无忧启动论坛

 找回密码
 注册
搜索
系统gho:最纯净好用系统下载站广告联系 微信:wuyouceo QQ:184822951
查看: 3866|回复: 14

[分享] PE添加64位写字板wordpad.exe组件需要的文件列表和注册表(基于WinRE制作的骨头版pe)

[复制链接]
发表于 2021-12-20 00:21:42 | 显示全部楼层 |阅读模式
本帖最后由 sairen139 于 2022-1-4 18:16 编辑

PE添加64位写字板wordpad.exe组件需要的文件列表和注册表(基于WinRE制作的骨头版pe)

写字板wordpad.exe程序被Word的光芒遮掩了很久,但写字板程序其实在pe里如果不想安装大型体积的Word还是有些用处的。
因为写字板可以创建和打开以及修改docx和rtf和odt格式,这几个富文本格式都是比较流行的富文本格式!

这篇教程就是给所有文件都取自WinRE的体积仅有88mb的骨头网络版,添加64位的wordpad.exe写字板组件程序。
第一步离线给所有文件都取自WinRE的骨头网络版pe的config文件夹里的software注册表配置文件添加注册表片段内容如下:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{0F7434B6-59B6-4250-999E-D168D6AE4293}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{32665929-D77E-4ab5-8C08-FBF409B8A233}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{926749fa-2615-4987-8845-c33e65f2b957}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"



[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}]
@="rtf persistent handler"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{e2403e98-663b-4df6-b234-687789db8560}"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{3037B4CD-A40B-401B-B676-2017EE8FAFF4}]
@="Wordpad DOCX Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{3037B4CD-A40B-401B-B676-2017EE8FAFF4}\InprocServer32]
@="X:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{6047F837-D527-467E-9DC1-6D51F92D9E45}]
@="Wordpad ODT Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{6047F837-D527-467E-9DC1-6D51F92D9E45}\InprocServer32]
@="X:\\Program Files\\Windows NT\\Accessories\\WordpadFilter.dll"
"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}]
@="Wordpad OOXML Document Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{3037B4CD-A40B-401B-B676-2017EE8FAFF4}"

[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}]
@="Wordpad ODT Document Filter"
[HKEY_LOCAL_MACHINE\pe-software\Classes\CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{6047F837-D527-467E-9DC1-6D51F92D9E45}"



[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.docx]
@="docxfile"
"PerceivedType"="document"
[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.docx\OpenWithList\WordPad.exe]
@=""
[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.docx\PersistentHandler]
@="{698A4FFC-63A3-4E70-8F00-376AD29363FB}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile]
@="OOXML Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,32,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell]

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\print\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\printto\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,\
  00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,\
  22,00,00,00



[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt]
@="odtfile"
"PerceivedType"="document"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\PersistentHandler]
@="{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}"





[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile]
@="ODF Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\open]

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\print\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\printto\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,\
  00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,\
  22,00,00,00



[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf]
@="rtffile"
"PerceivedType"="document"

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\PersistentHandler]
@="{2e2294a9-50d7-4fe7-a09f-e6492e185884}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile]
@="Rich Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\CLSID]
@="{73FDDC80-AEA9-101A-98A7-00AA00374959}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell]

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell\print\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\shell\printto\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,2f,00,70,00,74,00,20,00,22,00,25,00,31,00,22,00,20,00,22,\
  00,25,00,32,00,22,00,20,00,22,00,25,00,33,00,22,00,20,00,22,00,25,00,34,00,\
  22,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\rtffile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}]
@="{a42c2ccb-67d3-46fa-abe6-7d2f3488c7a3}"



第二步给骨头版pe增加下列64位写字板wordpad.exe组件程序的依赖文件48个即可:
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\WordpadFilter.dll
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\shellstyle.dll
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\OpcServices.dll
\Windows\SYSTEM32\ADVAPI32.dll
\Windows\SYSTEM32\bcrypt.dll
\Windows\SYSTEM32\bcryptPrimitives.dll
\Windows\SYSTEM32\combase.dll
\Windows\SYSTEM32\COMDLG32.dll
\Windows\SYSTEM32\dwmapi.dll
\Windows\SYSTEM32\GDI32.dll
\Windows\SYSTEM32\gdi32full.dll
\Windows\SYSTEM32\iertutil.dll
\Windows\SYSTEM32\IMM32.DLL
\Windows\SYSTEM32\kernel.appcore.dll
\Windows\SYSTEM32\KERNEL32.DLL
\Windows\SYSTEM32\KERNELBASE.dll
\Windows\SYSTEM32\MFC42u.dll
\Windows\SYSTEM32\MSCTF.dll
\Windows\SYSTEM32\MSFTEDIT.DLL
\Windows\SYSTEM32\msvcp_win.dll
\Windows\SYSTEM32\msvcrt.dll
\Windows\SYSTEM32\msxml3.dll
\Windows\SYSTEM32\ntdll.dll
\Windows\SYSTEM32\ntmarta.dll
\Windows\SYSTEM32\OLE32.dll
\Windows\SYSTEM32\oleacc.dll
\Windows\SYSTEM32\OLEAUT32.dll
\Windows\SYSTEM32\PROPSYS.dll
\Windows\SYSTEM32\RPCRT4.dll
\Windows\SYSTEM32\sechost.dll
\Windows\SYSTEM32\shcore.dll
\Windows\SYSTEM32\SHELL32.dll
\Windows\SYSTEM32\SHLWAPI.dll
\Windows\SYSTEM32\TextShaping.dll
\Windows\SYSTEM32\ucrtbase.dll
\Windows\SYSTEM32\urlmon.dll
\Windows\SYSTEM32\USER32.dll
\Windows\SYSTEM32\uxtheme.dll
\Windows\SYSTEM32\win32u.dll
\Windows\SYSTEM32\windows.storage.dll
\Windows\SYSTEM32\windowscodecs.dll
\Windows\SYSTEM32\WINMM.dll
\Windows\SYSTEM32\WINSPOOL.DRV
\Windows\SYSTEM32\wintypes.dll
\Windows\SYSTEM32\Wldp.dll
\Windows\SYSTEM32\WS2_32.dll
\Windows\SYSTEM32\XmlLite.dll

PS:至于这些依赖dll文件相对应的\Windows\System32\zh-CN文件夹里的语言配置文件请对照dll自行添加mui后缀的语言文件即可!


还有一个可加可不加的\Windows\write.exe是用来启动wordpad.exe写字板程序用的,不加也不影响写字板的使用!

64位wordpad写字板运行的离线注入RE的关键注册表和格式关联.reg.TXT

10.98 KB, 下载次数: 12, 下载积分: 无忧币 -2

64位wordpad写字板运行的离线注入RE的关键注册表和格式关联.reg

64位wordpad写字板程序48个依赖文件SYSTEM32下zh-CN目录里的配套语言文件请自己添加.txt

1.65 KB, 下载次数: 12, 下载积分: 无忧币 -2

64位wordpad写字板程序48个依赖文件SYSTEM32下zh-CN目录里的配套语言文件请自己添加.txt

SoftMaker办公三件套Office纯64位用.7z.001.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.002.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.003.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.004.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.005.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.006.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.007.ZIP

4 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

SoftMaker办公三件套Office纯64位用.7z.008.ZIP

3.37 MB, 下载次数: 0, 下载积分: 无忧币 -2

SoftMaker办公三件套去掉最后的.ZIP解压后离线导入pe使用

 楼主| 发表于 2021-12-20 00:22:50 | 显示全部楼层
本帖最后由 sairen139 于 2021-12-20 14:19 编辑

WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖共7个文件和离线注册表reg片段:
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\WordpadFilter.dll
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\shellstyle.dll
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\UIRibbon.dll\zh-CN\UIRibbon.dll.mui

wordpad写字板组件install里提取的7个文件和离线导入注册表片段.zip

2.98 MB, 下载次数: 22, 下载积分: 无忧币 -2

wordpad写字板组件install里提取的7个文件和离线导入的注册表片段

点评

\Program Files\Windows NT\Accessories\WordpadFilter.dll 这个文件似乎也可以删掉不影响写字板的正常使用!  详情 回复 发表于 2021-12-20 09:06
回复

使用道具 举报

发表于 2021-12-20 08:24:00 | 显示全部楼层
谢谢分享
回复

使用道具 举报

 楼主| 发表于 2021-12-20 09:06:00 | 显示全部楼层
本帖最后由 sairen139 于 2021-12-22 21:59 编辑
sairen139 发表于 2021-12-20 00:22
WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖共7个文件和离线注册表reg片段:
\Program F ...

\Program Files\Windows NT\Accessories\WordpadFilter.dll
这个文件似乎也可以删掉不影响写字板的正常使用!




给88mb骨头版pe增加下列64位写字板wordpad.exe组件程序的依赖文件5个即可:
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\OpcServices.dll
\Windows\SYSTEM32\MFC42u.dll
\Windows\SYSTEM32\MSFTEDIT.DLL


右键新建菜单能直接生成docx和RTF文档的添加wordpad写字板组件所需的注册表如下:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{0F7434B6-59B6-4250-999E-D168D6AE4293}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{32665929-D77E-4ab5-8C08-FBF409B8A233}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\CLSID\{926749fa-2615-4987-8845-c33e65f2b957}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,55,00,49,00,\
  52,00,69,00,62,00,62,00,6f,00,6e,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"



[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx\ShellNew]
"NullFile"=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx]
"PerceivedType"="document"
@="docxfile"

[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.docx\PersistentHandler]
@="{698A4FFC-63A3-4E70-8F00-376AD29363FB}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile]
@="OOXML Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,32,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\docxfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00


[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\ShellNew]
"Data"="{\\rtf1}"
"ItemName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\
  69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,\
  69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,\
  00,58,00,45,00,2c,00,2d,00,32,00,31,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf]
"PerceivedType"="document"
@="rtffile"

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-software\Classes\.rtf\PersistentHandler]
@="{2e2294a9-50d7-4fe7-a09f-e6492e185884}"

[HKEY_LOCAL_MACHINE\pe-software\Classes\rtffile]
@="Rich Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe-software\Classes\rtffile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-software\Classes\rtffile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00




[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt]
@="odtfile"
"PerceivedType"="document"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\.odt\PersistentHandler]
@="{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}"

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile]
@="ODF Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,33,00,30,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe-SOFTWARE\Classes\odtfile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00





WordPad写字板依赖文件注册表生效三条和配置.7z

3.97 MB, 下载次数: 6, 下载积分: 无忧币 -2

WordPad写字板依赖文件注册表生效三条和配置

回复

使用道具 举报

发表于 2021-12-20 19:56:08 | 显示全部楼层
这个非常好,为什么不制作一个绿色版的wordpad呢?改天按你的方法,试一下制作,然后在各PE中测试改进。

点评

很好的想法,做好了 @ 我 楼主 研究 很有意义 感觉 guid 是 间接地 引用依赖 文件 如果是 这样的 话,是不是 画图 计算器,也能呢  详情 回复 发表于 2021-12-21 21:05
回复

使用道具 举报

 楼主| 发表于 2021-12-21 15:39:51 | 显示全部楼层
[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\ShellNew]
"NullFile"=""

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf]
"PerceivedType"="document"
@="rtffile"

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\OpenWithList]

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\PersistentHandler]
@="{2e2294a9-50d7-4fe7-a09f-e6492e185884}"

[HKEY_LOCAL_MACHINE\pe_software\Classes\.rtf\ShellNew]
"Data"="{\\rtf1}"
"ItemName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,\
  69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,\
  00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,\
  69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,\
  00,58,00,45,00,2c,00,2d,00,32,00,31,00,33,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile]
@="Rich Text Document"
"AllowSilentDefaultTakeOver"=""
"EditFlags"=dword:00200000
"FriendlyTypeName"=hex(2):40,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,\
  00,46,00,69,00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,\
  77,00,73,00,20,00,4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,\
  00,72,00,69,00,65,00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,\
  2e,00,45,00,58,00,45,00,2c,00,2d,00,31,00,39,00,30,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\CLSID]
@="{73FDDC80-AEA9-101A-98A7-00AA00374959}"

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\DefaultIcon]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,2c,00,31,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\shell]

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\shell\open]

[HKEY_LOCAL_MACHINE\pe_software\Classes\rtffile\shell\open\command]
@=hex(2):22,00,25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,\
  00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,\
  4e,00,54,00,5c,00,41,00,63,00,63,00,65,00,73,00,73,00,6f,00,72,00,69,00,65,\
  00,73,00,5c,00,57,00,4f,00,52,00,44,00,50,00,41,00,44,00,2e,00,45,00,58,00,\
  45,00,22,00,20,00,22,00,25,00,31,00,22,00,00,00

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx]
"PerceivedType"="document"
@="docxfile"

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\OpenWithList]

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\OpenWithList\WordPad.exe]
@=""

[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\PersistentHandler]
@="{698A4FFC-63A3-4E70-8F00-376AD29363FB}"

点评

如果加了右键菜单直接创建生成docx文件和rtf文件,其实下面这个\Windows\SYSTEM32\shellstyle.dll依赖文件也可以删除。因为除了另存为其它格式这个\Windows\SYSTEM32\shellstyle.dll对wordpad正常使用几乎没影响。  详情 回复 发表于 2021-12-22 18:48
回复

使用道具 举报

发表于 2021-12-21 21:05:26 | 显示全部楼层
zds1210 发表于 2021-12-20 19:56
这个非常好,为什么不制作一个绿色版的wordpad呢?改天按你的方法,试一下制作,然后在各PE中测试改进。

很好的想法,做好了 @

楼主 研究 很有意义

感觉 guid 是 间接地 引用依赖 文件
如果是 这样的 话,是不是  画图  计算器,也能呢

点评

有空放出成品来玩玩。在不带网络的PE下测试效果如何。  详情 回复 发表于 2021-12-21 23:13
应该是差不多,在PE下一般就补注册项,补dll控件就行了。  详情 回复 发表于 2021-12-21 23:13
回复

使用道具 举报

发表于 2021-12-21 23:13:24 | 显示全部楼层
2011whp 发表于 2021-12-21 21:05
很好的想法,做好了 @ 我

楼主 研究 很有意义

应该是差不多,在PE下一般就补注册项,补dll控件就行了。
回复

使用道具 举报

发表于 2021-12-21 23:13:59 | 显示全部楼层
2011whp 发表于 2021-12-21 21:05
很好的想法,做好了 @ 我

楼主 研究 很有意义

请放出成品来玩玩。在不带网络的PE下测试效果如何。
回复

使用道具 举报

 楼主| 发表于 2021-12-22 18:48:38 | 显示全部楼层
sairen139 发表于 2021-12-21 15:39
[HKEY_LOCAL_MACHINE\pe_software\Classes\.docx\ShellNew]
"NullFile"=""

如果加了右键菜单直接创建生成docx文件和rtf文件,其实下面这个\Windows\SYSTEM32\shellstyle.dll依赖文件也可以删除。因为除了另存为其它格式这个\Windows\SYSTEM32\shellstyle.dll对wordpad正常使用几乎没影响。

点评

如果配合右键创建生成rtf和docx菜单注册表及wordpad必须的注册表,那么只要下面这样添加文件就足够使用了: WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖总共5个文件就能使用: \Program Files\Wi  详情 回复 发表于 2021-12-22 19:10
回复

使用道具 举报

 楼主| 发表于 2021-12-22 19:10:33 | 显示全部楼层
sairen139 发表于 2021-12-22 18:48
如果加了右键菜单直接创建生成docx文件和rtf文件,其实下面这个\Windows\SYSTEM32\shellstyle.dll依赖文 ...

如果配合右键创建生成rtf和docx菜单注册表及wordpad必须的注册表,那么只要下面这样添加文件就足够使用了:
WinRE.wim里缺失需要从install.wim里提取的写字板组件及其依赖总共5个文件就能使用:
\Program Files\Windows NT\Accessories\wordpad.exe
\Program Files\Windows NT\Accessories\zh-CN\wordpad.exe.mui
\Windows\SYSTEM32\UIRibbon.dll
\Windows\SYSTEM32\UIRibbonRes.dll
\Windows\SYSTEM32\UIRibbon.dll\zh-CN\UIRibbon.dll.mui
回复

使用道具 举报

发表于 2022-2-7 18:50:01 | 显示全部楼层
回复

使用道具 举报

发表于 2022-5-29 13:20:20 | 显示全部楼层
zds1210 发表于 2021-12-20 19:56
这个非常好,为什么不制作一个绿色版的wordpad呢?改天按你的方法,试一下制作,然后在各PE中测试改进。

期待PE下绿色版的WordPad成品!
回复

使用道具 举报

发表于 2022-5-29 18:18:02 | 显示全部楼层
还有两个课题, 烦劳楼主研究一下.
1. 现在许多 PE 系统自带的磁盘扫描不能用, 少什么注册表, 缺什么文件.
2. msi 安装方式, 在许多 PE 中不能用或不好用, 比如说 Edge 的 msi 有些 PE 不支持, 或装上也不能用.

点评

这两个课题很现实啊,实际当中经常遇得到。比如要绿色msi格式安装软件,也就H3w3的PE能支持。 还有画图 图片查看器,wordpad,如果能实现绿色化就非常好。  详情 回复 发表于 2022-5-30 00:30
回复

使用道具 举报

发表于 2022-5-30 00:30:22 | 显示全部楼层
vaf 发表于 2022-5-29 18:18
还有两个课题, 烦劳楼主研究一下.
1. 现在许多 PE 系统自带的磁盘扫描不能用, 少什么注册表, 缺什么文件.
...

这两个课题很现实啊,实际当中经常遇得到。比如要绿色msi格式安装软件,也就H3w3的PE能支持。
还有画图 图片查看器,wordpad,如果能实现绿色化就非常好。
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 注册

本版积分规则

小黑屋|手机版|Archiver|捐助支持|无忧启动 ( 闽ICP备05002490号-1 )

闽公网安备 35020302032614号

GMT+8, 2024-3-28 22:03

Powered by Discuz! X3.3

© 2001-2017 Comsenz Inc.

快速回复 返回顶部 返回列表