WelcomeWelcome | FAQFAQ | DownloadsDownloads | WikiWiki

Author Topic: Symantec Ghost on TCL  (Read 8732 times)

Offline genec

  • Full Member
  • ***
  • Posts: 240
Symantec Ghost on TCL
« on: May 13, 2011, 08:37:36 AM »
See also http://forum.tinycorelinux.net/index.php?topic=6942.msg40514#msg40514 as that's where I found the hint.

http://www.symantec.com/connect/forums/linux-client-ghost-errors-8032-36000-need-descriptions

Recently, I decided to try to use the Linux client for Ghost outside of the provided ThinStation system.  Some newer hardware is either not supported at all or not supported well.  A Ghost image that, when using a home brewed WinPE 3.0-based CD takes ~10 minutes to pull, took 70+ minutes in ThinStation on one particular piece of hardware.

At first, I got "Internal Error 8032" "An internal inconsistency has been detected" but also in my attempts got error 36000 once (I only saw it once and didn't record its message).  This message is deceptive and frustrating.

Examining all Linux binaries in the ghost.zip, I see they are all UPX-compressed.  When I attempt to extract ghost with upx-ucl, I see "CantUnpackException: header corrupted 2".  upx-nrv is no better and attempting to list is less informative.  The others don't display this behavior.  Researching this issue across the web, I find that it's common for malware as an analysis countermeasure.

#8032 appears to actually be a copy protection measure.  The Linux distribution in question used a module called ramzswap which allows the kernel to compress some unneeded data in memory as a part of the swap system (uncompressed RAM, ramzswap, normal swap on disk).  Disabling the ramzswap module solves this issue.  As root, 'swapoff -a' then 'rmmod ramzswap'.  As tc, 'sudo swapoff -a' then 'sudo rmmod ramzswap'.

This should not have been "An internal inconsistency has been detected" but rather stating that something about the system was determined to be incompatible

Distribution in question (name/version): Tiny Core Linux 3.6

Adding extensions for file systems (ie cifs-utils as our images are on Windows systems) rounds everything out for a usable system that's more compact and up to date than the Symantec-provided solution.

Kudos to everyone at Tiny Core.

Offline curaga

  • Administrator
  • Hero Member
  • *****
  • Posts: 11048
Re: Symantec Ghost on TCL
« Reply #1 on: May 13, 2011, 09:36:36 AM »
See the bootcode "nozswap". BTW, how fast is your bench on the TC-based boot?
The only barriers that can stop you are the ones you create yourself.

Offline genec

  • Full Member
  • ***
  • Posts: 240
Re: Symantec Ghost on TCL
« Reply #2 on: May 13, 2011, 05:34:55 PM »
See the bootcode "nozswap". BTW, how fast is your bench on the TC-based boot?

I found that later but I think knowing both can be helpful in case you forget to use "nozswap".  I also felt that since the forum was trying to make me think seriously on posting on the old post and that I had more information, it justified a new post.

On first run on the same hardware without any tweaks/configuration, ~15-17 minutes (I think a 6GiB image, full gigabit network).  I still want to see if there are any options to increase the block sizing and also watch the CPU more closely tomorrow to see if I can find where the bottleneck may be.  It's entirely possible that the Linux client for Ghost is just coded poorly.

Offline tinypoodle

  • Hero Member
  • *****
  • Posts: 3857
Re: Symantec Ghost on TCL
« Reply #3 on: May 13, 2011, 10:16:13 PM »
At first, I got "Internal Error 8032" "An internal inconsistency has been detected" but also in my attempts got error 36000 once (I only saw it once and didn't record its message).  This message is deceptive and frustrating.

FWIW, I have come across similar with various versions of Norton/Symantec Ghost for DOS in the past, so the problematic error output seems to be inheritant to Ghost rather than particular to Linux...   :-\
"Software gets slower faster than hardware gets faster." Niklaus Wirth - A Plea for Lean Software (1995)