请问下有没有办法用批处理或者命令行小程序确定系统引导分区？

plusv

CodeHz 发表于 2021-1-6 18:54
通过逆向 bcdedit 我找到了如下几个可能相关的，但是没文档的 api ：
NtEnumerateBootEntries
NtQueryBoo ...

NtEnumerateBootEntries(
  OUT PVOID Buffer,
  IN OUT PULONG BufferLength
  );

Routine Description:

    This function returns a list of all existing boot entries.

    N.B. This service requires the system environment privilege.

Arguments:

    Buffer - Supplies the address of the buffer that is to receive the
        returned data. The returned data is a sequence of BOOT_ENTRY_LIST
        structures.

    BufferLength - On input, supplies the length in bytes of the buffer.
        On output, returns the length in bytes of the returned data.
        If the input buffer is large enough, then BufferLength indicates
        the amount of data copied into Buffer. If the input buffer
        is too small, then BufferLength indicates the required buffer length.

Return Value:

    STATUS_SUCCESS              The function succeeded.
    STATUS_BUFFER_TOO_SMALL     The input buffer was too small.
    STATUS_INVALID_PARAMETER    One of the parameters is invalid.
    STATUS_NOT_IMPLEMENTED      This function is not supported on this platform.
    STATUS_UNSUCCESSFUL         The firmware returned an unrecognized error.
    STATUS_PRIVILEGE_NOT_HELD   The caller does not have the required privilege.
    STATUS_ACCESS_VIOLATION     One of the input parameters cannot be read,
                                or one of the output parameters cannot be written.

==================================================================================
NtQueryBootOptions(
  OUT PBOOT_OPTIONS BootOptions,
  IN OUT PULONG BootOptionsLength
  );

Routine Description:

    This function returns the system's global boot options.

    N.B. This service requires the system environment privilege.

Arguments:

    BootOptions - Supplies the address of the buffer that is to receive the
        returned data.

    BootOptionsLength - On input, supplies the length in bytes of the buffer.
        On output, returns the length in bytes of the returned data.
        If the input buffer is large enough, then BootOptionsLength indicates
        the amount of data copied into BootOptions. If the input buffer
        is too small, then BootOptionsLength indicates the required buffer
        length.

Return Value:

    STATUS_SUCCESS              The function succeeded.
    STATUS_BUFFER_TOO_SMALL     The input buffer was too small.
    STATUS_INVALID_PARAMETER    One of the parameters is invalid.
    STATUS_NOT_IMPLEMENTED      This function is not supported on this platform.
    STATUS_UNSUCCESSFUL         The firmware returned an unrecognized error.
    STATUS_PRIVILEGE_NOT_HELD   The caller does not have the required privilege.
    STATUS_ACCESS_VIOLATION     One of the input parameters cannot be read,
                                or one of the output parameters cannot be written.
==================================================================================
NtQueryBootEntryOrder(
  OUT PULONG Ids,
  IN OUT PULONG Count
  );

Routine Description:

    This function returns the system boot order list.

    N.B. This service requires the system environment privilege.

Arguments:

    Ids - Supplies the address of the buffer that is to receive the
        returned data. The returned data is an array of ULONG boot
        entry identifiers.

    Count - On input, supplies the length in ULONGs of the buffer.
        On output, returns the length in ULONGs of the returned data.
        If the input buffer is large enough, then Count indicates
        the amount of data copied into Buffer. If the input buffer
        is too small, then Count indicates the required buffer length.

Return Value:

    STATUS_SUCCESS              The function succeeded.
    STATUS_BUFFER_TOO_SMALL     The input buffer was too small.
    STATUS_INVALID_PARAMETER    One of the parameters is invalid.
    STATUS_NOT_IMPLEMENTED      This function is not supported on this platform.
    STATUS_UNSUCCESSFUL         The firmware returned an unrecognized error.
    STATUS_PRIVILEGE_NOT_HELD   The caller does not have the required privilege.
    STATUS_ACCESS_VIOLATION     One of the input parameters cannot be read,
                                or one of the output parameters cannot be written.

plusv

查了 Google
可能有用的 API

NtAddBootEntry
NtDeleteBootEntry
NtModifyBootEntry
NtEnumerateBootEntries

NtQueryBootEntryOrder
NtQueryBootOptions

NtSetBootEntryOrder
NtSetBootOptions

plusv

CodeHz 发表于 2021-1-7 13:33
继续研究了一下，似乎就是\Device\SystemPartition这个路径对应引导分区，至少在我这里是这样的。。。（关 ...

Windows 7 X64 完整版,
没有这些符号链接.

plusv

WuYou 从昨晚到现在都很卡,
网速只有 0.000-0.030 Mbps,
传个 78 KB 小图都很久,
快晕了.

plusv

CodeHz 发表于 2021-1-7 13:46
在GLOBAL??下找找看有没有对应的（直接按符号链接排序，找找有没有对应引导分区且有显著标志的

也是没有.

WuYou 从昨晚到现在都很卡,
网速只有 0.000-0.030 Mbps,
不传图了

plusv

CodeHz 发表于 2021-1-7 13:51
我这边GLOBAL??里磁盘相关的有这些项目

也是没有.

plusv

CodeHz 发表于 2021-1-15 15:17
我认为根本不用检测，直接尝试两个路径（sysnative, system32）就好了

反应一个小问题

SmartMountFirmware X64 多了一个 pdata 区段,
删了运行也正常,还省了 512 Bytes.