Win PE 插件制作原理

下面我们来看一下插件中.inf文件的构造。
这是一个WinRAR.inf的例子：
=======================================================================
; WinRAR.inf
; PE Builder v3 plug-in INF file for WinRAR v3.30
; Created by Cybervyk
; http://www.nu2.nu/pebuilder/
[Version]
Signature= "$Windows NT$"
[PEBuilder]
Name="WinRAR"
Enable=1
Help="WinRAR.htm"
[WinntDirectories]
a=Programs/WinRAR,2
b=Programs/WinRAR/Formats,2
[SourceDisksFiles]
RarExt.dll=a,,1
rarnew.dat=a,,1
rarreg.key=a,,1
WinRAR.cnt=a,,1
WinRAR.exe=a,,1
zipnew.dat=a,,1
Default.SFX=a,,1
Dos.SFX=a,,1
WinCon.SFX=a,,1
Zip.SFX=a,,1
RarFiles.lst=a,,1
Formats/ace.fmt=b,,1
Formats/arj.fmt=b,,1
Formats/bz2.fmt=b,,1
Formats/cab.fmt=b,,1
Formats/gz.fmt=b,,1
Formats/iso.fmt=b,,1
Formats/lzh.fmt=b,,1
Formats/tar.fmt=b,,1
Formats/UNACEV2.DLL=b,,1
Formats/uue.fmt=b,,1
[Software.AddReg]
0x1, "Classes/.ace",,"WinRAR"
0x1, "Classes/.arj",,"WinRAR"
0x1, "Classes/.bz",,"WinRAR"
0x1, "Classes/.bz2",,"WinRAR"
0x1, "Classes/.cab",,"WinRAR"
0x1, "Classes/.gz",,"WinRAR"
0x1, "Classes/.iso",,"WinRAR"
0x1, "Classes/.jar",,"WinRAR"
0x1, "Classes/.lha",,"WinRAR"
0x1, "Classes/.lzh",,"WinRAR"
0x1, "Classes/.rar",,"WinRAR"
0x1, "Classes/.rar/ShellNew","FileName","%SYSTEMDRIVE%/Programs/WinRAR/rarnew.dat"
0x1, "Classes/.rev",,"WinRAR.REV"
0x1, "Classes/.tar",,"WinRAR"
0x1, "Classes/.tbz",,"WinRAR"
0x1, "Classes/.tbz2",,"WinRAR"
0x1, "Classes/.tgz",,"WinRAR"
0x1, "Classes/.uu",,"WinRAR"
0x1, "Classes/.uue",,"WinRAR"
0x1, "Classes/.xxe",,"WinRAR"
0x1, "Classes/.zip",,"WinRAR"
0x1, "Classes/.zip/ShellNew","FileName","%SYSTEMDRIVE%/Programs/WinRAR/zipnew.dat"
0x1, "Classes/WinRAR",,"WinRAR archive"
0x1, "Classes/WinRAR/DefaultIcon",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe,0"
0x1, "Classes/WinRAR/shell/open/command",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe %1"
0x1, "Classes/WinRAR.REV",,"RAR recovery volume"
0x1, "Classes/WinRAR.REV/DefaultIcon",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe,1"
0x1, "Classes/WinRAR.REV/shell/open/command",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe %1"
0x1, "Classes/WinRAR.ZIP/DefaultIcon",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe,0"
0x1, "Classes/WinRAR.ZIP/shell/open/command",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe" "%1
[Default.AddReg]
0x0, "Software/WinRAR/General/Toolbar/Layout"
0x1, "Software/WinRAR/Paths","TempFolder","%temp%"
========================================================================
以下为inf的说明：
[Version]
Signature= "$Windows NT$"
这两行信息必须添加到新建文件中，否则inf文件就不可用，[Version]之上可按照自己的需要添加注释（行前加分号），添加内容完毕后将其存为.inf文件，这个插件显然还不能做任何事情，下面我们还要添加其他部分。
[PEBuilder]
每个插件的inf文件都必须包含这一部分，此部分有3个参数。 “Name”是插件名称，即在PE Builder中显示的名称。 “Enable”是插件的默认初始状态，0表示插件在PE Builder中非激活，1则表示插件在PE Builder中默认激活。”Help”是这个插件的帮助文件，这个可以省略。
以分号“；”开始的每行是作为注释或者说是可以被忽略，不会被执行的内容。
[WinntDirectories]此部分使用固定语句格式：directoryID=dirname[,attribute]
directoryID是要建立的目录ID，可以用字母a到z表示。
dirname是要建立的目录名称，如果目录名称中含有空格，需要在前后使用双引号。
attribute一般可以用这么几个值 （1，2，3），
1 － 表示在i386/下建立目录，而无论该目录是否为空；
2 － 表示在光盘根目录下建立目录，但如果该目录是空的话，则不会建立；
3 － 表示在光盘根目录下建立目录，而无论目录是否为空；
如果没有使用上面这3个值的话，默认的值是0，表示在i386/下建立目录，但如果该目录是空的话，则不会建立。
例如：
[WinntDirectories]
a=repair
表示在i386/下建立一个非空的目录repair；
b=com,1
表示总是在i386/下建立一个目录com；
c＝" programs/my documents ",2
表示在光盘根目录下建立一个非空的目录programs/my documents；
d＝programs/winrar,3
表示总是在光盘根目录下建立一个目录programs/winrar。
[SourceDisksFiles]的作用是复制文件，
格式为：filename=directoryID[,filenameRenamed][,attribute]
filename表示要复制的文件名称；
directoryID表示目标目录ID；
filenameRenamed表示目标文件名称，如果和源文件相同的话可以省略；
attribute可以用这么几个值 （1，2，4），默认值是0 关于attribute的几个值1，2，4，
1－－表示使用pluginCheck()，检查该文件是否存在.
4－－表示不检查该文件是否存在。
至于2就不用管它了。
[SourceDisksFolders]的作用是复制整个文件夹，格式是sourcepath=directoryID
sourcepath表示源文件夹的路径；
directoryID表示目标目录ID。
================================================================================
简介：
[WinntDirectories]
a=programs/winrar,2
[SourceDisksFiles]
rar.exe=2
表示把rar.exe复制到i386/system32目录下；
unrar.exe=a
表示把unrar.exe复制到programs/winrar目录下；
c:/winrar/winrar.exe=a
表示把c:/winrar/winrar.exe复制到programs/winrar目录下；
[SourceDisksFolders]
c:/winrar=a
表示把c:/winrar下的所有文件和文件夹复制到programs/winrar目录下。
================================================================================
例如:Outlook插件文件复制部分
[SourceDisksFolders]
Files/System32=2,,1
Files/Help=2,,1
Files/Outlook Express=a,,1
Files/Common Files/System=b,,1
Files/Common Files/Microsoft Shared/Stationery=c,,1
Files/Common Files/Services=d,,1

[SourceDisksFiles]
Files/autorun_oe.cmd=2,,1
Files/SYSTEM.wab=e,,1
================================================================================
在这里列出常用的系统目录ID
[WinntDirectories]
1  = "/"
2  = system32
3  = system32/config
4  = system32/drivers
5  = system
7  = system32/ras
9  = system32/spool
10 = system32/spool/drivers
11 = system32/spool/drivers/w32x86/3
12 = system32/spool/prtprocs
13 = system32/spool/prtprocs/w32x86
14 = system32/wins
15 = system32/dhcp
16 = repair
17 = system32/drivers/etc
18 = system32/spool/drivers/w32x86
19 = system32/drivers/disdn
20 = inf
21 = Help
22 = Fonts
23 = Config
24 = msagent/intl
25 = Cursors
26 = Media
27 = java
28 = java/classes
29 = java/trustlib
30 = system32/ShellExt
31 = Web
32 = system32/Setup
33 = Web/printers
34 = system32/spool/drivers/color
35 = system32/wbem
36 = system32/wbem/Repository
37 = addins
38 = "Connection Wizard"
39 = "Driver Cache/i386"
40 = security
41 = security/templates
42 = system32/npp
43 = system32/ias
44 = system32/dllcache
45 = Temp
46 = Web/printers/images
47 = system32/export
48 = system32/wbem/mof/good
49 = system32/wbem/mof/bad
50 = twain_32
51 = msapps/msinfo
52 = msagent
53 = msagent/chars
54 = security/logs
55 = system32/icsxml
57 = system32/mui
58 = %MUI_PRIMARY_LANG_ID_DIR%
59 = system32/mui/dispspec
60 = AppPatch
61 = Debug
62 = Debug/UserMode
63 = system32/oobe
67 = Help/Tours
68 = Resources/Themes/Luna
69 = Resources/Themes/Luna/Shell/NormalColor
70 = system32/oobe/html/ispsgnup
71 = system32/oobe/html/mouse
72 = system32/oobe/html/oemcust
73 = system32/oobe/html/oemhw
74 = system32/oobe/html/oemreg
75 = system32/oobe/images
76 = system32/oobe/setup
77 = system32/oobe/sample
78 = Resources/Themes/Luna/Shell/Metallic
79 = Resources/Themes/Luna/Shell/Homestead
91 = Help/Tours/mmTour
92 = Help/Tours/htmlTour
93 = Provisioning/Schemas
100 = system32/1025
101 = system32/1028
102 = system32/1031
103 = system32/1033
104 = system32/1037
105 = system32/1041
106 = system32/1042
107 = system32/1054
108 = system32/2052
109 = system32/3076
110 = system32/wbem/xml
111 = system32/usmt
112 = system32/inetsrv
123 = mui
124 = WinSxS
125 = WinSxS/Manifests
126 = WinSxS/InstallTemp
127 = ime
129 = Resources/Themes
130 = ime
132 = ime/imejp
133 = System32/IME/PINTLGNT
134 = System32/IME/CINTLGNT
135 = System32/IME/TINTLGNT
136 = IME/CHTIME/Applets
137 = ime/imejp98
138 = ime/imejp/applets
139 = pchealth/helpctr/binaries
180 = system32/3com_dmi
181 = PeerNet
239 = system32/wbem/Logs
240 = ehome
================================================================================
[Default.AddReg]   －对应HKCR/.DEFAULT
[Software.AddReg]  －对应HKLM/SYSTEM
[Setup.AddReg]     －对应HKLM/SOFTWARE
这3项的作用是添加相应的注册表内容，格式都是：regType, regKey, regValue, regData
regType的值及其含义如下：
0x0 --- REG_NONE
0x1 --- REG_SZ
0x2 --- REG_EXPAND_SZ
0x3 --- REG_BINARY
0x4 --- REG_DWORD
0x7 --- REG_MULTI_SZ
================================================================================
例如：
[Software.AddReg]
0x1, "Microsoft/Windows NT/CurrentVersion/Fonts", "Tahoma (TrueType)","TAHOMA.TTF"
0x2, "Control Panel/desktop", "WallPaper", "%systemroot%/system32/nu2.bmp"
0x3, "ControlSet001/Control/TimeZoneInformation", "DaylightStart",/
00,00,04,00,00,01,00,02,00,00,00,00,00,00,00,00
0x4, "ControlSet001/Control/GraphicsDrivers/DCI", "Timeout", 0x7
0x7, "ControlSet001/Services/VgaSave/Device0", "InstalledDisplayDrivers","vga", "framebuf", "vga256", "vga64k"
================================================================================
    这里是添加相关的注册表的键值，这是最复杂的步骤，如果是绿色软件我们就可以简化这个过程了。我们要在软件安装的过程中监视注册表，安装完毕后在提取相应注册表中的相关键值。这个过程我们可以使用Install Watch Pro和ConvReg To Inf这两个软件来帮助我们完成这项工作，Install Watch Pro可以在安装过程中监视注册表，然后将注册表提取出来，同时用ConvReg To Inf将Reg文件转换PE识别的Inf文件，这样可以大大减少我们的工作量。
[Software.DelReg]和[Default.DelReg]
这两项是删除相关的注册表键值。格式是regKey[.regValue]
[AddLine][.build]
这一项的作用是在指定的windows系统的inf文件中添加内容。格式是Filename,Section,StringToAdd
例如：
[AddLine.2600]
"netmscli.inf", "MSClient.DelReg", "HKLM, Software/Microsoft/Rpc/SecurityService, 9"
[DelLine][.build]
这一项的作用是在指定的windows系统的inf文件中删除内容。格式是Filename,Section,StringToDel
例如：
[DelLine.3790]
"netmscli.inf", "MSClient.Browser.AddReg", "HKR, Parameters, MaintainServerList,"
[SetValue][.build]
这一项的作用是改变指定的windows系统中的inf文件的某一项内容。
格式是：Filename,Section,Key,Value
例如：
[SetValue.2600]
"netmscli.inf", "Alerter_Service_Inst", "StartType", "3"
如果使用Filename,Section,Key这样的格式，则是删除相应的Key；
如果使用Filename,Section这样的格式，则是删除相应的整个Section。