可作为pe外置组件（无需DWM支持）的最少右键解锁bitlocker分区的最少依赖文件如下

sairen139 · 发表于 2023-9-16 15:08:23

本帖最后由 sairen139 于 2023-9-16 16:41 编辑

可作为pe外置组件（无需DWM支持）的最少右键解锁bitlocker分区的最少依赖文件如下：

经过两天实践和无数次测试找到最少右键解锁bitlocker分区的最少依赖文件如下：
在添加dwm功能之后再添加下面的文件就能界面解锁bitlocker加密分区（每个分区都强行出现解锁项），这样就能在加密分区子目录横行无阻了：
【关于DWM这个前提条件其实是错误的，今天实验发现原生的右键菜单弹出界面解锁bitlocker加密分区并不需要DWM作为前提条件！】
\Windows\SystemResources\Windows.UI.Immersive.dll.mun

\Windows\System32\drivers\fvevol.sys

\Windows\System32\bdeui.dll
\Windows\System32\bdeunlock.exe
\Windows\System32\fveapi.dll
\Windows\System32\fvecerts.dll
\Windows\System32\fveui.dll
\Windows\System32\Windows.UI.Immersive.dll

\Windows\System32\zh-CN\bdeunlock.exe.mui
\Windows\System32\zh-CN\Windows.UI.Immersive.dll.mui

在线导入骨头版pe添加所有分区bitlocker右键解锁项.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\Classes\Drive\shell\unlock-bde]
@=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
  00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,62,00,\
  64,00,65,00,75,00,6e,00,6c,00,6f,00,63,00,6b,00,2e,00,65,00,78,00,65,00,2c,\
  00,2d,00,31,00,30,00,30,00,00,00
"MultiSelectModel"="Single"

[HKEY_LOCAL_MACHINE\software\Classes\Drive\shell\unlock-bde\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,62,00,64,00,\
  65,00,75,00,6e,00,6c,00,6f,00,63,00,6b,00,2e,00,65,00,78,00,65,00,20,00,25,\
  00,31,00,00,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0dec7d0c-bd63-4759-aa64-adefd70dcf9a}\InProcServer32]
@="X:\\Windows\\System32\\Windows.UI.Immersive.dll"
"ThreadingModel"="Apartment"

sairen139 · 发表于 2023-9-16 15:10:00

本帖最后由 sairen139 于 2023-9-16 16:27 编辑

昨日从hhh333处得知bitlocker功能组件可外置，我就实验了一下的确可以外置。
然后再找到bitlocker解锁功能的依赖文件和注册表之后，我突然想起pe界一直流传右键菜单弹出界面解锁的bitlocker需要DWM支持才能弹出，我想试试是不是真的需要DWM才能这样解锁，没想到实践之下才知道原生的右键菜单弹出bitlocker解锁界面是不需要DWM功能作为前提条件的！

真是一波三折，也算给pe界爱好者提供了一点新的认知！
链接: https://pan.baidu.com/s/1eE7eyArcPYUeu5gi7FmJAQ?pwd=8864 提取码: 8864 请下载网盘里的【!支持解锁BitLocker加密分区BOOT.WIM】这个pe文件使用。

sairen139 · 发表于 2023-9-16 19:25:54

本帖最后由 sairen139 于 2023-9-16 23:14 编辑

狼人72105 发表于 2023-9-16 19:02
你少了shellhwddetection服务注册表天行健。。。。

难道re自带了这个吗，我是winre.wim的注册表，没加这个shellhwddetection服务。这个服务是干什么用的？

多谢告知注册表：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ShellHWDetection]

"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00

"Description"="@%SystemRoot%\\System32\\shsvcs.dll,-12289"

"DisplayName"="@%SystemRoot%\\System32\\shsvcs.dll,-12288"

"ErrorControl"=dword:00000000

"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\

00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00

"Group"="ShellSvcGroup"

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,20,00,2d,00,70,00,00,\

00

"ObjectName"="LocalSystem"

"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\

00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\

65,00,00,00,53,00,65,00,53,00,79,00,73,00,74,00,65,00,6d,00,45,00,6e,00,76,\

00,69,00,72,00,6f,00,6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,\

69,00,6c,00,65,00,67,00,65,00,00,00,00,00

"ServiceSidType"=dword:00000001

"Start"=dword:00000002

"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ShellHWDetection\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

73,00,68,00,73,00,76,00,63,00,73,00,2e,00,64,00,6c,00,6c,00,00,00

"ServiceDllUnloadOnStop"=dword:00000001

"ServiceMain"="HardwareDetectionServiceMain"

和依赖文件shsvcs.dll和fwbase.dll

sairen139 · 发表于 2023-9-17 08:39:16

martin313 发表于 2023-9-17 05:16
又要补充这2个文件才行？shsvcs.dll和fwbase.dll

这两个不影响解锁bitlocker，这两个是双击bitlocker分区自动弹出解锁驱动器界面框的，可加可不加。

sairen139 · 发表于 2023-9-17 08:40:17

martin313 发表于 2023-9-17 05:21
顺带咨询老大一个问题，前几天分享与您的PE，存在一个问题，就是用 GImageX 装载卸载映像时，有时存在 ...

不能每次复现的问题我也不知道怎么解决好

sairen139 · 发表于 2023-9-17 18:39:34

martin313 发表于 2023-9-17 17:39
请教老大，PE 用原版开始菜单的话，应该如何配置？

10pe不能用原生开始菜单，11pe可以但是体积很大

sairen139 · 发表于 2023-9-17 19:33:58

martin313 发表于 2023-9-17 18:44
11pe 如何配置原生菜单？

现在就是用原生explorer，与 StartAllBack 搭配，总是报错

http://bbs.wuyou.net/forum.php?mod=viewthread&tid=436703

sairen139 · 发表于 2023-9-17 22:19:24

martin313 发表于 2023-9-17 22:16
问题解决了，哈哈
请看这里：http://bbs.wuyou.net/forum.php?mod=viewthread&tid=437362

为什么这个共享会失效？？

sairen139 · 发表于 2023-9-17 23:37:06

martin313 发表于 2023-9-17 22:30
我也不知道

请看那个帖子的图片（手机 RNDIS 共享后，联网的图标都出现了，虚拟机里也可以上外网了）
...

这个问题比较好确认，测试方法是直接打开pecmd.exe里下面那个输入框，输入

EXEC @NET share X=X: /grant:everyone,full

或者

EXEC net share X=X: /grant:everyone,full

然后点pecmd.exe下面输入框后面的执行按钮

然后cmd里输入net share就可以知道命令能不能成功共享X盘出去

sairen139 · 发表于 2023-9-18 08:23:08

martin313 发表于 2023-9-18 05:35
刚刚测试看了一下，进pe桌面后，再执行 EXEC @net share X=X: /grant:everyone,full
是可以的

那问题有点奇怪了，如果pecmd.exe里可以执行，那加到pecmd.ini里开机时自动执行应该也能共享X盘为X才对？

sairen139 · 发表于 2023-9-18 08:49:37

martin313 发表于 2023-9-18 08:30
估计执行时机不对（此PE的特殊性吧）

这个要进桌面再自动执行，也是有办法的，就是把命令（或者快捷键 ...

你可以调整一下把这句放在最后执行，看是不是时机问题导致的？

sairen139 · 发表于 2023-9-18 15:03:35

本帖最后由 sairen139 于 2023-9-18 16:40 编辑

sairen139 发表于 2023-9-16 19:25
难道re自带了这个吗，我是winre.wim的注册表，没加这个shellhwddetection服务。这个服务是干什么用的？
...

目前以原生资源管理器为shell外壳的pe可以双击弹出，而以winxshell为外壳的话目前配制winxshell自带百分之99类似原生管理器的资源管理器这个不能双击弹出，但是直接复制原生资源管理器和语言文件夹到程序文件夹下，这两个都能实现双击直接弹出解锁驱动器的输入框界面。

sairen139 · 发表于 2023-9-18 15:56:38

2012zhd 发表于 2023-9-18 15:46
不会吧，k大的几个pe我测试都是可以双击弹出输入密码框的。

K大是winxshell做外壳shell吗？

sairen139 · 发表于 2023-9-19 15:40:58

本帖最后由 sairen139 于 2023-9-24 10:01 编辑

sairen139 发表于 2023-9-16 15:10
昨日从hhh333处得知bitlocker功能组件可外置，我就实验了一下的确可以外置。
然后再找到bitlocker解锁功能 ...

群友@ smine 提供的bitlocker相关依赖文件如下:
;基础文件
\Windows\System32\bdesvc.dll
\Windows\System32\bdeui.dll
\Windows\System32\bdeunlock.exe
\Windows\System32\fveapi.dll
\Windows\System32\fvecerts.dll
\Windows\System32\fvenotify.exe
\Windows\System32\fveui.dll
\Windows\System32\StructuredQuery.dll
\Windows\System32\Windows.Storage.Search.dll
\Windows\System32\vssapi.dll
\Windows\System32\vsstrace.dll
;删除会导致启用bitlocker报错
\Windows\System32\ReAgent.dll
;
;全功能补充
\Windows\System32\bdechangepin.exe
\Windows\System32\BdeHdCfg.exe
\Windows\System32\BdeHdCfgLib.dll
\Windows\System32\bderepair.dll
\Windows\System32\BdeSysprep.dll
\Windows\System32\BdeUISrv.exe
\Windows\System32\BitLockerCsp.dll
\Windows\System32\BitLockerDeviceEncryption.exe
\Windows\System32\BitLockerWizard.exe
\Windows\System32\BitLockerWizardElev.exe
\Windows\System32\EhStorAPI.dll
\Windows\System32\EhStorAuthn.exe
\Windows\System32\EhStorPwdMgr.dll
\Windows\System32\EhStorShell.dll
\Windows\System32\fveapibase.dll
;\Windows\System32\fvecpl.dll
\Windows\System32\fveprompt.exe
\Windows\System32\fveskybackup.dll
\Windows\System32\fvewiz.dll
;
;命令行加密补充(manage-bde -on/off ...)
\Windows\System32\manage-bde.exe
\Windows\System32\repair-bde.exe
\Windows\System32\shdocvw.dll
\Windows\System32\swprv.dll
;解决加密时报错无法加载资源文件的问题, 微软的坑, 居然藏在en-US下, 害我一通好找!!!
\Windows\System32\en-US\fveapi.dll.mui
;
\Windows\System32\wbem\Win32_EncryptableVolume.dll
\Windows\System32\wbem\win32_encryptablevolume.mof
\Windows\System32\wbem\Win32_EncryptableVolumeUninstall.mof
\Windows\System32\wbem\Win32_Tpm.dll
\Windows\System32\wbem\Win32_Tpm.mof

注册表:
SOFT\Classes\Drive\shell\unlock-bde
SOFT\Classes\Drive\shell\encrypt-bde
SOFT\Classes\Drive\shell\encrypt-bde-elev
SYS\ControlSet001\Services\BDESVC

还有kuer版主提供的注册表和相关文件如下：
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\encrypt-bde-elev]
"AppliesTo"="-"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"UseAdvancedStartup"=dword:00000001
"EnableBDEWithNoTPM"=dword:00000001
"UseTPM"=dword:00000002
"UseTPMPIN"=dword:00000002
"UseTPMKey"=dword:00000002
"UseTPMKeyPIN"=dword:00000002

右键更改 Bitlocker 密码

//[HKEY_LOCAL_MACHINE\SOFTWARE\Drive\shell\change-passphrase\command]
//@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,42,00,69,00,\
  74,00,4c,00,6f,00,63,00,6b,00,65,00,72,00,57,00,69,00,7a,00,61,00,72,00,64,\
  00,2e,00,65,00,78,00,65,00,20,00,25,00,31,00,20,00,5a,00,00,00

控制面板Bitlocker 驱动器加密

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}]
@="Secure Startup"
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
  6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
  00,66,00,76,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,\
  32,00,23,00,69,00,6d,00,6d,00,75,00,74,00,61,00,62,00,6c,00,65,00,31,00,00,\
  00
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
  6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
  00,5c,00,66,00,76,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,\
  2d,00,31,00,23,00,69,00,6d,00,6d,00,75,00,74,00,61,00,62,00,6c,00,65,00,31,\
  00,00,00
"System.ApplicationName"="Microsoft.BitLockerDriveEncryption"
"System.ControlPanel.Category"="10"
"System.ControlPanel.EnableInSafeMode"=dword:00000003
"System.Software.TasksFileUrl"="Internal"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,66,00,76,00,\
  65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,31,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\
  64,00,6f,00,63,00,76,00,77,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}\Instance]
"CLSID"="{328B0346-7EAF-4BBE-A479-7CB88A095F5B}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}\Instance\InitPropertyBag]
"ResourceDLL"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  66,00,76,00,65,00,63,00,70,00,6c,00,2e,00,64,00,6c,00,6c,00,00,00
"ResourceID"=dword:00000064

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}\Shell\Open\Command]
@="control.exe /name Microsoft.BitLockerDriveEncryption /page ?InitialVolume==%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}\ShellFolder]
"Attributes"=dword:28000000
"WantsParseDisplayName"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{26ED43EA-45C6-4EF6-9E9B-1740366C98BE}]
@="Secure Startup"

;更改 BitLocker 密码
//[HKEY_LOCAL_MACHINE\SOFTWARE\Drive\shell\change-passphrase]
//@=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
  00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,66,00,\
  76,00,65,00,77,00,69,00,7a,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,39,00,37,\
  00,31,00,00,00
//"AppliesTo"="(System.Volume.BitLockerProtection:=System.Volume.BitLockerProtection#On OR System.Volume.BitLockerProtection:=System.Volume.BitLockerProtection#Encrypting OR System.Volume.BitLockerProtection:=System.Volume.BitLockerProtection#Suspended) AND System.Volume.BitLockerCanChangePassphraseByProxy:=System.StructuredQueryType.Boolean#True"
//"MultiSelectModel"="Single"

//[HKEY_LOCAL_MACHINE\SOFTWARE\Drive\shell\change-passphrase\command]
//@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,62,00,64,00,\
  65,00,63,00,68,00,61,00,6e,00,67,00,65,00,70,00,69,00,6e,00,2e,00,65,00,78,\
  00,65,00,20,00,2d,00,70,00,77,00,20,00,25,00,31,00,00,00

;管理BitLocker
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde]
@=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
  00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,66,00,\
  76,00,65,00,77,00,69,00,7a,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,39,00,34,\
  00,39,00,00,00
"AppliesTo"="System.Volume.BitLockerProtection:=System.Volume.BitLockerProtection#On OR System.Volume.BitLockerProtection:=System.Volume.BitLockerProtection#Encrypting OR System.Volume.BitLockerProtection:=System.Volume.BitLockerProtection#Suspended"
"MultiSelectModel"="Single"
"HasLUAShield"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\manage-bde\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
  00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,00,6f,00,\
  6e,00,74,00,72,00,6f,00,6c,00,2e,00,65,00,78,00,65,00,20,00,2f,00,6e,00,61,\
  00,6d,00,65,00,20,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,\
  2e,00,42,00,69,00,74,00,4c,00,6f,00,63,00,6b,00,65,00,72,00,44,00,72,00,69,\
  00,76,00,65,00,45,00,6e,00,63,00,72,00,79,00,70,00,74,00,69,00,6f,00,6e,00,\
  20,00,2f,00,70,00,61,00,67,00,65,00,20,00,3f,00,49,00,6e,00,69,00,74,00,69,\
  00,61,00,6c,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,3d,00,3d,00,25,00,31,00,\
  00,00

;加锁解锁关闭BL添加文件
\Windows\System32\bridgeres.dll
\Windows\System32\FrameServer.dll
\Windows\System32\wiaservc.dll
\Windows\System32\BdeHdCfgLib.dll
\Windows\System32\BitLockerWizard.exe
\Windows\System32\BitLockerWizardElev.exe
\Windows\System32\fveskybackup.dll
\Windows\System32\fvewiz.dll
\Windows\System32\fveapibase.dll
\Windows\System32\fvecpl.dll

sairen139 · 发表于 2024-5-10 10:30:32

sairen139 发表于 2023-9-16 15:10
昨日从hhh333处得知bitlocker功能组件可外置，我就实验了一下的确可以外置。
然后再找到bitlocker解锁功能 ...

@echo off

set "tempfile=%TEMP%\%~n0.tmp"
set "partition=%~1"
for %%D in ("%~1") do set "DriveLetter=%%~dD"
vol %DriveLetter% > "%tempfile%" 2>&1
find /i /c:"Bitlocker" "%tempfile%" >nul
if %errorlevel% equ 0 %SystemRoot%\System32\bdeunlock.exe %1
del "%tempfile%"

goto :EOF

[分享] 可作为pe外置组件（无需DWM支持）的最少右键解锁bitlocker分区的最少依赖文件如下

评分

点评

点评

点评

点评

点评

点评

浏览过的版块

		自动登录	找回密码
密码			注册