PE添加64位写字板wordpad.exe组件需要的文件列表和注册表（基于WinRE制作的骨头版pe）

sairen139

PE添加64位写字板wordpad.exe组件需要的文件列表和注册表（基于WinRE制作的骨头版pe）

写字板wordpad.exe程序被Word的光芒遮掩了很久，但写字板程序其实在pe里如果不想安装大型体积的Word还是有些用处的。
因为写字板可以创建和打开以及修改docx和rtf和odt格式，这几个富文本格式都是比较流行的富文本格式！

这篇教程就是给所有文件都取自WinRE的体积仅有88mb的骨头网络版，添加64位的wordpad.exe写字板组件程序。
第一步离线给所有文件都取自WinRE的骨头网络版pe的config文件夹里的software注册表配置文件添加注册表片段内容如下：
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{0F7434B6-59B6-4250-999E-D168D6AE4293}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{32665929-D77E-4ab5-8C08-FBF409B8A233}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{926749fa-2615-4987-8845-c33e65f2b957}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"



[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}]
@="rtf persistent handler"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{e2403e98-663b-4df6-b234-687789db8560}"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{3037B4CD-A40B-401B-B676-2017EE8FAFF4}]
@="Wordpad DOCX Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{3037B4CD-A40B-401B-B676-2017EE8FAFF4}\InprocServer32]
@="X:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{6047F837-D527-467E-9DC1-6D51F92D9E45}]
@="Wordpad ODT Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{6047F837-D527-467E-9DC1-6D51F92D9E45}\InprocServer32]
@="X:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}]
@="Wordpad OOXML Document Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{3037B4CD-A40B-401B-B676-2017EE8FAFF4}"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}]
@="Wordpad ODT Document Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{6047F837-D527-467E-9DC1-6D51F92D9E45}"



[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.docx]
@="docxfile"
"PerceivedType"="document"
[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.docx\OpenWithList\WordPad.exe]
@=""
[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.docx\PersistentHandler]
@="{698A4FFC-63A3-4E70-8F00-376AD29363FB}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile]
@="OOXML Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,32,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell]

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\print\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\printto\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,\
  00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,\
  22,00,00,00



[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt]
@="odtfile"
"PerceivedType"="document"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\PersistentHandler]
@="{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}"





[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile]
@="ODF Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\open]

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\print\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\printto\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,\
  00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,\
  22,00,00,00



[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf]
@="rtffile"
"PerceivedType"="document"

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\PersistentHandler]
@="{2e2294a9-50d7-4fe7-a09f-e6492e185884}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile]
@="Rich Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\CLSID]
@="{73FDDC80-AEA9-101A-98A7-00AA00374959}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell]

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell\print\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell\printto\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,\
  00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,\
  22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}]
@="{a42c2ccb-67d3-46fa-abe6-7d2f3488c7a3}"



第二步给骨头版pe增加下列64位写字板wordpad.exe组件程序的依赖文件48个即可：
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\WordpadFilter.dll
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\shellstyle.dll
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\OpcServices.dll
\Windows\SYSTEM32\ADVAPI32.dll
\Windows\SYSTEM32\bcrypt.dll
\Windows\SYSTEM32\bcryptPrimitives.dll
\Windows\SYSTEM32\combase.dll
\Windows\SYSTEM32\COMDLG32.dll
\Windows\SYSTEM32\dwmapi.dll
\Windows\SYSTEM32\GDI32.dll
\Windows\SYSTEM32\gdi32full.dll
\Windows\SYSTEM32\iertutil.dll
\Windows\SYSTEM32\IMM32.DLL
\Windows\SYSTEM32\kernel.appcore.dll
\Windows\SYSTEM32\KERNEL32.DLL
\Windows\SYSTEM32\KERNELBASE.dll
\Windows\SYSTEM32\MFC42u.dll
\Windows\SYSTEM32\MSCTF.dll
\Windows\SYSTEM32\MSFTEDIT.DLL
\Windows\SYSTEM32\msvcp_win.dll
\Windows\SYSTEM32\msvcrt.dll
\Windows\SYSTEM32\msxml3.dll
\Windows\SYSTEM32\ntdll.dll
\Windows\SYSTEM32\ntmarta.dll
\Windows\SYSTEM32\OLE32.dll
\Windows\SYSTEM32\oleacc.dll
\Windows\SYSTEM32\OLEAUT32.dll
\Windows\SYSTEM32\PROPSYS.dll
\Windows\SYSTEM32\RPCRT4.dll
\Windows\SYSTEM32\sechost.dll
\Windows\SYSTEM32\shcore.dll
\Windows\SYSTEM32\SHELL32.dll
\Windows\SYSTEM32\SHLWAPI.dll
\Windows\SYSTEM32\TextShaping.dll
\Windows\SYSTEM32\ucrtbase.dll
\Windows\SYSTEM32\urlmon.dll
\Windows\SYSTEM32\USER32.dll
\Windows\SYSTEM32\uxtheme.dll
\Windows\SYSTEM32\win32u.dll
\Windows\SYSTEM32\windows.storage.dll
\Windows\SYSTEM32\windowscodecs.dll
\Windows\SYSTEM32\WINMM.dll
\Windows\SYSTEM32\WINSPOOL.DRV
\Windows\SYSTEM32\wintypes.dll
\Windows\SYSTEM32\Wldp.dll
\Windows\SYSTEM32\WS2_32.dll
\Windows\SYSTEM32\XmlLite.dll

PS:至于这些依赖dll文件相对应的\Windows\System32\zh-CN文件夹里的语言配置文件请对照dll自行添加mui后缀的语言文件即可！


还有一个可加可不加的\Windows\write.exe是用来启动wordpad.exe写字板程序用的，不加也不影响写字板的使用！

sairen139

WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖共7个文件和离线注册表reg片段：
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\WordpadFilter.dll
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\shellstyle.dll
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\UIRibbon.dll\zh-CN\UIRibbon.dll.mui

lily9718

谢谢分享

sairen139

sairen139 发表于 2021-12-20 00:22
WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖共7个文件和离线注册表reg片段：
\Program F ...

\Program Files\Windows NT\Accessories\WordpadFilter.dll
这个文件似乎也可以删掉不影响写字板的正常使用！




给88mb骨头版pe增加下列64位写字板wordpad.exe组件程序的依赖文件5个即可：
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\OpcServices.dll
\Windows\SYSTEM32\MFC42u.dll
\Windows\SYSTEM32\MSFTEDIT.DLL


右键新建菜单能直接生成docx和RTF文档的添加wordpad写字板组件所需的注册表如下：
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{0F7434B6-59B6-4250-999E-D168D6AE4293}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{32665929-D77E-4ab5-8C08-FBF409B8A233}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{926749fa-2615-4987-8845-c33e65f2b957}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"



[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx\ShellNew]
"NullFile"=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx]
"PerceivedType"="document"
@="docxfile"

[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx\PersistentHandler]
@="{698A4FFC-63A3-4E70-8F00-376AD29363FB}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile]
@="OOXML Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,32,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00


[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\ShellNew]
"Data"="{\\rtf1}"
"ItemName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\
  69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,\
  69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,\
  00,58,00,45,00,2c,00,2d,00,32,00,31,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf]
"PerceivedType"="document"
@="rtffile"

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\PersistentHandler]
@="{2e2294a9-50d7-4fe7-a09f-e6492e185884}"

[HKEY_LOCAL_MACHINE\pe-software\Classes\rtffile]
@="Rich Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-software\Classes\rtffile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-software\Classes\rtffile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00




[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt]
@="odtfile"
"PerceivedType"="document"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\PersistentHandler]
@="{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile]
@="ODF Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

zds1210

这个非常好，为什么不制作一个绿色版的wordpad呢？改天按你的方法，试一下制作，然后在各PE中测试改进。

sairen139

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\ShellNew]
"NullFile"=""

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf]
"PerceivedType"="document"
@="rtffile"

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\OpenWithList]

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\PersistentHandler]
@="{2e2294a9-50d7-4fe7-a09f-e6492e185884}"

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\ShellNew]
"Data"="{\\rtf1}"
"ItemName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\
  69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,\
  69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,\
  00,58,00,45,00,2c,00,2d,00,32,00,31,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile]
@="Rich Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\CLSID]
@="{73FDDC80-AEA9-101A-98A7-00AA00374959}"

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\shell]

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\shell\open]

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx]
"PerceivedType"="document"
@="docxfile"

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\OpenWithList]

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\PersistentHandler]
@="{698A4FFC-63A3-4E70-8F00-376AD29363FB}"

2011whp

zds1210 发表于 2021-12-20 19:56
这个非常好，为什么不制作一个绿色版的wordpad呢？改天按你的方法，试一下制作，然后在各PE中测试改进。

很好的想法，做好了 @ 我

楼主 研究 很有意义

感觉 guid 是 间接地 引用依赖 文件
如果是 这样的 话，是不是  画图  计算器，也能呢

zds1210

2011whp 发表于 2021-12-21 21:05
很好的想法，做好了 @ 我

楼主 研究 很有意义

应该是差不多，在PE下一般就补注册项，补dll控件就行了。

zds1210

2011whp 发表于 2021-12-21 21:05
很好的想法，做好了 @ 我

楼主 研究 很有意义

请放出成品来玩玩。在不带网络的PE下测试效果如何。

sairen139

sairen139 发表于 2021-12-21 15:39
[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\ShellNew]
"NullFile"=""

如果加了右键菜单直接创建生成docx文件和rtf文件，其实下面这个\Windows\SYSTEM32\shellstyle.dll依赖文件也可以删除。因为除了另存为其它格式这个\Windows\SYSTEM32\shellstyle.dll对wordpad正常使用几乎没影响。

sairen139

sairen139 发表于 2021-12-22 18:48
如果加了右键菜单直接创建生成docx文件和rtf文件，其实下面这个\Windows\SYSTEM32\shellstyle.dll依赖文 ...

如果配合右键创建生成rtf和docx菜单注册表及wordpad必须的注册表，那么只要下面这样添加文件就足够使用了：
WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖总共5个文件就能使用：
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\UIRibbon.dll\zh-CN\UIRibbon.dll.mui

2011whp

依赖  竞如此 相似
https://www.itsk.com/forum.php?mod=viewthread&tid=385984

chg008

zds1210 发表于 2021-12-20 19:56
这个非常好，为什么不制作一个绿色版的wordpad呢？改天按你的方法，试一下制作，然后在各PE中测试改进。

期待PE下绿色版的WordPad成品！

vaf

还有两个课题, 烦劳楼主研究一下.
1. 现在许多 PE 系统自带的磁盘扫描不能用, 少什么注册表, 缺什么文件.
2. msi 安装方式, 在许多 PE 中不能用或不好用, 比如说 Edge 的 msi 有些 PE 不支持, 或装上也不能用.

zds1210

vaf 发表于 2022-5-29 18:18
还有两个课题, 烦劳楼主研究一下.
1. 现在许多 PE 系统自带的磁盘扫描不能用, 少什么注册表, 缺什么文件.
...

这两个课题很现实啊，实际当中经常遇得到。比如要绿色msi格式安装软件，也就H3w3的PE能支持。
还有画图 图片查看器，wordpad，如果能实现绿色化就非常好。

martin313

在我的豪华版骨头PE里，用wordpad.exe关联文件，只需要下述3个文件及对应mui文件，以及在PE里在线添加注册表即可：

wordpad.exe
UIRibbon.dll
UIRibbonRes.dll

[HKEY_CLASSES_ROOT\.doc\shell\open\command]  
@="\"X:\\Windows\\System32\\wordpad.exe\" \"%1\""

[HKEY_CLASSES_ROOT\.docx\shell\open\command]  
@="\"X:\\Windows\\System32\\wordpad.exe\" \"%1\""

[HKEY_CLASSES_ROOT\.rtf\shell\open\command]  
@="\"X:\\Windows\\System32\\wordpad.exe\" \"%1\""

[HKEY_CLASSES_ROOT\.odt\shell\open\command]  
@="\"X:\\Windows\\System32\\wordpad.exe\" \"%1\""

qhb

感谢分享