC)

WireSock VIrtual Adapter

 

ipconfig shows two interfaces, apart from NIC also “not known”,  but running wiresock-client did not work , I got messages:

[TUN] Windows packet Filter driver is not available!

[MGR] Failed to alllocate or initialize the WinGuard tunnel!

and I suspected that a reboot needs to be done after installing the wiresock and this cannto be done on WinPE withou losing the changes, so I injected the files  directly into the boot.wim with my favorite tool NTLITE.

Msi installers cannot be run in the WinPE, so I exctracted the files and installed them manually. (wiresock.inf ,wiresock.cat ,wiresock.sys).

I can see the “Winsock Virtual Adapter” with command”devcon listclass net”

wpeinit initializes the NIC, I get an IP, so far so good. But when I try to connect to WG server, there is the same message that

[TUN] Windows packet Filter driver is not available!

[MGR] Failed to alllocate or initialize the WinGuard tunnel!

Thas it why i downloaded and added (again, first in batch and then inject to boot.wim)  following :

WinpkFilter NDIS LWF driver      and

WinpkFilter NDIS LWF driver (WireSock VPN Client build)  :

netcfg -v -l ndiswgc_lwf.inf -c s -i nt_ndiswgc
netcfg -v -l ndisrd_lwf.inf -c s -i nt_ndisrd

I tried first ndiswgc_lwf.inf, then reboot and tried ndisrd_lwf.inf , tehn I tried to load both of them.

Both commands say.. Trying to instal…,      d:\ndiXXXX.inf was copied to X:\windows\INF\oemXXX.inf, …done…

After installing inf files and runnig “wiresock-client  -config my.conf -log-level all” or “wiresock-client  -config my.conf -log-level all -lac”  I have different error messages:

Wiresock Serives started

[Peer].Endpoint is either invalid of failed to resolve!

Failed to initialize Wireguards tunnel.

 

After checking the network connection I realized that all adapters disappear??

ipconfig shows nothing (both NIC and not known interfaces are gone) and I am not able to bring NIC back to live with devcon or any other means until reboot the PC and going over and over again through the process with zero outcome.

It does not matter which driver I load, both ndiswgc_lwf.inf and ndisrd_lwf.inf  are killing the network immediatelly after netcfg (or snetcfg) command

Would you be so good as to point me the right direction?

Many thanks for help and/or your hints.

BREGS

 

[Vadim Smirnov]

Over the past weekend, I conducted experiments with Windows PE and can corroborate your findings. It seems there might be a component essential for NDIS filter drivers that could be missing or not functioning as expected in Windows PE. Installing such a driver leads to a network shutdown. This is merely a hypothesis, and I’m uncertain about a solution, if one exists.

[wolfiecz]

Hi, another observation I made during the last week.

While both Wiresock VPN and original WG clients have this issue in WinPE, TunSafe client works out of the box.  The only think that is required is install TAP adapter before using it.

tapinstall.exe install OemVista.inf tap0901

Of cource TAP adapter can be also injected into WinPE (with DSIM or similar) , and then is no need to install it in the script. So for the time being, I stick to TS.

 

[Vadim Smirnov]

Thanks for the update!

While I understand that installing the NDIS filter driver might not be feasible in WinPE, encountering issues with the standard Wireguard for Windows is surprising. Given that it’s essentially just another network interface driver, I would anticipate that it should be possible to get it working.

[Author]

Posts