Tuesday, 13 March 2018

Boot Eset Rescue using UEFI from E2B

The current Eset System Rescue ISO does not contain UEFI boot files and so cannot be used on a UEFI-only system.

If you can Legacy\MBR boot, then you can simply directly boot from the Eset ISO file (or add persistence for updates too - see previous blog articles).

Here is a way to 32-bit and 64-bit UEFI-boot by using the E2B grub2 menu system.

You will need to be familiar with the E2B grub2 menu system first.

1. Set up your E2B USB drive for the grub2 menu system. You will need to split the E2B drive into two partitions as instructed here.

2. Download the latest Eset System Rescue ISO and copy it to the \_ISO\ANTIVIRUS folder on the 2nd partition of the E2B USB drive.

3. Rename the file to eset.iso

4. Edit the \_ISO\ANTIVIRUS\grub\antivirus_menu.grub2 file on the 2nd partition and replace the non-working eset menu (bottom of the file) with this new menu.

#WORKS if extract casper folder from ISO file to PTN2:\casper, not persistent
if [ -e "$isofpath/eset.iso" ]; then
menuentry "ESET System Rescue" --unrestricted --class eset{
    set isoname=eset.iso ; CHECK_MNU_FOLDER
set root=$root2
set gfxpayload=1024x768,800x600
loopback loop $isofile
linux (loop)/casper/vmlinuz boot=casper live-media=/dev/disk/by-uuid/$root2uuid iso-scan/filename=$isofile  ---
initrd (loop)/casper/initrd.lz

5. Using 7Zip, extract the \casper folder from the eset.iso and copy the whole folder to the root of the 2nd partition of the E2B USB drive. Only the squashfs files are required.

Your 2nd partition should now have:

\casper\(lots of squashfs files)
\_ISO\ANTIVIRUS\grub2\antivirus_menu.grub2 (modified)

That's it. Legacy BIOS and UEFI-32 and UEFI-64 (non-secure boot) should now work.

AV definition updates will NOT be persistent.

If you update the eset.iso file, don't forget to also update the files in \casper too!

Note: The iso-scan/filename cheat code is not actually used by the eset kernel. You could also delete all the squashfs files from inside the eset ISO file if you wish to reduce it's size.