KB5028254 breaks the Macrium bootable media.

Josey Wales · Jul 27, 2023

Ghot said:
It's gonna take me a bit to figure this out. I noticed some changes in the BIOS (made by ASUS I presume).
I don't seem to have a toggle for Secure Boot any more. Currently it says disabled.

I had to Clear the Secure Boot keys, to disable Secure Boot (BLUE box)
The RED boxes are how other things are currently set.

View attachment 65869 View attachment 65870

View attachment 65871

I think I'm too tired to figure this out right now.

It's been a loooong day. Walmart screwed up my order... delivered one out of eight items, and marked them ALL as delivered.
Got refund and reordered. Just dealing with Walmart, tuckered me out.

Got a new medication today, bring the total to 13. LOL

@IanMosley I can't compare your DELL prebuilt to my home built PC... unfortunately.

Something I can do tonight, is make a fresh pre- .2070 backup, now that Secure Boot is OFF. Re-do the KB5028254 update, and see if the Macrium bootable Rescue USB stick works (with Secure Boot disabled).

Be back in about 10 minutes...

I can't use CSM as my machine will not boot properly. I use secure boot.

Ghot · Jul 27, 2023

Josey Wales said:
I can't use CSM as my machine will not boot properly. I use secure boot.

Some motherboards don't like to have CSM enabled, some do.
On mine... enabling CSM just allows some further settings.

Scott · Jul 27, 2023

There's another place to look to see if "revocations" were applied. Inside your boot drive's EFI partition.

Assign your boot drive's EFI partition a drive letter. I use MiniTool Partition Wizard.

Download Explorer++ It's portable.

Run Explorer++ as ADMINISTRATOR
Select your drive and navigate to EFI\Microsoft\Boot

If you see that policy, revocations were applied.

Given these two things, the policy and the Mixed Secure Boot key, there's a way to "undo" the revocations, which I successfully did on both my machines. I found a Youtube video were a nice Indian fellow explained how. I sure as heck can't find that video now.

Ghot · Jul 27, 2023

Scott said:
There's another place to look to see if "revocations" were applied. Inside your boot drive's EFI partition.

Assign your boot drive's EFI partition a drive letter. I use MiniTool Partition Wizard.

Download Explorer++ It's portable.

Run Explorer++ as ADMINISTRATOR
Select your drive and navigate to EFI\Microsoft\Boot

View attachment 65954

If you see that policy, revocations were applied.

Given these two things, the policy and the Mixed Secure Boot key, there's a way to "undo" the revocations, which I successfully did on both my machines. I found a Youtube video were a nice Indian fellow explained how. I sure as heck can't find that video now.

I only have the winsipolicy.p7b
FYI... you can just right click the EFI partition in Minitool and choose: Explore

Remember, I cleared the Secure Boot Keys in the BIOS.
I also restored to a backup before yesterday's patch.
And to do that, I had to create the Boot Manager Macrium boot option.

What I need is a video by a nice Indian fellow that shows how to apply the revocations AND fix my Macrium bootable USB stick. Either that or have Macrium fix their media creation tool.

I shouldn't have to apply the revocations or fix the Macrium bootable USB. Both should be done by the authors.
Aka, MS and Macrium.

There should be a revocations patch from MS, and Macrium should make their bootable USB creator grab whatever is necessary (ADK and PE add-on), to function with the revocations.

As I mentioned somewhere else... MS should never even have started on the revocation stuff, without already having a compatible ADK and PE-add-on, that Macrium could "grab" when creating the bootable media.

Flashorn · Jul 27, 2023

IanMosley said:
Yet available as an optional update on Public. I've been on 'this' build since 13 July '23 with no issues.

I have it in my settings app but, I never download them. It will become a actual install
next month so, I'll wait as I always do. I like to see if something breaks on other PCs
so I can make the decision to install or not.

glasskuter · Jul 27, 2023

Ghot said:
What I'd really like to see, is one batch file that does it all.

What I didn't want to see is:
Caution: Once the mitigation for this issue is enabled on a device, meaning the revocations have been applied, it cannot be reverted if you continue to use Secure Boot on that device. Even reformatting of the disk will not remove the revocations if they have already been applied. Please be aware of all the possible implications and test thoroughly before applying the revocations that are outlined in this article to your device.
I don't mind telling you, boys and girls, as messed up and misunderstood as this entire mess has been, it scares the pee-waddling-do out of me when I'm told something can't be UNDONE. One has to be a rocket scientist to understand it, and this old woman ain't. And for MS to be in control of what's in my UEFI bios....just doesn't sit right with me. Maybe I'm stupid...or hardheaded...or crazy...but I'd rather take my chances that I won't be a Black Lotus victim.

SIW2 · Jul 27, 2023

it scares the pee-waddling-do out of me

is it hard to turn off secure boot if necessary?

glasskuter · Jul 27, 2023

@SIW2 I have it off. Until I know more and understand more, I will keep it off as I do not want the revocations to apply until I do. So far the only ill affect I have seen from it is in device security it says "standard hardware security not supported."

glasskuter · Jul 28, 2023

@SIW2 @Ghot I want to add to what I discovered. With my secure boot off, 3 other things happened. Security said I had no TPM but system information said I did. So did device manager. I had to reset tpm to get security panel to see it. Also with secure boot off in security panel I have no LSA or core isolation settings at all; completely disappeared. Rather than totally removing them one would think I would have some warnings on security page yet my security panel has all green checkmarks. This is such crazy stuff.
Hey, I don't care. I don't want that stuff anyway. I just want MS to leave me and my security (or lack thereof) alone.
I may wake up some morning and see a Mission Impossible message from MS on this PC..."This PC will self destruct in 5 seconds" Poof up in smoke.

jimbo45 · Jul 28, 2023

C'mon guys -- Even Norton Ghost still works for a lot of backups (including latest canary builds) -- so there's no prob whatsoever with any version with Macrium 8 on any currently known version of Windows (unless you have the rumored "Intergalctic version" only downloadable from the new Microsoft Servers situated on a planet around Arcturus B using their patented "Faster than light technology" and assisted by Amazon with its new high speed intergalctic quantum delivery servers (even though if you visit parts of the UK or some other places in USA / AUS / EU the local interconnection for the final bit could take 1 week to get the whole file after the download from the other end of the galaxy) .

Any simple bootable partition manager e.g gparted, or whatever can also save images. You won't have all the bells and whistles but the base idea of a backup will work.

I can't see any problem with Macrium Free and any version of Windows not working before (addressed to UK audiences here) before their 160 KM piddling bit of railway line (HS2) will be ready -- in around 2050 !!!! -- at a cost of more than NASA's Mars project !!!!.

I'm really not just having a go at the UK (although I really hate Brexit - but that's an issue for another forum) - but there are loads of similar mega huge rubbish vanity projects in loads of other jurisdictions as well that taxpayers get saddled the bill for. We also have some bad politicians -- seems a world wide problem.

Cheers
jimbo

glasskuter · Jul 28, 2023

jimbo45 said:
so there's no prob whatsoever with any version with Macrium 8 on any currently known version of Windows

I believe you are missing the point of @Ghot's post. No one argues that Macrium program can't still backup a system. It surely can. What this discussion is referring to is the effect the recent MS changes in security has had on ability to use his recovery media in the same way he always has.

Ghot · Jul 28, 2023

glasskuter said:
I believe you are missing the point of @Ghot's post. No one argues that Macrium program can't still backup a system. It surely can. What this discussion is referring to is the effect the recent MS changes in security has had on ability to use his recovery media in the same way he always has.

Yep... the .2070 update broke my Macrium bootable media on USB stick. It's still there, but changes made to Windows, has made the stick unbootable.

Anibor_11 · Jul 28, 2023

I have 22H2 2070 installed [via Rufus] in a 11-year old Dell laptop, with Secure Boot enabled. A boot UFD with Macrium Free 8.0.7279 boots without any problem. Same with Terabyte IFW and IFL boot UFDs.

hsehestedt · Jul 28, 2023

Ghot said:
@hsehestedt has created an excellent tutorial here, but it's still too complex, at least for my addled mind.

Latest on the BlackLotus Bootkit Mitigations - Includes Instructions and Batch Files

EDIT: Updated May 3, 2024. Please refer the following from now onward. This is a greatly improved article over this post, and it is in that article that I will post any new updates as they become available. https://www.elevenforum.com/t/performing-mitigations-for-blacklotus-uefi-bootkit.24892/...

www.elevenforum.com

I'd like to see three batch files.
One, that downloads and installs the Windows ADK, and the PE addon, with no help from the user.
One, that creates the Macrium bootable rescue media, or takes a Macrium rescue media ISO and fixes it.
One, that applies the revocations.

What I'd really like to see, is one batch file that does it all.

Question: Would you be okay with an executable (.EXE) or would you specifically prefer a batch file?

Ghot · Jul 28, 2023

hsehestedt said:
Question: Would you be okay with an executable (.EXE) or would you specifically prefer a batch file?

I'm cool with executables. They're easy enough to scan.
The revocations seem fairly simple, it's the fixing of the Macrium bootable media that's a pain in the butt.

No rush or anything. I'm also cool with Secure Boot disabled.

hsehestedt · Jul 28, 2023

Ghot said:
I'm cool with executables. They're easy enough to scan.
The revocations seem fairly simple, it's the fixing of the Macrium bootable media that's a pain in the butt.

No rush or anything. I'm also cool with Secure Boot disabled.

I'll see what I can do. It may be a while before I can get to this, but your idea is a really good one so I'd like to try to do this.

Ghot · Jul 28, 2023

hsehestedt said:
I'll see what I can do. It may be a while before I can get to this, but your idea is a really good one so I'd like to try to do this.

Like I said... take your time. I can run with no Secure Boot forever. It bothers me not.

Wisewiz · Jul 28, 2023

@Ghot

I have Secure Boot ON and have NOT done any revocations, and a test run of one of my Macrium bootable keys on my System 2 with 2070 just succeeded beautifully. No sweat at all.

MitchAtHome · Jul 28, 2023

I too have Secure Boot ON and have NOT done any revocations. A quick BIOS Boot test of my Macrium 8.1 7544 on my system went fine ..... a relief

Scott · Jul 28, 2023

Anibor_11 said:
I have 22H2 2070 installed [via Rufus] in a 11-year old Dell laptop, with Secure Boot enabled. A boot UFD with Macrium Free 8.0.7279 boots without any problem. Same with Terabyte IFW and IFL boot UFDs.

And you have revocations applied? Anything will boot without revocations applied.

KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support

support.microsoft.com

KB5028254 breaks the Macrium bootable media.

Endeavor to Persevere

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

aka Mama Glass

My Computers

Well-known member

My Computers

aka Mama Glass

My Computers

aka Mama Glass

My Computers

Well-known member

My Computer

aka Mama Glass

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Banned

My Computer

Well-known member

My Computers

Similar threads