原帖由 soyan.xjx 于 2007-1-2 04:37 PM 发表
从老九的52M的PE中提取了fbwf.sys与fltMgr.sys两个文件还有注册表合到自已的里面不成功
哪位能帮忙提供一下正确的文件列表与注册表内容。
注册表:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\HK\ControlSet001\Services\fbwf]
"DisplayName"="fbwf"
"Group"="FSFilter System Recovery"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,66,00,62,00,77,00,66,00,2e,00,73,\
00,79,00,73,00,00,00
"Description"="File Based Write Filter Driver"
"ErrorControl"=dword:00000001
"Start"=dword:00000000
"Type"=dword:00000002
"EnabledOnAllSkus"=dword:00000001
"DependOnService"=hex(7):66,00,6c,00,74,00,6d,00,67,00,72,00,00,00,00,00
"CacheType"=dword:00000001
"WinPECacheThreshold"=dword:00000008
[HKEY_LOCAL_MACHINE\HK\ControlSet001\Services\fbwf\Instances]
"DefaultInstance"="Fbwf Instance"
[HKEY_LOCAL_MACHINE\HK\ControlSet001\Services\fbwf\Instances\Fbwf Instance]
"Altitude"="226000"
"Flags"=dword:00000000
[HKEY_LOCAL_MACHINE\HK\ControlSet001\Services\FltMgr]
"Description"="File System Filter Manager Driver"
"DisplayName"="FltMgr"
"ErrorControl"=dword:00000001
"Group"="FSFilter Infrastructure"
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,66,00,6c,00,74,00,6d,00,67,00,72,\
00,2e,00,73,00,79,00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000002
"Tag"=dword:00000001
"AttachWhenLoaded"=dword:00000001
其它的参照这里:http://bbs.wuyou.net/forum.php?m ... ghlight=&page=1
[ 本帖最后由 lxl1638 于 2007-1-2 04:50 PM 编辑 ] |