Sometimes we need to make some optimizations in the registration table of PE so that we can use it more conveniently, here are some ways to optimize the settings:
1. Right-click to increase command prompt and open with Notepad
Windows Registry Editor Version 5.00
[Hkey_local_machine_softwareclassesfoldershellcmd]
@= "Command Prompt"
[Hkey_local_machine_softwareclassesfoldershellcmdcommand]
@= "cmd.exe/k" CD%l ""
[Hkey_local_machine_softwareclas
How to modify the PE system disk character
Step one: Open the Winpe.ini file and modify it inside:
Configuration file Start
Moun%curdrv%minipeop. wim,w:,1
ENVI opdir=w: External Program
The second step: the Winpe.is_ core decompression, under the System32 has a setupreg.hi_, and then decompression, get Setupreg.hiv, with Registry workshop load as a registry hive WinPE, here are two to change:
[Hkey_local_machinepecontrolset001controlsession Mana
Q: I want to start a VMware virtual machine with a flash Windows PE, but VMware prompts "Disable host connection for USB devices", how do I get my virtual machine to use a USB device?
A: The analysis should be the VMware USB Arbitration service is not enabled, the workaround is to go to "control Panel → administrative tools → services", turn on the "VMware USB Arbitration Server" service, restart VMware, You can do it.
If this service cannot be star
[PE Structure Analysis] 9. Export table IMAGE_EXPORT_DIRECTORY, dockerexportimage
Typedef struct _ IMAGE_EXPORT_DIRECTORY {DWORD Characteristics; // unused, total 0
DWORD TimeDateStamp; // file creation timestamp WORD MajorVersion; // unused, total 0
WORD MinorVersion; // not used, always 0 DWORD Name; // point to an rva dword Base that represents the Name of this DLL; // The start sequence of the function, DWORD NumberOfFunctions; // total number of
u disk installation Assistant, is the IT sky for the vast number of installed personnel to build the Windows PE environmentU disk installation assistant from the vastfrom the point of view of the installation maintainer, the three major requirements of PE are maintained by the machine."widely compatible, convenient operation, quick Start "to focus on the point,force will be a U disk installed Assistant to b
Section in PE isStore different types of data (Code, Data, constants, resources)Different sections have different access permissions.
Section is the basic unit for storing code or data in PE files. Some data types belong to different data directories, but they are classified into the same section because their access attributes are the same. The section may occupy one or more pages, the page attributes in
The PE file format is the self-contained execution body file format in the Win32 environment. The main subject of a personal volume is the. exe file and. DLL file. I don't know if it is correct. If it's not correct, I hope the heroes will correct it. I will not talk about it much more. Brother Feng feixue described it in details in encryption and decryption, first, write a console-based PE File Format analy
Configuration:System: win7 + Ubuntu dual-System Computer: Sony
Cause:
After windows 12.04 and Ubuntu are installed, Ubuntu has some problems, so I want to reinstall ubuntu.
I used the easybcd software to install the dual-system, because I did not know about the software and system, and so on. I just thought about it. Do I think Sony has any built-in recovery software? I can fix the entire hard disk and restore the system to the factory status. So I did it.
As a result, there is a tragedy
Image_dos_header struct
{
+ 0 h word e_magic // magic dos signature MZ (4dh 5ah) DoS Executable File tag
+ 2 H word e_cblp // bytes on last page of File
+ 4 h word e_cp // pages in file
+ 6 h word e_crlc // relocations
+ 8 h word e_cparhdr // size of header in paragraphs
+ 0ah word e_minalloc // minimun extra paragraphs needs
+ 0ch word e_maxalloc // maximun extra paragraphs needs
+ 0eh word e_ss // intial (relative) SS value dos code initialization stack SS
+ 10 h word e_sp /
The parser writes additional data to the file.
It mainly resolves the PE File Header, locates the overlay location, and writes the file. The common application scenario is that in crackme, crackme itself has a piece of encrypted additional data, parse its own additional data during the crackme operation, and then decrypt the data ....
Code retention:
// Parse your PE file TCHAR szModuleFile [MAX_PATH] = {
Research on basic PE resources
Resources are generally stored in a tree, which usually contains three layers. In NT, the top layer is type, followed by name, and finally language. If a PE file contains a resource file, the system checks whether the selection table contains ". rsrc" but does not apply to some PE files.
1. The structure of a type table is as
How is the PE system letter modified? WinPE believe that everyone has used, but every time the PE letter is fixed, then there is no way to change the letter?
For example, the PE system in the B disk into the W plate, carry forward the DIY spirit, and then together to modify it. The following areas are roughly required:
First, WINPE. There is one place in the IN
PE system can not find a hard drive solution, here we introduce the following four methods:
Method One:
On the desktop, right-click "My Computer"--"manage"--"Disk Management", you can see that PE has recognized the mobile hard disk (disk 1), but did not assign a letter to it.
On a partition on a removable hard disk (disk 1) (if there are 2 or more partitions), right-click--"Change drive name and path"--"
binary level of metadata.
In the next article, I will gradually metadata in PE, the organizational structure gradually stripped away,
So that you can understand what this mysterious CLR core is, what it hides, that we can get through
What he did, why he designed it, and so on ...
The organization structure of 1.4 metadata in PE
After saying a nonsense, back to Roman up, talk about metadata in
Recently just bought a piece of the net to move a plate, and then want to install a PE system for its system maintenance, I will explain how to install the PE system on the mobile hard disk, the use of this method will not harm the data of the mobile hard disk itself!
Of course, someone would like to, why not buy a U disk, click on it! Oh, or I hope you do not spray me greatly!
Installation Preparation:
This article illustrates the method of C + + to judge PE file. Share to everyone for your reference.
The implementation methods are as follows:
#include Main.h is as follows:
Copy Code code as follows:
#include
Class Cmyapp:public CWINAPP
{
BOOL InitInstance ();
};
Main.cpp is as follows:
Copy Code code as follows:
#include "Main.h"
#include
CMyApp Theapp;
BOOL cmyapp::initinstance ()
{
CFileDialog
A friend is using Acer 4750G, the kind of dual graphics. Recently want to redo a system, with a U disk made a PE. Results with u disk boot is ok, but one into the PE on the blue screen, the code is 0X000000B4 blue. It's impossible to pretend now. What is the reason for this? How to solve the blue screen? Here's a solution to this situation:
The information code from the blue screen shows that you are doing
Replace the theme under normal Windows I believe everyone will, but the use of the desktop theme in PE should not have seen it. Let's take a look at the next steps.
First look at the principle: Winlogon startup after initialization of some global variables, detection hkey_local_machinesystemsetup under the systemsetupinprogress is zero, if it is normal to start, if 1, When the system service Samss is started, tell it not to manage the SAM database, s
How to quickly make your own USB disk boot PE, the following is to say simple steps:
First, let your USB disk boot DOS
Run the FlashBootWizard.exe in the Flashboot folder,
1 choose to make a boot disk with the smallest DOS system
2 Use the built-in freedos/to select your USB drive letter
3 then select Zip or HDD mode (see if your motherboard supports which kind of zip mode is best for compatibility)
You'll have a DOS boot file on your USB driv
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.