A Study of Windows optimization masters

This article is based on the English version v7.80.8.218. It should be the latest public version.

InstallProgramIs the latest installation program created by Inno Setup 5.2.2. Inno Setup is compiled by Delphi 2. Therefore, it is very compatible with the application software developed by Delphi, just like using C ++ The program is like packaging with NSIs. Inno Setup 5.2.2 is also the latest version released. Inno Setup has been improving its support for the Vista system for several recent updates. Another advantage of Inno Setup is that you can set the compression mode to lzma./Ultra, which can generate the smallest installation package and save the download time.

Next, we will start to dissect the installation program. You can obtain the universal extractortool (of course, the command line tool innounp.exe can also be used directly), and unpack the package to see the extracted files.

Setup. E32 is the real installation execution file, which is equivalent to the E of InstallShield.Ngine
Flist. Bin looks like the index file of script. Bin.
The binary file compiled by the script. bin script focuses on this file.

A lot of Chinese shortcuts are deleted at the beginning of installation, which may be convenient for those testers.Staff, so that they do not have to install the Chinese version at a time, while installing the English version, the Start menu and the desktop appearHeap repetition shortcut. Then I saw a URL: http://login.wopti.net/install.. Php? Ver = 7.80.8.218.5, which is believed to be used to record the software installation of networked users for statistical analysis. The next step is to copy the file to the system, where {sys} \ iosubsys\ Smartvsd. VxD is installed only in Win9x,{App} \ woptidefrag. dll is in non-Win9x and non-Will be installed under Vista, {app} \ woptidefragvisTa. dll is installed under Vista. {TMP}\ Woptiinfo. dll is actually originally called sendinfodllTo send an HTTP request to the url I mentioned earlier. (Because this is a DelphI compiled DLL and referenced the wininet Unit)

{Sys} \ iosubsys \ smartvsd. VxD is a virtual device driver that supports the smart ioctl interface, because Windows is designedThe program cannot directly access the underlying hardware. Therefore, you need to obtain the relevant hardware information from the device driver.. Win9x can directly use smartvsd. Vxd to access hard disk information.For Windows NT and later operating systems, administrators can manage hardware devices.Therefore, you can use the identify Device of ATA/apapi to obtain the required information. However, considering that user permissions are not necessarily administrator permissionsSo non-administrator users in winnt/2 k/XP can use SCSI backdoors.To read the IDE Hard Disk information (Vista below this trick will not work ).

All execution files and DLL files under {app} are digitally signed.This should be an international need. After all, foreign countries are more concerned with this.. The signature is a wosign (Shenzhen wotong) Certificate, and it does not seem cheap.More than 1000 in a year. For some reason, woptidefragvista. dll does not have version information.The description of woptiupdate.exe is actually chinese., It looks like this. Some companies in the version information are SSN.Some are wopti, the copyright information is inconsistent, and some are still in Chinese.Name. Some [languages] are Chinese and some [languages] are English.The released product files are not all compiled on the same machine.

Lightmap. PNG should be used as texture, together with d3dx81ab. DLL to test the graphics display (DirectX) performance.

Updateserver. INI is a configuration file that defines the address of the upgrading server. It can be seen that it supports joining multiple upgrading servers in the future.To meet the upgrade requirements after the number of users increases.

Portslist. inf this definition file defines the port usage of Common ServicesSituation, You can constantly add new definitions.

Activeximmunity. ini (ActiveX plug-in immune database) This file is the CLSID of the collection plug-in, so that users can select the immune plug-inModerate protection.

The selfregchg. ini file is originally stored with custom optimization settings. By default, it has two settings. One is to support Win2000 to use a large hard drive larger than 137g.The other is to cancel the disk capacity warning settings, which should be optimized by users.Apply the settings to the software.

Empty. ICO is a transparent icon used to hide arrows on shortcuts.

Woptihwdetect. sys is the original gwiopm. sys, which is a service program used to perform I/O port operations under NT.

Woptihelp. chm help file, is to use help & Manual (professional help production tools, although the installation program is less than 30 m, Which is much thinner than Adobe RoboHelp.) There is no image in it.So the Help file is only 100 kb.
Big5.dat, Devs. dat, JEDEC. dat, monv. dat at first, I thought it was an encrypted format. Later I took a closer look at the two bytes starting with the file."78 da" (maximum compression rate), "78 9C" is not a mark of the standard zlib compression format, obviously the compression here also plays(Because there is no file header, the compression tool cannot open the file). These DAT files will automatically decompress the. tmp temporary files with the same name when needed after running. After monv. dat is decompressed to generate monv. tmp, it is quickly deleted.
The temporary file Devs. tmp (Chip Detection database) is a text file, which contains a table of device IDs and names.
JEDEC. tmp (Spd vendor database) temporary file?
[Note: JEDEC = Joint Electron Device Engineering couneller (Electronic Component Industry Federation)]
Big5.dat should be required for registration verification.
Monv. dat does not know what to do. It is also required for registration verification?

The set. ini file is generated only after it is run. It contains the saved user settings. It seems that all external tools areThis setting file.

Wopti. log is generated only after running. It is the operation log recorded.

The file d3dx81ab. dll has been compressed by ASPack, but other EXE and DLL files are not compressed..

Woptidefrag. dll and woptidefragvistA. dll (disk finishing component) is compiled with midl of VC and ActiveX control.. Defragcontrol class is provided.

Wopticdromcontmenu. dll is also a COM file that can be registered, but it is developed using Delphi.. The function is context menu handler, which is to use the interface provided by windows for Shell extension.To add two items to the right-click menu of all file types: Enable and disable the optical drive.Optical Drive. However, garbled characters may appear in the status bar when I select the menu.(I don't know if Delphi does not support Unicode). After regsvr32 wopticdromcontmenu. dll is executed, the menu is added. After regsvr32 wopticdromcontmenu. dll/u is executed, the menu is removed. CoreCodeOf course, it is mcisendcomman for winmm. dll.D, mcisendstring call.

Woptiglobe. dll is developed in Delphi 7 and has three export functions: woptichkfileisok., Woptictrlhomepage, woptisetmaxtHon

Woptip2p. dll (process function library) is developed with Delphi 7 and has three export functions: womterminateprofr.Omname, womterminateprocess, Getport2processlist

Woptiutils. dll is developed with vc7 and has only one export function: cleartracksfoRvista

Woptimem.exe (memory sorting) is developed using Delphi 7. It can be seen that the memory is sorted out or the large request memory is used to force the operating systemThe content occupied by common processes is transferred to the virtual memory to sort out memory fragments.

Woptiprocess.exe (Process Manager) was developed using Delphi 7 and statically linked to getport2proce of woptip2p. dllSslist function.

Woptiupdate.exe (online upgrade) is developed with Delphi 7, upgrade information address is: http://liveupdate.wopti.net/Updatefilelist.zip. it's strange to define the. Zip suffix, But it returns a text file. This file only contains Chinese characters, and the version is incorrect.

Woptiutilities.exe (main program) was developed using Delphi 7 and statically linked to getport2proce of woptip2p. dllSslist function. The third-party controls used are roughly as follows:

Fast Memory Manager provides excellent memory management programs. It is easy to detect memory leakage caused by code in the program.
Only public under tregexpr Delphi Source code Regular Expression Widget
Simpletimer is a lightweight timer with a precision R is the same, but it is inherited from tobject, and multiple instances can Share the same handle
Deep sorting of maxmem memory
Mitec system information component system information detection
Cooltrayicon tray Control
Activeports
System Directory and disk view controls available for dhcheckfolder
TMS components a set of fully functional interface functional controls
Apnetscapelabel is used as the title bar for the label control of the Netscape Communicator performance dialog box.
Select components from the column on the left of mxoutlookbar pro
The powerful tree control of virtual Treeview can also be used as a table.
Flatstyle buttons, input boxes, and other flat style controls
Magenta systems WMI and smart component obtain more detailed and accurate system information Through WMI, smart, and SCSI
Ipinfo uses IP helper API to obtain network configuration and adapter Information
Delphix DirectX's Delphi Interface Control
Zlib supports Compression
Indy Network Communication Control
Teechart is used to display pie charts, etc.
MD5, blowfish, fgintrsa, and rc6 are cryptographic Algorithm Implementation Unit, which can use registration verification and encrypted files.

Some developers use Microsoft pinyin.It is easy to automatically set the imename of the input box control to "Chinese (simplified)-Microsoft Pinyin ".

It is certain that the RSA algorithm is used for registration verification, and the main program is not added.Shell and other protection processing, that is, it is unlikely that the Code will be analyzed and written into the registration MachineBut it is inevitable to be cracked. Previous enemy list: -arongsoft.com.htm,keygen.exe,wom60_keygen.exe is still defined in the Code.

Interface:

The tab key of the form is not set to jump in order, and the ESC cannot close the dialog box. ApnetscaThe function of simulating the title bar on pelabel is a little problematic.: When you maximize double-click recovery, the position of the form will be stuck. Apnetscapelabel does not implement right-click menuThe icon in the upper left corner does not implement double-click event closure, which is inconsistent with the normal form behavior..

The status bar below is a self-painted panel, which achieves the upper and lower gradient effect.. The source code of mxoutlookbar on the left is modified to implement both the project and the externalIntegration effect and rounded corner effect. VirtualstringtreeIt is inherited to implement twomccvt. Flatbutton changed to a more flatAnd achieve the rounded corner effect.

Based on the execution file, I wrote a demo interface (source include ):

Http://files.cnblogs.com/Icebird/WoptiUtilitiesDemo.rar