Howto: BT4 USB with persistent changes - how this n00b succeeded

[Spider Jerusalem]

Hi,

First of all I would like to say that I'm not taking credit for the contents of this posting. None of it would have been possible without several other guides, especially those by #mfBaranian# and JoeleZ. It's basically just a remix of what has been said before by them. With that said, though, I found myself struggling to create a persistent USB stick. And then, suddenly, I figured out what the puny show-stopper was that kept me from succeeding. There are several guides on how to do this, and you shouldn't assume this guide is the best or safest, just because it's the latest. I'm merely posting this in the hope that it will help somebody else. Also, I'm sorry for providing instructions on googling some webpages, it's only because I'm not allowed to post links yet.

Situation:

• You have a computer with Linux installed.
• You have an USB stick that is at least 8 GB.
• You want to install BT4 Prefinal to your USB stick and have persistent changes.

Requirements:

• You need to be able to format an USB stick on your own (google for dedoimedo gparted tutorial to find a guide if needed)
• You have downloaded the bt4-pre-final.iso to your desktop - (google for bt4-pre-final.iso remote exploit to find it from the official webpage)
• You need to be able to open a shell and enter a few commands

Assumptions for this guide:
Note: You MUST change these as appropriate for your situation! If you don't know how to do this, you should NOT follow this guide!

• The USB stick is located at /dev/sdb
• The mountpoint for the first partition of the USB stick is /media/BT4
• The path to the ISO is /home/spider/Desktop/bt4-pre-final.iso
• Text in green is what you type.

For reference, I did this using Ubuntu 9.04 and as far as I can tell it should work just fine using any recent distribution. This is why I have used sudo, you might need to do it some other way as root.



STEP 1: Prepare the USB stick

Note: This will delete everything on your USB stick so backup whatever you want to keep.

Format the stick so that it has two partitions:

1. Make the first partition a FAT32 partition. I frequently hear the recommendation for 1,5 GB so let's size it between 1,5 and 2 GB to be on the safe side. Label this partition BT4. Make sure you set the flag for bootable.
2. Make the second partition the rest of the drive in size. I hear a lot of discussion on whether one should choose EXT2 or EXT3, and both are supposedly just fine so let's choose EXT2 unless you have a reason to choose EXT3. It is crucial you name this partition casper-rw. This is how the system knows where to save your persistent changes. (This was the fact that I missed, making for a very effective showstopper.)

You can verify the results by opening a shell and comparing to my result:

spider@mothership:~$ sudo fdisk -l /dev/sdb

Disk /dev/sdb: 8213 MB, 8213305856 bytes
255 heads, 63 sectors/track, 998 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x000325c5

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *           1         191     1534176    b  W95 FAT32
/dev/sdb2             192         998     6482227+  83  Linux
spider@mothership:~$

At this point it's a good idea to remove the USB stick, wait a couple of seconds and insert it again. This should make the operating system automatically mount it for you.


STEP 2: Copying files to the USB stick

2.1 Making the files in the ISO available for copying

As I wrote initially, you need to have the bt4-pre-final.iso on your desktop.
Create a directory on your desktop, name it BT4CD.

spider@mothership:~$ sudo mount -o loop -t iso9660 /home/spider/Desktop/bt4-pre-final.iso /home/spider/Desktop/BT4CD
spider@mothership:~$

If you open the BT4CD directory on your desktop, you should see the contents of the CD. (Another way would be to burn the ISO to an actual CD, but why bother with that when we can do it this way instead?)

2.2 Make sure the USB stick is mounted

If the stick is mounted already you can skip this step.

Assuming the stick is inserted as /dev/sdb:

spider@mothership:~$ sudo mkdir /media/BT4
spider@mothership:~$ sudo mount /dev/sdb1 /media/BT4
spider@mothership:~$

2.3 Doing the actual copy

spider@mothership:~$ sudo rsync -avh /home/spider/Desktop/BT4CD/ /media/BT4
lot of actual progress output removed
spider@mothership:~$

Wait for the copy to finish, this can take quite a while, depending on the speed of your USB stick etc. After the copy is done, verify the contents in the root directory:

spider@mothership:~$ ls /media/BT4
boot  boot.catalog  casper  md5sum.txt
spider@mothership:~$

STEP 3: Making sure the USB stick can boot

spider@mothership:~$ sudo grub-install --no-floppy --root-directory=/media/BT4 /dev/sdb
Installing GRUB to /dev/sdb as (hd1)...
Installation finished. No error reported.
This is the contents of the device map /media/BT4/boot/grub/device.map.
Check if this is correct or not. If any of the lines is incorrect,
fix it and re-run the script `grub-install'.

(hd0)	/dev/sda
(hd1)	/dev/sdb
spider@mothership:~$

STEP 4 OPTIONAL: Adjust the USB boot menu for convenience

Open the menu file as root using whatever text editor you like, in this case nano:

spider@mothership:~$ sudo nano /media/BT4/boot/grub/menu.lst

4.1 Make the persistent option preselected

In the beginning of the file you will see default 0. Change this to default 4.

Find the section with the title Start Persistent Live CD. Update it to say Start Persistent Live USB.
Below it you see a line starting with kernel. At the end of it you should add vga=0x317. (Or, if you use a netbook with smaller screen, it might be better to use vga=0x315.)

All in all, the section should look like this:

title                Start Persistent Live USB
kernel                /boot/vmlinuz BOOT=casper boot=casper persistent rw quiet vga=0x317
initrd                /boot/initrd.gz

4.2 Remove the background image and adjust the colours

To make the menu selection easier to see, find where it says

splashimage=/boot/grub/bt4.xpm.gz

...and change it to...

color cyan/blue white/blue
#splashimage=/boot/grub/bt4.xpm.gz

STEP 5: Do some housecleaning

If you mounted the USB stick manually, you probably need to unmount it manually and remove the directory we created:

spider@mothership:~$ sudo umount /media/BT4
spider@mothership:~$ sudo rmdir /media/BT4
spider@mothership:~$

You don't have any further use of the mounted ISO so we can remove that:

spider@mothership:~$ sudo umount /home/spider/Desktop/BT4CD
spider@mothership:~$

When you have verified that the USB stick works, you can also delete the actual bt4-pre-final.iso file.


CONGRATULATIONS, YOU ARE DONE!

After I wrote this, but before posting it, I followed the guide again with another USB stick to verify that it worked. As far as I can tell it worked like a charm. However, you should always be careful not to mess up your computer as you are doing things as root. Comments and suggestions are most welcome.

[orange_moon35]

good work spider, you seem Palestinian, or Jewish?
what is your answer?
and how good are you in Linux?
I have a problem booting my Gigabyte U60 umpc, it doesn't boot the Grub menu, instead it gives me the grub> console !!

[imported_athacks]

good work spider, you seem Palestinian, or Jewish?
what is your answer?
and how good are you in Linux?
I have a problem booting my Gigabyte U60 umpc, it doesn't boot the Grub menu, instead it gives me the grub> console !!

When you computer's splash screen goes off, its boot time, its now searching for the bootable mbr, quickly press "esc" (escape key) and then hit "down arrow" and leave it pressed until you see the menu, if it so doing that, then boot the live version and edit /boot/grub/menu.lst and comment out the "hidden menu" thing . . . then on the time out set it to 5-10 so it allows you to make an action if you want to boot another OS like windows (in my case).

[imported_athacks]

This is somewhat a waste of time(in my opinion), simple copy (extact) the files onto your usb and get the edited boot menu that can be found on this forum. and you boot your usb, install.sh and you have a complete persistent with changes and all OS :P

[Snakerdlk]

Well...install.sh has been quite buggy on my notebook(HP dv6000) and haven't gotten it to work.

But still, this guide is pretty much the same one of the videos from offensive-security explaining how to install BT4pre.

And yet, creating another partition named casper-rw and booting in persistent mode didn't work for me...
So I'm slowly converting my ubuntu9.04 to a sec-auditor

[Gearshock]

Text in green is what you type.

Where do i type green?

Just kidding, thanks for the post. It was very informative.