Skip to content

MHimken/WinRE-Customization

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

48 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

WinRE-Customization

Customizes WinRE - recent updates can be found in the changelog. This script applies patches and drivers. Will resize and create recovery partition if required.

This script was initially created to automate remediation of CVE-2022-41099, however it can be used to patch WinRE monthly and automated as well. The script will verify the size of your recovery partition and resize it if required.

Please read https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-update-to-winre to learn which patches you should apply! GDR-DU and LCU should only be applied to fix major issues, they take about 8-10 minutes. SOS and DUs are extremly small and take seconds to apply (less than a minute).

Applies to

As of 15.08.24 this script can be used to remidiate issues around the following KBs that require manual interaction:

Prerequisites

The script generally tries to detect states that it can not handle. Please consult the log (CMTrace compatible). If you encounter a scenario, that needs fixing please contact me or open an issue so I can investigate.

Attention This can only be done in an automated fashion, if the disk:

  • is formatted in UEFI using GPT partitions (this is verified) and
  • if the sysdrive has enough space and no blocking files to shrink it to the required size - this is verified.

A description of each parameter comes with the script.

Adressing the script offered by Microsoft

Microsoft released their own script officially on https://support.microsoft.com/en-us/topic/kb5025175-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2022-41099-ba6621fa-5a9f-48f1-9ca3-e13eb56fb589.

In it the following information is given:

If the BitLocker TPM protector is present, reconfigures WinRE for BitLocker service. Important This step is not present in most third-party scripts for applying updates to the WinRE image.

Which most likely refers to this snippet from their code (trimmed empty lines)

                if (IsTPMBasedProtector)
                {
                    # Disable WinRE and re-enable it to let new WinRE be trusted by BitLocker
                    LogMessage("Disable WinRE")
                    reagentc /disable
                    LogMessage("Re-enable WinRE")
                    reagentc /enable
                    reagentc /info
                }

The order for this script is (because it made the most sense to me)

  1. Backup WinRE - the script does this even if you specify to delete the backup later.
    • This disables the Recovery Agent so that the .wim file can be backed up elsewhere.
    • This also verifies that the Recovery Agent can be safely disabled and that the .wim is accessible.
  2. Mount the WinRE using the new method that was provided here https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-update-to-winre?view=windows-11#apply-the-update-to-a-running-pc
  3. Apply whatever you provided to the script (as of writing drivers or patches)
  4. Dismount the image and try to commit the changes
  5. Enable the Recovery Agent

All in all, the script does exactly the same thing. Although by accident, because it seems to re-sign the partition or the .wim, so that Secure Boot/BitLocker can still trust the recovery partition. If you think about it, this makes sense because otherwise an attacker could just replace the .wim in the unprotected partition.

So far, I haven't received any reports of Secure Boot or BitLocker itself acting up (unless the script never fully ran!). If you used this script to apply your patches, you should be fine. The obvious caveat here is that I'm not an MS employee and cannot vouch for the accuracy of the information provided by what I have just described. You still use this script at your own risk!

Noteworthy content

Relevant CVEs: CVE-2022-41099 CVE-2024-20666

Relevant patches:

Thanks to everyone that helped build this, especially https://homotechsual.dev/

About

WinRE Customization to apply patches, drivers and soon™ language packs

Topics

Resources

License

Security policy

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published