[Win10v1607b14393 x64] Windows can't boot, SFC & DISM doesn't work (files corrupted)
Hi.
Windows 10 Pro x64, was installed as 1511, apparently later auto-updated till 1607 via Windows Update.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion:
(few values only)
Code:
BuildLab = 14393.rs1_release.170706-2004
BuildLabEx = 14393.1480.amd64fre.rs1_release.170706-2004
EditionID = Professional
ReleaseId = 1607
Problem:
After sending system to sleep, the next day it wasn't able to boot.
Automatic recover failed. Neither any restore points nor any system images were created before.
Need to keep installed apps so can't just reinstall, also impossible to reinstall using "Update" mode because it's working from online system only (not via WinRE).
Tried to run SFC and DISM inside of WinRE and WinPE (10 x64 Upd 1607, 14393.rs1_release.160715-1616) - no any success.
Folders:
E:\Temp - folder created by me to workaround few amount of space in temp folders in WinPE / WinRE.
%SystemRoot% - windows folder of broken offline system (unless otherwise specified) - mounted as D:\Windows in WinRE, as C:\Windows in WinPE.
SFC attempts:
Code:
set TEMP=E:\Temp
set TMP=E:\Temp
SFC /SCANNOW /OFFBOOTDIR=c:\ /OFFWINDIR=c:\windows
(WinPE, same in WinRE except another disk letter)
System shows an error (message box) about corrupted dll in "downlevel" folder created in subdirectory inside of %Temp% directory.
About each of the following:
Code:
api-ms-win-core-file-l1-2-1.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
(got all of them by trying to replace with working dll)
All dll-s were auto-copied from offline system from:
%SystemRoot%\System32\downlevel\
Which also (all of them) are hard linked to files inside of:
%SystemRoot%\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.14393.0_none_f4d9462b97ccf242
And I see there are those 3 dll-s corrupted indeed.
I tried to move them to another place and put instead of them 3 dll-s from WinPE (the most close build which I could get) - SFC started this time but ended with error "Windows resource protection can not perform the requested operation."
No any logs were created during any of these attempts (including last one with dll replacing) - neither in %SystemRoot%\Logs\CBS of both systems (offline & WinPE), nor anywhere else (checked using ProcessMonitor).
DISM attempts:
Code:
set TEMP=E:\Temp
set TMP=E:\Temp
DISM /Image:c:\ /Cleanup-Image /RestoreHealth
(WinPE, same in WinRE except another disk letter)
Ended with error:
Error: 193
An initialization error occurred.
Log file is attached.
The main error is "Unable to retrieve servicing stack folder for DLL search path modification."
I quickly checked files (header and visual byte structure) in folders by mask "*rvicing" inside of %SystemRoot%\WinSxS\ folder, and found several corrupted for sure files there:
Code:
amd64_microsoft-windows-b..servicing.resources_31bf3856ad364e35_10.0.14393.0_en-us_99a2f7832cdf1a72
amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.0_none_36d3ccc3ddfd1ecb
amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1051_none_7f2bf7ea21d201b2
amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_7efe016621f50bd0
amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.693_none_42ff55c9655f38bf
x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_22df65e269979a9a
I know about special dummy files of 12 bytes in size, also bigger, with a special file header like DCD... or DCH... etc, so I didn't count them as corrupted.
Maybe there are more corrupted files but I can't check properly all of them.
Btw, from all of these folders (inlcuding not corrupted), DISM (DismHost.exe) tried to open this file only:
C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_7efe016621f50bd0\wcp.dll
(during attempt in WinPE, checked using ProcessMonitor)
Which looks like
not corrupted.
Offline system registry,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Version
Code:
10.0.14393.1439 = %SystemRoot%\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_7efe016621f50bd0
Folders inside of %SystemRoot%\servicing\Version\
Code:
10.0.14393.0
10.0.14393.1051
10.0.14393.1439
10.0.14393.693
Files exist in "10.0.14393.1439" only:
Code:
amd64_installed
x86_installed
SFCFix.exe probably is impossible to try - it's working on online system only.
Is it possible to tell it to work in offline mode?
Attached files:
CBS.zip - archived CBS folder from offline system (logs from previos days only).
dism.log - log of DISM attempt in WinRE.
DISM-WinPE.zip - log of DISM attempt in WinPE + log of ProcessMonitor with filter: Pocess Name contains "dism" (for Dism.exe & DismHost.exe)
Help me please... I guess, my main problem is I can't get files of proper version. Also don't know how to properly replace with another version (hashes are somewhere, manifests, etc?). So, I'm stuck.
