PE又一技术难题，提供共同研究。

lxl1638

今天又看了一下以前从911CD拉下来的FBWF插件，发现似乎可以对其它卷或路径开启FBWF，
看红字部分：

; fbwf.inf
; PE Builder v3 plug-in INF file for File-based write filter
; Created by SCP
; Modified by d4vr0s 2005-12-30
; Only Slightly Modified by frodo 2006-8-4

[Version]
Signature= "$Windows NT$"
[PEBuilder]
Name="File-based write filter"
Enable=1

[SourceDisksFiles]
; Im using the fltmgr files from XP SP2, instead of the ones from Vista, and
; these work 100%, unlike Vista's which either randomly give "the file fltmgr.sys is
; corrupted" errors or blue screens completely.
fltmgr.inf=20
fltmgr.sys=4
fltlib.dll=2
files\system32\*.*=2,,1
files\system32\drivers\*.*=4,,1
%11%\emptyregdb.dat=2; Required for XPE
[SetupReg.AddReg]
0x4,"ControlSet001\Services\FBWF","Start",0x0
0x4,"ControlSet001\Services\FBWF","Type",0x2
0x4,"ControlSet001\Services\FBWF","ErrorControl",0x1
0x2,"ControlSet001\Services\fbwf","ImagePath","system32\DRIVERS\fbwf.sys"
0x1,"ControlSet001\Services\FBWF","Group","FSFilter System Recovery"
0x1,"ControlSet001\Services\FBWF","DisplayName","File-Based Write Filter"
0x1,"ControlSet001\Services\FBWF","Description","File-Based Write Filter driver"
0x7,"ControlSet001\Services\FBWF","DependOnService","FltMgr"
0x4,"ControlSet001\Services\FBWF","DebugFlags", 0x0
;Only here for completeness - doesnt seem to be needed
;0x4,"ControlSet001\Services\FBWF","EnabledOnAllSkus", 0x1
;Not changeable
0x1,"ControlSet001\Services\FBWF\Instances","DefaultInstance","Fbwf Instance"
0x4,"ControlSet001\Services\FBWF\Instances\Fbwf Instance","Flags", 0x0
;Altitude never changes, so no point messing with it.
0x1,"ControlSet001\Services\FBWF\Instances\Fbwf Instance","Altitude","226000"

:SIZING
;======
;
; 8Mb - This is apparently not possible, the XPe documentation
;     says FBWF sizes are from 16Mb - 1024Mb only.
;       Trying to force it with Target Designer reverts it to 16Mb.
;    To be honest i didnt bother fiddling this low in real world testing.
:
; Valid sizes are:
;
; 0x10 = 16Mb
; 0x18 = 24Mb
; 0x20 = 32Mb
; 0x30 = 48Mb
; 0x40 = 64Mb
; 0x48 = 72Mb
; 0x60 = 96Mb
; 0x80 = 128Mb
; 0x100 = 256Mb
;
; The following line sets the cachesize to 64Mb, theoretically
; you could leave this out and it will still do 64Mb, but
; in my testing, it would revert to 32Mb, not the 64Mb
; according to the documentation.
0x4,"ControlSet001\Services\FBWF","WinPECacheThreshold", 0x40

;CACHING
;=======
;
; "Apparently" you can either Pre-Allocate the cache to full size,
; say 64Mb and it starts off at 64Mb, or you can set it to grow
; dynamically, where it dynamically increases. You can also try
; the dynamically compressed setting, but this may come with a
; performance hit, meaning file access will be slower, but this
; setting is better for lower RAM systems.
;
; 0x1 = "dynamic"
; 0x2 = "dynamic compressed"
; 0x3 = "pre-allocated"
;
; This is with "pre-allocated" caching on.
; i dont know if its the best option, yet.
; I tested all 3 and found no real difference in usability.
0x4,"ControlSet001\Services\FBWF","CacheType", 0x3

; PROTECTION
;==========
;
; Set protection for drives/paths.
; You should set this as ProtectionX,<drive:>,<\Path>
; Any path specified will not allow commits.
;
; By default the systemdrive is automatically protected.
;
; This is just an example....
;
;0x7,"ControlSet001\Services\FBWF\Exclusion", "protection1","C:","\windows"

;FltMgr Stuff
;--------------------------------------------------------------------------------------
0x4,"ControlSet001\Services\FltMgr","Type",0x2
0x4,"ControlSet001\Services\FltMgr","Start",0x3
0x4,"ControlSet001\Services\FltMgr","ErrorControl",0x1
0x2,"ControlSet001\Services\FltMgr","ImagePath","system32\DRIVERS\fltMgr.sys"
0x1,"ControlSet001\Services\FltMgr","DisplayName","FltMgr"
0x1,"ControlSet001\Services\FltMgr","Description","File System Filter Manager Driver"
0x4,"ControlSet001\Services\FltMgr","AttachWhenLoaded",0x0
;--------------------------------------------------------------------------------------
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR","NextInstance",0x1
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Service","FltMgr"
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Legacy",0x1
0x4,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","ConfigFlags",0x0
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","Class","LegacyDriver"
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
0x1,"ControlSet001\Enum\Root\LEGACY_FLTMGR\0000","DeviceDesc","FltMgr"

[AddLine]
"txtsetup.sif","BusExtenders.Load",     "fbwf     = fbwf.sys"
"txtsetup.sif","BusExtenders.Load",     "fltmgr   = fltmgr.sys"
"txtsetup.sif","files.fbwf",     "fbwf.sys,4"
"txtsetup.sif","files.fbwf",     "fbwflib.dll,2"
"txtsetup.sif","files.fbwf",     "fbwfdll.dll,2"
"txtsetup.sif","files.fltmgr",   "fltmgr.sys,4"
"txtsetup.sif","files.fltmgr",   "fltlib.dll,2"

但本人简单用如下的试验，
0x7,"ControlSet001\Services\FBWF\Exclusion","Protection1","B:","\Programs"
发现不功成。定制过Embedded朋友可能对FBWF有较多的了解，在这里能否提供一些信息和技术指导？

[ 本帖最后由 lxl1638 于 2007-9-19 12:18 PM 编辑 ]

lxl1638

如果曾经定制过Embedded的，可能对这一技术有了解，或者手头上有这方面的资料。

无翼鸟飞翔

呃。老九。从字面上看。。好像规定的是保护区域。。也就是不允许更改的区域？
比如你那样的。好像是把b盘和program文件夹定义成只读？！

lxl1638

原帖由 无翼鸟飞翔 于 2007-9-20 12:54 PM 发表
呃。老九。从字面上看。。好像规定的是保护区域。。也就是不允许更改的区域？
比如你那样的。好像是把b盘和program文件夹定义成只读？！

; PROTECTION
;==========
;
; Set protection for drives/paths.
; You should set this as ProtectionX,<drive:>,<\Path>
; Any path specified will not allow commits.
;
; By default the systemdrive is automatically protected.
;
; This is just an example....
;
;0x7,"ControlSet001\Services\FBWF\Exclusion", "protection1","C:","\windows"

本人是这样理解的：所谓保护区域就FBWF作用的区域，FBWF起作用后，该区域的一切文件更改都是在内存进行。
蓝字部分是不是这个意思：系统驱动器(X盘)是自动默认的保护区域？

wblam

自己看不懂。这里有16页的讨论。可能对你有帮助。


http://www.911cd.net/forums//ind ... 282&hl=fbwf.inf

无翼鸟飞翔

有这种可能。。。。呃。莫非他不认ramdisk生成的B盘。。那么制定一个已存在的物理分区的话。能不能实现呢？？。。现在朋友家。没条件。。明天回家了试试。。比如定义到硬盘上真实存在的D:\TOOL看看。。。

uepon

不知有什么实用价值。

lxl1638

原帖由 uepon 于 2007-9-23 02:58 PM 发表
不知有什么实用价值。

如果能实现，可以将所有的工具挂到B盘，且能动态挂载，即可以随时UnMount一个WIM，再MOUNT别一个WIM，或者随时以增加的方式MOUNT上不同的WIM。另外也可以解决某些程序读写本身目录的问题(911的B盘是只读的，因为WIM只读，只能以只读方式挂上；当B盘能开FBWF后，即使是只读挂载，程序所处的目录也是可写的)。

sansa520

轶微???
都是你自己的作品吗?
还是只是这里改改?那里改改的?

lee88889999

在Feature Pack 2007里面，微软还加入了FBWF（File Based Write Filter）的技术，让用户可以封装系统盘，并且开放制定的目录进行写操作。
http://bbs.wuyou.net/forum.php?mod=viewthread&tid=114078&extra=page%3D1

在这帖子里发现的，“似乎”这两个字可以删除了，现在只剩下设置的疑问。
如果能运用到目录，会解决很多问题，再不用把某些程序放到可写盘运行了。

lzyyj

既然 Windows 可以加载到内存磁盘, 为什么不能将加载后不再使用的的文件删除, 并适当扩大该虚拟磁盘的容量, 直接使用该虚拟磁盘呢, 有人尝试过这样做吗!
其实, 使用虚拟磁盘的原因就是需要一个肯定能随时能读写的一个磁盘空间,

无翼鸟飞翔

ls的没用过PE？现在的pe基本都有你说的功能。。

klanlyjp

msdn上對exclusion的注解是..

The following table shows the functions that are used to manage files excluded within a protected volume.http://msdn2.microsoft.com/en-us/library/aa940918.aspx
應該可理解成"保護之外", 即不受fbwf保護而能實寫入的文件/文件夾.. 個人感覺fbwf是個類似"影子系統"的東西..

將保護擴展到其他分區或許該研究下FbwfProtectVolume函數..

天风

FBWF类似于EWF，增加了目录过滤功能！
老九可以通过FBWF的帮助信息可看到！

有一年多没作了！
记不清了！

无翼鸟飞翔

To get help for each individual command, for example, "/addvolume",
enter the following command:
     FbwfMgr /help /addvolume
101 FbwfMgr /displayconfig
   Displays the file-based write filter configuration for the current and
   next session.
102 FbwfMgr /displayconfig
   Displays the list of files and directories that are modified, along with
   the size of memory used by the write filter to cache the modified data
   of the file or directory and the number of open handles to it.
103 FbwfMgr /enable
   Enables the file-based write filter for the next session. The state of
   the write filter during the current session is not changed.
104 FbwfMgr /disable
   Disables the file-based write filter for the next session. The state of
   the write filter during the current session is not changed.
105 FbwfMgr /addvolume volumename
   Protects the specified volume for the next session. The protection state
   of the volume during the current session is not changed.
   The volume name can either be a volume device name, for example,
   \Device\HarddiskVolume1, case insensitive, or a drive letter, for example,
   C: or D:. The name is NOT the volume label that Windows Explorer displays
   before the drive letter.
   Note that the volume must exist. Otherwise, an error message "The system
   cannot find the drive specified." will be displayed.
106 FbwfMgr /removevolume volumename 1|0
   Unprotects the specified volume for the next session. The protection state
   of the volume during the current session is not changed.
   The volume name can either be a volume device name, for example,
   \Device\HarddiskVolume1, case insensitive, or a drive letter, for example,
   C: or D:. The name is NOT the volume label that Windows Explorer displays
   before the drive letter.
   The option 1 after the volume name indicates that all exclusion lists
   associated with the volume will be lost after the reboot. The option 0
   after the volume name indicates that all exclusion lists associated with
   the volume will be saved after the reboot, and should the volume be
   protected again, those exclusion lists would be automatically added to
   the volume.
   Note that the volume must be in the protection list for the next session
   when the command is invoked. Otherwise, an error message "The system
   cannot find the drive specified." will be displayed.
107 FbwfMgr /addexclusion volumename file_or_dir_path
   Adds the file or the directory to the exclusion list of the volume. The
   exclusion will take effect after the next reboot.
   The volume name can either be a volume device name, for example,
   \Device\HarddiskVolume1, case insensitive, or a drive letter, for example,
   C: or D:. The name is NOT the volume label that Windows Explorer displays
   before the drive letter.
   The file or directory path must be an absolute path starting with "\".
   Note that the volume must be in the protection list for the next session
   when the command is invoked. Otherwise, an error message "The system
   cannot find the drive specified." will be displayed.
108 FbwfMgr /removeexclusion volumename file_or_dir_path
   Removes the file or the directory from the exclusion list of the volume.
   The removal of the exclusion will take effect after the next reboot.
   The volume name can either be a volume device name, for example,
   \Device\HarddiskVolume1, case insensitive, or a drive letter, for example,
   C: or D:. The name is NOT the volume label that Windows Explorer displays
   before the drive letter.
   The file or directory path must be an absolute path starting with "\".
   Note that the volume must be in the protection list for the next session
   when the command is invoked. Otherwise, an error message "The system
   cannot find the drive specified." will be displayed.
109 FbwfMgr /commit volumename file_path
   Commits the changes made to the file to the underlying media.
   The volume name can either be a volume device name, for example,
   \Device\HarddiskVolume1, case insensitive, or a drive letter, for example,
   C: or D:. The name is NOT the volume label that Windows Explorer displays
   before the drive letter.
   The file path must be an absolute path starting with "\". It must be a
   file and must exist.
   Note that the volume must currently be protected. Otherwise, an error
   message "The system cannot find the drive specified." will be displayed.
110 FbwfMgr /commit volumename file_path
   Discards the changes made to the file, that is, restores the files to its
   orignial contents from the underlying media.
   The volume name can either be a volume device name, for example,
   \Device\HarddiskVolume1, case insensitive, or a drive letter, for example,
   C: or D:. The name is NOT the volume label that Windows Explorer displays
   before the drive letter.
   The file path must be an absolute path starting with "\". It must be a
   file. It is OK that the file is deleted, in which case, it will be recovered.
   Note that the volume must currently be protected. Otherwise, an error
   message "The system cannot find the drive specified." will be displayed.
111 FbwfMgr /setthreshold threshold
   Sets the cache threshold (in Megabytes) for the write filter. The new
   threshold will take effect after the next reboot
112 FbwfMgr /setcompression 1|0
   Sets the compression state for the write filter. The new compression
   state will take effect after the next reboot
   The option 1 indicates the compression will be enabled, and option 0
   indicates the compression will be disabled.
   Note that if cache compression is enabled, cache pre-allocation will
   automatically be disabled.
113 FbwfMgr /setpreallocation 1|0
   Sets the cache allocation state for the write filter. The new cache
   allocation state will take effect after the next reboot
   The option 1 indicates the cache will be pre-allocated, and option 0
   indicates the cache will not be pre-allocated.
   Note that if cache pre-allocation is enabled, cache compression will
   automatically be disabled.

[ 本帖最后由 无翼鸟飞翔 于 2007-10-22 10:53 PM 编辑 ]

chnhhwz

这个课题的意义重大
如果成功再也不用为WIM的可写费脑筋了

可惜我不懂
只有等高手解决以后用现成的了

不过貌似新版的PECMD出来以后
已经解决可写问题了？
感觉比挂在B盘要好些
毕竟少用一个盘符
看上去清爽许多

haonan

用天风原来发布的fbwf在xp下可以实现对任意分区开启缓存，不过似乎32位系统下只能写入100多m的文件，64位系统无此限制，1g都能写

carrison

http://www.911cd.net/forums//lofiversion/index.php?t15282.html

doosan1019

不知道啊，本人纯菜鸟，呵呵

hhh333

不使用B盘，将wim直接挂接到系统盘X：中不就解决这个问题了？

iceleafage

路过，看一下，学习中

macl

微软专为PE系统定制的系统保护还原技术，不久前看到PE2.0 的资料解释过，在微软官网上，那个地址是从邮件里得知的。

yup282

太高深了～只有支持下～

katar1024

好象有冲突哎，FltMgr和FBWF两个驱动同时加载PE会蓝屏挂掉
不过看起来FBWF的功能很不错哦

ltwjqd

谢谢！谢谢！谢谢！！！
支持！！！！！！！！！！！！！！！

liysandtixy

大家一起想想办法，看看有好的方法没有

happymy

MXP(XPE非内存盘)FBWF用了很久了。
http://bbs.wuyou.net/forum.php?mod=viewthread&tid=126780&extra=page%3D1

如果集成FBWFMGR就方便了。
偶写的控制台命令指南。
FBWF控制台命令指南。
http://bbs.wuyou.net/forum.php?mod=viewthread&tid=129709&extra=page%3D1

我对FBWF比较熟悉，大家尽管问：）

建议自己提取FBWF正式版本的文件。
虽然FP07的commit不支持新建立的文件。但是这个版本稳定性好（毕竟是正式版本的，这个在XPE MXP测试的结果，不是PE！，PE我没测试）。

[ 本帖最后由 happymy 于 2008-9-11 16:00 编辑 ]

lswuyouls

值得讨论与研究