Unstrike

Provided by Legacy Update

Unstrike can automatically rescue a Windows 10 or 11 installation that has been affected by the 19 July 2024 CrowdStrike Falcon content update error. This tool will create a new ISO file that can be copied to a USB drive using software such as Rufus, or booted via the network using tools such as Windows Deployment Services (WDS). All you need is an ISO image of Windows 10 or Windows 11.

It’s important to know what’s running with high privileges in your network, which is why Unstrike is designed to be auditable. It makes use of a PowerShell script and the mkisofs program. Please review the script before executing it, to ensure it meets your needs and has not been compromised. It is also signed by Hashbang Productions, the developer of Legacy Update, and many other open-source projects.

Please note: Unstrike is a tool for IT administrators. If you’re a regular user, this tool is most likely not useful to you. You should only run Unstrike if you have computer(s) that are crashing with a blue screen error (also known as a stop error or bugcheck) that mentions Stop code: PAGE_FAULT_IN_NONPAGED_AREA and What failed: csagent.sys.

Watch demo video

Unstrike 1.0.1 main window screenshot

Download Unstrike

DISCLAIMER: This software is provided “as is” and without any express or implied warranties, including, without limitation, the implied warranties of merchantability and fitness for a particular purpose. Use of this software is at your own risk.
Compatible with Windows 10, version 1511 and later, Windows 11, Server 2019 and later
Requires a 64-bit Windows installation to run the script, and a 64-bit Windows installation ISO image.

How to use

To use the script:

  1. Download and extract the zip from the latest release.

  2. Recommended: Review the script to ensure it does what you expect. You can confirm that Unstrike.ps1 has a digital signature from Hashbang Productions, and mkisofs.exe has a digital signature from VMware, Inc.

  3. Right-click Unstrike.ps1 and select Run with PowerShell.

  4. Click the first Browse button and select a compatible Windows ISO image. Refer to the compatibility above. Download Windows 10 or Windows 11 64-bit if needed.

  5. Click the second Browse button and select where you would like to place the final modified ISO.

  6. Click OK, and within a minute you should see your output ISO in File Explorer.

Once the image is created, you have multiple options for deploying it to affected systems:

  • Rufus - Free and open source software to create a bootable USB drive from an ISO image.

  • Windows Deployment Services (WDS) - Network boot feature built into Windows Server. If you use Microsoft Deployment Toolkit (MDT), you are also using WDS. Use the Deployment Services snap-in to add Unstrike as an image.

  • Microsoft Configuration Manager - Formerly System Center Configuration Manager (SCCM); another Microsoft network-based deployment offering.

  • Other network deployment products may also be capable of booting WIM images. Refer to the product’s documentation.

  • Burn the ISO image to a CD or DVD.

When deploying over the network (PXE), remember that Unstrike is a boot image, not a system installation image. You may need to extract boot.wim from the ISO image. Simply double-click to mount the image, then copy it from sources\boot.wim.

Credits

Legacy Update is made available for free thanks to generous support from these fans:
Sam Bushman, Junior Moreno, Mithilesh Thakur, gary kerr, AnemonePrune, @mstg, @jeanluc162, @valnoxy, @Emil215p, @vondenstein, @oblakhost, @LabelGames, @NuwanWolters, Marrianne, Teena Rodriguez, Alex Auspitz, Timon, Alexis Irizarry, Roger Smith, Ryan Croughn, miss australiana, Trevor Key, and 4 private supporters.

Your name can be here too! Support me on GitHub Sponsors or Patreon. You can also support me anonymously on Ko-fi, which has the lowest fees.

Thanks to Bob Pony for helping with the trick to modify a Windows setup ISO into a generic Windows PE image, which can execute a batch file. This makes Unstrike far easier to use, eliminating the need to download and install the Windows Assessment and Deployment Kit (ADK).