Win PE 外掛程式製作原理

下面我們來看一下外掛程式中.inf檔案的構造。
這是一個WinRAR.inf的例子：
=======================================================================
; WinRAR.inf
; PE Builder v3 plug-in INF file for WinRAR v3.30
; Created by Cybervyk
; http://www.nu2.nu/pebuilder/
[Version]
Signature= "$Windows NT$"
[PEBuilder]
Name="WinRAR"
Enable=1
Help="WinRAR.htm"
[WinntDirectories]
a=Programs/WinRAR,2
b=Programs/WinRAR/Formats,2
[SourceDisksFiles]
RarExt.dll=a,,1
rarnew.dat=a,,1
rarreg.key=a,,1
WinRAR.cnt=a,,1
WinRAR.exe=a,,1
zipnew.dat=a,,1
Default.SFX=a,,1
Dos.SFX=a,,1
WinCon.SFX=a,,1
Zip.SFX=a,,1
RarFiles.lst=a,,1
Formats/ace.fmt=b,,1
Formats/arj.fmt=b,,1
Formats/bz2.fmt=b,,1
Formats/cab.fmt=b,,1
Formats/gz.fmt=b,,1
Formats/iso.fmt=b,,1
Formats/lzh.fmt=b,,1
Formats/tar.fmt=b,,1
Formats/UNACEV2.DLL=b,,1
Formats/uue.fmt=b,,1
[Software.AddReg]
0x1, "Classes/.ace",,"WinRAR"
0x1, "Classes/.arj",,"WinRAR"
0x1, "Classes/.bz",,"WinRAR"
0x1, "Classes/.bz2",,"WinRAR"
0x1, "Classes/.cab",,"WinRAR"
0x1, "Classes/.gz",,"WinRAR"
0x1, "Classes/.iso",,"WinRAR"
0x1, "Classes/.jar",,"WinRAR"
0x1, "Classes/.lha",,"WinRAR"
0x1, "Classes/.lzh",,"WinRAR"
0x1, "Classes/.rar",,"WinRAR"
0x1, "Classes/.rar/ShellNew","FileName","%SYSTEMDRIVE%/Programs/WinRAR/rarnew.dat"
0x1, "Classes/.rev",,"WinRAR.REV"
0x1, "Classes/.tar",,"WinRAR"
0x1, "Classes/.tbz",,"WinRAR"
0x1, "Classes/.tbz2",,"WinRAR"
0x1, "Classes/.tgz",,"WinRAR"
0x1, "Classes/.uu",,"WinRAR"
0x1, "Classes/.uue",,"WinRAR"
0x1, "Classes/.xxe",,"WinRAR"
0x1, "Classes/.zip",,"WinRAR"
0x1, "Classes/.zip/ShellNew","FileName","%SYSTEMDRIVE%/Programs/WinRAR/zipnew.dat"
0x1, "Classes/WinRAR",,"WinRAR archive"
0x1, "Classes/WinRAR/DefaultIcon",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe,0"
0x1, "Classes/WinRAR/shell/open/command",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe %1"
0x1, "Classes/WinRAR.REV",,"RAR recovery volume"
0x1, "Classes/WinRAR.REV/DefaultIcon",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe,1"
0x1, "Classes/WinRAR.REV/shell/open/command",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe %1"
0x1, "Classes/WinRAR.ZIP/DefaultIcon",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe,0"
0x1, "Classes/WinRAR.ZIP/shell/open/command",,"%SYSTEMDRIVE%/Programs/WinRAR/WinRAR.exe" "%1
[Default.AddReg]
0x0, "Software/WinRAR/General/Toolbar/Layout"
0x1, "Software/WinRAR/Paths","TempFolder","%temp%"
========================================================================
以下為inf的說明：
[Version]
Signature= "$Windows NT$"
這兩行資訊必須添加到建立檔案中，否則inf檔案就不可用，[Version]之上可按照自己的需要添加註釋（行前加分號），新增內容完畢後將其存為.inf檔案，這個外掛程式顯然還不能做任何事情，下面我們還要添加其他部分。
[PEBuilder]
每個外掛程式的inf檔案都必須包含這一部分，此部分有3個參數。 “Name”是外掛程式名稱，即在PE Builder中顯示的名稱。 “Enable”是外掛程式的預設初始狀態，0表示外掛程式在PE Builder中非啟用，1則表示外掛程式在PE Builder中預設啟用。”Help”是這個外掛程式的協助檔案，這個可以省略。
以分號“；”開始的每行是作為注釋或者說是可以被忽略，不會被執行的內容。
[WinntDirectories]此部分使用固定語句格式：directoryID=dirname[,attribute]
directoryID是要建立的目錄ID，可以用字母a到z表示。
dirname是要建立的目錄名稱，如果目錄名稱中含有空格，需要在前後使用雙引號。
attribute一般可以用這麼幾個值 （1，2，3），
1 － 表示在i386/下建立目錄，而無論該目錄是否為空白；
2 － 表示在光碟片根目錄下建立目錄，但如果該目錄是空的話，則不會建立；
3 － 表示在光碟片根目錄下建立目錄，而無論目錄是否為空白；
如果沒有使用上面這3個值的話，預設的值是0，表示在i386/下建立目錄，但如果該目錄是空的話，則不會建立。
例如：
[WinntDirectories]
a=repair
表示在i386/下建立一個非空的目錄repair；
b=com,1
表示總是在i386/下建立一個目錄com；
c＝" programs/my documents ",2
表示在光碟片根目錄下建立一個非空的目錄programs/my documents；
d＝programs/winrar,3
表示總是在光碟片根目錄下建立一個目錄programs/winrar。
[SourceDisksFiles]的作用是複製檔案，
格式為：filename=directoryID[,filenameRenamed][,attribute]
filename表示要複製的檔案名稱；
directoryID表示目標目錄ID；
filenameRenamed表示目標檔案名稱，如果和源檔案相同的話可以省略；
attribute可以用這麼幾個值 （1，2，4），預設值是0 關於attribute的幾個值1，2，4，
1－－表示使用pluginCheck()，檢查該檔案是否存在.
4－－表示不檢查該檔案是否存在。
至於2就不用管它了。
[SourceDisksFolders]的作用是複製整個檔案夾，格式是sourcepath=directoryID
sourcepath表示源檔案夾的路徑；
directoryID表示目標目錄ID。
================================================================================
簡介：
[WinntDirectories]
a=programs/winrar,2
[SourceDisksFiles]
rar.exe=2
表示把rar.exe複製到i386/system32目錄下；
unrar.exe=a
表示把unrar.exe複製到programs/winrar目錄下；
c:/winrar/winrar.exe=a
表示把c:/winrar/winrar.exe複製到programs/winrar目錄下；
[SourceDisksFolders]
c:/winrar=a
表示把c:/winrar下的所有檔案和檔案夾複製到programs/winrar目錄下。
================================================================================
例如:Outlook外掛程式檔案複製部分
[SourceDisksFolders]
Files/System32=2,,1
Files/Help=2,,1
Files/Outlook Express=a,,1
Files/Common Files/System=b,,1
Files/Common Files/Microsoft Shared/Stationery=c,,1
Files/Common Files/Services=d,,1

[SourceDisksFiles]
Files/autorun_oe.cmd=2,,1
Files/SYSTEM.wab=e,,1
================================================================================
在這裡列出常用的系統目錄ID
[WinntDirectories]
1  = "/"
2  = system32
3  = system32/config
4  = system32/drivers
5  = system
7  = system32/ras
9  = system32/spool
10 = system32/spool/drivers
11 = system32/spool/drivers/w32x86/3
12 = system32/spool/prtprocs
13 = system32/spool/prtprocs/w32x86
14 = system32/wins
15 = system32/dhcp
16 = repair
17 = system32/drivers/etc
18 = system32/spool/drivers/w32x86
19 = system32/drivers/disdn
20 = inf
21 = Help
22 = Fonts
23 = Config
24 = msagent/intl
25 = Cursors
26 = Media
27 = java
28 = java/classes
29 = java/trustlib
30 = system32/ShellExt
31 = Web
32 = system32/Setup
33 = Web/printers
34 = system32/spool/drivers/color
35 = system32/wbem
36 = system32/wbem/Repository
37 = addins
38 = "Connection Wizard"
39 = "Driver Cache/i386"
40 = security
41 = security/templates
42 = system32/npp
43 = system32/ias
44 = system32/dllcache
45 = Temp
46 = Web/printers/images
47 = system32/export
48 = system32/wbem/mof/good
49 = system32/wbem/mof/bad
50 = twain_32
51 = msapps/msinfo
52 = msagent
53 = msagent/chars
54 = security/logs
55 = system32/icsxml
57 = system32/mui
58 = %MUI_PRIMARY_LANG_ID_DIR%
59 = system32/mui/dispspec
60 = AppPatch
61 = Debug
62 = Debug/UserMode
63 = system32/oobe
67 = Help/Tours
68 = Resources/Themes/Luna
69 = Resources/Themes/Luna/Shell/NormalColor
70 = system32/oobe/html/ispsgnup
71 = system32/oobe/html/mouse
72 = system32/oobe/html/oemcust
73 = system32/oobe/html/oemhw
74 = system32/oobe/html/oemreg
75 = system32/oobe/images
76 = system32/oobe/setup
77 = system32/oobe/sample
78 = Resources/Themes/Luna/Shell/Metallic
79 = Resources/Themes/Luna/Shell/Homestead
91 = Help/Tours/mmTour
92 = Help/Tours/htmlTour
93 = Provisioning/Schemas
100 = system32/1025
101 = system32/1028
102 = system32/1031
103 = system32/1033
104 = system32/1037
105 = system32/1041
106 = system32/1042
107 = system32/1054
108 = system32/2052
109 = system32/3076
110 = system32/wbem/xml
111 = system32/usmt
112 = system32/inetsrv
123 = mui
124 = WinSxS
125 = WinSxS/Manifests
126 = WinSxS/InstallTemp
127 = ime
129 = Resources/Themes
130 = ime
132 = ime/imejp
133 = System32/IME/PINTLGNT
134 = System32/IME/CINTLGNT
135 = System32/IME/TINTLGNT
136 = IME/CHTIME/Applets
137 = ime/imejp98
138 = ime/imejp/applets
139 = pchealth/helpctr/binaries
180 = system32/3com_dmi
181 = PeerNet
239 = system32/wbem/Logs
240 = ehome
================================================================================
[Default.AddReg]   －對應HKCR/.DEFAULT
[Software.AddReg]  －對應HKLM/SYSTEM
[Setup.AddReg]     －對應HKLM/SOFTWARE
這3項的作用是添加相應的註冊表內容，格式都是：regType, regKey, regValue, regData
regType的值及其含義如下：
0x0 --- REG_NONE
0x1 --- REG_SZ
0x2 --- REG_EXPAND_SZ
0x3 --- REG_BINARY
0x4 --- REG_DWORD
0x7 --- REG_MULTI_SZ
================================================================================
例如：
[Software.AddReg]
0x1, "Microsoft/Windows NT/CurrentVersion/Fonts", "Tahoma (TrueType)","TAHOMA.TTF"
0x2, "Control Panel/desktop", "WallPaper", "%systemroot%/system32/nu2.bmp"
0x3, "ControlSet001/Control/TimeZoneInformation", "DaylightStart",/
00,00,04,00,00,01,00,02,00,00,00,00,00,00,00,00
0x4, "ControlSet001/Control/GraphicsDrivers/DCI", "Timeout", 0x7
0x7, "ControlSet001/Services/VgaSave/Device0", "InstalledDisplayDrivers","vga", "framebuf", "vga256", "vga64k"
================================================================================
    這裡是添加相關的註冊表的索引值，這是最複雜的步驟，如果是綠色軟體我們就可以簡化這個過程了。我們要在軟體安裝的過程中監視註冊表，安裝完畢後在提取相應註冊表中的相關索引值。這個過程我們可以使用Install Watch Pro和ConvReg To Inf這兩個軟體來協助我們完成這項工作，Install Watch Pro可以在安裝過程中監視註冊表，然後將註冊表提取出來，同時用ConvReg To Inf將Reg檔案轉換PE識別的Inf檔案，這樣可以大大減少我們的工作量。
[Software.DelReg]和[Default.DelReg]
這兩項是刪除相關的註冊表索引值。格式是regKey[.regValue]
[AddLine][.build]
這一項的作用是在指定的windows系統的inf檔案中新增內容。格式是Filename,Section,StringToAdd
例如：
[AddLine.2600]
"netmscli.inf", "MSClient.DelReg", "HKLM, Software/Microsoft/Rpc/SecurityService, 9"
[DelLine][.build]
這一項的作用是在指定的windows系統的inf檔案中刪除內容。格式是Filename,Section,StringToDel
例如：
[DelLine.3790]
"netmscli.inf", "MSClient.Browser.AddReg", "HKR, Parameters, MaintainServerList,"
[SetValue][.build]
這一項的作用是改變指定的windows系統中的inf檔案的某一項內容。
格式是：Filename,Section,Key,Value
例如：
[SetValue.2600]
"netmscli.inf", "Alerter_Service_Inst", "StartType", "3"
如果使用Filename,Section,Key這樣的格式，則是刪除相應的Key；
如果使用Filename,Section這樣的格式，則是刪除相應的整個Section。