wimtool是一款非常强大的镜像处理工具,同时它也是PE下加载wim镜像的必要软件,在制作PE时如果把它添加到PE里呢?其实很简单,几步就可以实现了。

第一步:先在WinPE内核中添加WIMFLTR.SYS、WIMFSF.SYS、WIMGAPI.DLL和FLTLIB.DLL 4个文件(sys放在drivers下,dll放在system32下)。

第二步:在WInPE注册表中导入以下内容:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINEpeControlSet001ServicesFltMgr]

"Description"="File System Filter Manager Driver"

"DisplayName"="FltMgr"

"ErrorControl"=dword:00000001

"Group"="FSFilter Infrastructure"

"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,

72,00,69,00,76,00,65,00,72,00,73,00,5c,00,66,00,6c,00,74,00,6d,00,67,00,72,

00,2e,00,73,00,79,00,73,00,00,00

"Start"=dword:00000000

"Type"=dword:00000002

"Tag"=dword:00000001

"AttachWhenLoaded"=dword:00000001

[HKEY_LOCAL_MACHINEpeControlSet001EnumRootLEGACY_FLTMGR]

"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINEpeControlSet001EnumRootLEGACY_FLTMGR000]

"Service"="FltMgr"

"Legacy"=dword:00000001

"ConfigFlags"=dword:00000000

"Class"="LegacyDriver"

"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"

"DeviceDesc"="FltMgr"

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFltr]

"Type"=dword:00000002

"Start"=dword:00000003

"ErrorControl"=dword:00000001

"Tag"=dword:00000004

"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,

52,00,49,00,56,00,45,00,52,00,53,00,5c,00,77,00,69,00,6d,00,66,00,6c,00,74,

00,72,00,2e,00,73,00,79,00,73,00,00,00

"DisplayName"="WimFltr"

"Group"="FSFilter Compression"

"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00

"DependOnGroup"=hex(7):00,00

"Description"="Windows Image Mini-Filter Driver"

"DebugFlags"=dword:00000001

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFltrInstances]

"DefaultInstance"="WimFltr Instance"

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFltrInstancesWimFltr Instance]

"Altitude"="170500"

"Flags"=dword:00000000

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFltrSecurity]

"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,

00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFsf]

"DisplayName"="Windows Imaging File System Filter Driver"

"Group"="FSFilter Compression"

"ErrorControl"=dword:00000001

"Start"=dword:00000000

"Type"=dword:00000002

"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00

"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,

72,00,69,00,76,00,65,00,72,00,73,00,5c,00,77,00,69,00,6d,00,66,00,73,00,66,

00,2e,00,73,00,79,00,73,00,00,00

"Tag"=dword:00000001

"DependOnGroup"=hex(7):00,00

"Description"="Windows Imaging File System Filter Driver"

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFsfInstances]

"DefaultInstance"="Wimfsf Instance"

[HKEY_LOCAL_MACHINEpeControlSet001ServicesWimFsfInstancesWimfsf Instance]

"Altitude"="161000"

"Flags"=dword:00000000

把PE重新打包,进入PE就可以使用这个工具了。