老外出了新的WIN8 BOOTMGR解压工具，有谁试一下

一只猴子

之前迷离大大的修改方法：http://bbs.wuyou.net/forum.php?mod=viewthread&tid=211314&extra=page%3D1
====================我是分割线============================================
刚才跟迷离大大在QQ里问了一下对于PRE-M3 6.2.7955.0以后的BOOTMGR怎么破解，他说老外已经有新的工具了，但是不知道怎么用。
下面附上迷离大大的说明图片

老外论坛的地址：
http://reboot.pro/files/file/188-bootmgr-recompiler/
帖子：http://reboot.pro/16824/、
附上一部分帖子内容:

In Windows 8 many things changed, including bootmgr. Previously, bootmgr was compressed with lznt1, but is now compressed withXpress Huffman. I have previously described how to modify the Windows 7 and previous versions:http://reboot.pro/fi...ls-bootmgrntfs/
For the new compression I made a separate program;http://www.mediafire...3d3jb8a9f13dytr(outdated)
Update version 2, 20.05.12: A program to recompile bootmgr.exe into bootmgr, ready for booting:http://reboot.pro/fi...mgr-recompiler/or[url=http://www.mediafire...d9pyrn578bvxbww]http://www.mediafire...d9pyrn578bvxbww[/url]
It uses RtlCompressBuffer and RtlGetCompressionWorkSpaceSize in ntdll.dll. The parameters are supplied through an inputbox, and is the CompressionFormatAndEngine bitmask. It can be supplied in decimal or in hex (prefixed with 0x). Obviously, you must run the attached program in Windows 8, unless you just want compression with LZNT1. Explanation of the possible valid parameters:
COMPRESSION_FORMAT_NONE=0x0000 COMPRESSION_FORMAT_DEFAULT=0x0001 COMPRESSION_FORMAT_LZNT1=0x0002 COMPRESSION_FORMAT_XPRESS=0x0003 COMPRESSION_FORMAT_XPRESS_HUFF=0x0004 COMPRESSION_ENGINE_STANDARD=0x0000 COMPRESSION_ENGINE_MAXIMUM=0x0100
So to compress with Xpress Huffman supply either 260 or 0x104.
Basic structure of bootmgr:
1.16-bit stubwithcode to unpack,evaluateandexecute the compressed part.About2xKB. 2.A16bytesectionwithsome information that the16-bit stub evaluates 3.A tiny8192bytePE image,withunknownfunction.It's content is not evaluated. 4. The compressed 32-bit executable bootmgr.exe
This is in accordance with previous versions, but with the main difference being the compression engine used on the 32-bit executable. Another small difference is the small section right before the tiny PE image. Take a look at this image:

工具的一部分图片：

这个好像是工具说明：

BOOTMGR Recompiler
This tool takes bootmgr.exe and creates bootmgr ready for booting. You can choose between compression method LZNT1 and XpressHuffman. You can also choose which library to use for the compression, either MSCompression.dll an excellent library by Jeffrey Bush, or the Windows shipped ntdll.dll. Note that ntdll.dll supports LZNT1 on any Windows version, whereas XpressHuffman support is only present on ntdll.dll on Windows 8. You can however copy ntdll.dll from Windows 8 and to XP/Vista etc (to same directory as this tool), to overcome this. The MSCompression.dll library supports both methods, and is included in this download. But currently I had some issues with the 32-bit compiled version of this library, so the option on x86 arch OS is to use ntdll.dll. The tool also performs some basic PE testing, and for instance optionally corrects the PE checksum if found incorrect. It does not matter which version of bootmgr.exe you choose or compression method. All generated bootmgr combinations should work fine. The XpressHuffman compressed ones, are much smaller in size than the LZNT1 ones, because of better compression ratio.

Structure of BOOTMGR
1. 16-bit stub with code to unpack, evaluate and execute the compressed part. About 2x KB.
2. A 16 byte section with some information that the 16-bit stub evaluates.
3. A tiny 8192 byte PE image, with unknown function. It's content is not evaluated.
4. The compressed 32-bit executable bootmgr.exe

The 16 byte sectioncontains these values:
byte 1-4: a signature.
byte 5-8: the compressed size of bootmgr.exe.
byte 9-12: the uncompressed size of bootmgr.exe.
byte 13-16: the relative offset to the compressed data calculated from the start of this section (ie the signature).

More detailed information connected to this topic that you may find useful:
http://reboot.pro/16824/
http://reboot.pro/fi...ls-bootmgrntfs/
http://www.sevenforu...indows-7-a.html

MSCompression
https://github.com/c...ife/ms-compress
The included program is a frontend for the library, and strictly not used with the above application. I just included it, since the library is included, in case someone needed it. It's a commandline compressor/decompressor supporting. The library supports these compression methods;
COMPRESSION_NONE=0 COMPRESSION_LZX=1 COMPRESSION_LZNT1=2 COMPRESSION_XPRESS=3 COMPRESSION_XPRESS_HUFF=4
The MSCompression library has a slightly better compression ratio than ntdll.dll when using XpressHuffman

由于迷离大大很忙，所以有可能他没有时间发破解修改的方法
再次附上地址。。。
http://reboot.pro/files/file/188-bootmgr-recompiler/
http://reboot.pro/16824/
有能力的去搞定吧。。我这里没WIN8

更新下，迷离大大说这段到底是怎么修改的：

1. At VA 401263 change these 6 bytes:
   
2. 0f8862020000 -> 909090909090
   
3. At VA 42935e change these 2 bytes:
   
4. 7415 -> eb15

复制代码

[ 本帖最后由 一只猴子 于 2012-8-8 23:03 编辑 ]

迷离境界

外国朋友已经知道WIN8 BOOTMGR的压缩方式，并更新那个破解压缩、解压BOOTMGR的工具为V2版，下载地址：http://reboot.pro/files/file/188-bootmgr-recompiler/
大家有兴趣就一起玩玩，研究下......看一楼帖子里老外的帖子.....

[ 本帖最后由 迷离境界 于 2012-8-8 23:13 编辑 ]

一只猴子

貌似只有我一个人在奋斗。。
用MScompression，怎么都解压不到。。

一只猴子

自己顶一下~~~~~~~~

一只猴子

继续自己顶。。。。。

拿铁不加糖

MScompression这个程序怎么用啊！运行它就出来图中的那个解释。

一只猴子

不是直接运行，要在CMD下。
解压的话：
MScompression -d X(这个X是数字，代表算法） %CD%\bootmgr %CD%\bootmgr.exe
上面的第一个%CD%\bootmgr为待解压的文件，第二个%CD%\bootmgr.exe为解压出来的文件

拿铁不加糖

试了一下，还是提示错误。我觉得适合这个文件有关系MSCompression.dll。注册这个dll文件提示错误“已加载MSCompression.dll,但没有找到DllRegisterServer输入点”

sratlf

1. 
   
2. At VA 401263 change these 6 bytes:
   
3. 0f8862020000 -> 909090909090
   
4. At VA 42935e change these 2 bytes:
   
5. 7415 -> eb15
   

复制代码

意思应该是 将 偏移量0x401263 开始的6个字节 0f8862020000  改成  909090909090

将 偏移量0x42935e 开始的2个字节  7415  改成  eb15

迷离境界

原帖由 sratlf 于 2012-8-9 19:52 发表

At VA 401263 change these 6 bytes:
0f8862020000 -> 909090909090
At VA 42935e change these 2 bytes:
7415 -> eb15


意思应该是 将 偏移量0x401263 开始的6个字节 0f8862020000  改成  9090909 ...

这个意思大概知道，但什么软件打开的可以看到这个偏移量.....

sratlf

winhex就可以啊   快捷键是alt+g  输入你要跳转到的偏移量就可以了

快雪时晴

http://bbs.wuyou.net/forum.php?m ... p;extra=&page=1

一只猴子

那个方法对现在WIN8的BOOTMGR已经没有效果了。所以才发新的

迷离境界

原帖由 sratlf 于 2012-8-9 20:25 发表
winhex就可以啊   快捷键是alt+g  输入你要跳转到的偏移量就可以了

额...怪我表达不清楚....
意思是貌似winhex 、uedit32 之类的打开BOOTMGR没看到那么多的偏移量啊...就算是解开BOOTMGR也不一定有那么多啊...
是不是用什么汇编之类的软件来打开编辑呢？