AuraBoot

Write faster.
Boot cleaner.

A high-performance disk imaging utility that bypasses the OS page cache for raw, kernel-level writes. AuraBoot is Rufus reimagined: faster, cleaner, and built for the modern UEFI era.

Try the simulatorUnder the hood
Why AuraBoot

Engineered for speed

Every layer of the stack is built for one thing: getting your bootable media ready faster.

Raw-speed writes

Bypasses the OS page cache with FILE_FLAG_NO_BUFFERING for direct-to-hardware writes. No double-buffering, no latency.

Kernel-level control

FSCTL_LOCK_VOLUME, FSCTL_DISMOUNT_VOLUME, IOCTL_DISK_CREATE_DISK. AuraBoot speaks directly to the Windows volume manager.

Hardware bypass kit

Bypass TPM 2.0, Secure Boot, and RAM checks. Inject telemetry blockers and registry keys offline before Windows even boots.

Offline registry injection

Mount boot.wim registry hives via RegLoadAppKey for surgical pre-boot modifications. No install-time prompts.

Interactive Simulator

Flash a drive

Configure your bootable USB and hit Write.

Sector Visualizer

Physical sector map

Real-time block-level visualization of the disk imaging process.

DEVICE: \\\\.\\PHYSICALDRIVE2Awaiting write...
Empty
Locked
Unmounted
Written
Under the Hood

C / Win32 internals

The kernel-level API calls that make AuraBoot tick.

01

Volume Locking & Unmounting

Before writing to a volume, AuraBoot acquires an exclusive lock and dismounts the filesystem via DeviceIoControl. This prevents the OS from interfering with raw sector access.

Why this matters: A locked volume guarantees no competing writes from the file system driver.
HANDLE hVol = CreateFile(
  L"\\\\.\\F:",                    // volume device path
  GENERIC_READ | GENERIC_WRITE,
  FILE_SHARE_READ | FILE_SHARE_WRITE, // share mode
  NULL,                               // security attributes
  OPEN_EXISTING,
  0,
  NULL
);

DWORD bytesReturned;

// Lock the volume - prevents any further I/O
BOOL locked = DeviceIoControl(
  hVol,
  FSCTL_LOCK_VOLUME,                  // control code
  NULL, 0,                            // no input buffer
  NULL, 0,                            // no output buffer
  &bytesReturned,
  NULL
);

if (!locked) {
  // handle error: volume may be in use
  wprintf(L"FSCTL_LOCK_VOLUME failed: %lu\n", GetLastError());
  CloseHandle(hVol);
  return FALSE;
}

// Dismount the filesystem
BOOL dismounted = DeviceIoControl(
  hVol,
  FSCTL_DISMOUNT_VOLUME,              // force dismount
  NULL, 0,
  NULL, 0,
  &bytesReturned,
  NULL
);

// Volume is now exclusively ours
02

Raw Sector Writing (FILE_FLAG_NO_BUFFERING)

Standard file writes go through the OS page cache, adding latency. AuraBoot opens the physical drive with FILE_FLAG_NO_BUFFERING | FILE_FLAG_WRITE_THROUGH, writing directly to the disk controller with no intermediate caching.

Why bypass the page cache? No double-buffering, no cache flushes, no copy-on-write overhead. The data goes straight from your buffer to the hardware.
HANDLE hDisk = CreateFile(
  L"\\\\.\\PHYSICALDRIVE2",      // physical drive handle
  GENERIC_WRITE,
  0,                                  // exclusive access
  NULL,
  OPEN_EXISTING,
  FILE_FLAG_NO_BUFFERING |            // bypass OS page cache
  FILE_FLAG_WRITE_THROUGH,            // bypass disk write cache
  NULL
);

if (hDisk == INVALID_HANDLE_VALUE) {
  wprintf(L"CreateFile failed: %lu\n", GetLastError());
  return FALSE;
}

// Align buffer to physical sector size (4096 bytes)
DWORD sectorSize = 4096;
PVOID buffer = _aligned_malloc(1 << 20, sectorSize); // 1MB aligned

LARGE_INTEGER offset;
offset.QuadPart = 0;

// Position file pointer using 64-bit offset
BOOL positioned = SetFilePointerEx(
  hDisk,
  offset,
  NULL,
  FILE_BEGIN
);

DWORD bytesWritten;
BOOL written = WriteFile(
  hDisk,
  buffer,
  1 << 20,                            // 1MB per write
  &bytesWritten,
  NULL
);

// Written directly to disk - no cache involved
03

Offline Registry Injection (mounting boot.wim)

For Windows installer images, AuraBoot mounts the boot.wim registry hive directly to inject BypassTPM, telemetry blockers, and other registry keys before the OS even boots.

Offline injection means the modifications apply before Windows Setup runs. TPM checks are already patched when the installer starts.
// Mount the SOFTWARE hive from boot.wim's registry files
HKEY hMountedHive;
LSTATUS status = RegLoadAppKey(
  L"C:\\Windows\\System32\\config\\SOFTWARE",
  &hMountedHive,
  KEY_READ | KEY_WRITE,
  0,                                  // no flags required
  0
);

if (status != ERROR_SUCCESS) {
  wprintf(L"RegLoadAppKey failed: %lu\n", status);
  return FALSE;
}

// Create the BypassTPMKey
HKEY hKey;
DWORD disposition;
status = RegCreateKeyExW(
  hMountedHive,
  L"Microsoft\\Windows\\CurrentVersion\\OOBE",
  0, NULL, REG_OPTION_NON_VOLATILE,
  KEY_SET_VALUE, NULL,
  &hKey, &disposition
);

if (status == ERROR_SUCCESS) {
  DWORD value = 1;
  RegSetValueExW(
    hKey,
    L"BypassTPMCheck",
    0, REG_DWORD,
    (BYTE*)&value, sizeof(value)
  );

  RegSetValueExW(
    hKey,
    L"BypassSecureBootCheck",
    0, REG_DWORD,
    (BYTE*)&value, sizeof(value)
  );

  RegSetValueExW(
    hKey,
    L"BypassRAMCheck",
    0, REG_DWORD,
    (BYTE*)&value, sizeof(value)
  );

  RegCloseKey(hKey);
}

RegCloseKey(hMountedHive);
Get Started

Ready to aura-boot?

AuraBoot is built from scratch as a modern, high-performance alternative. Built for power users who want speed and control at the sector level.

Try the simulatorRead the internals