SlpIsDynamicUpdate函数分析检测DynamicUpdateBootDriverPresent和PreInstall和检测是否存在migrate.inf和unsupdrv.infsetupparams节的DynamicUpdateBootDriverPresent和DynamicUpdateBootDriverRootUnattended节的PreInstall//// Are there any dyamic update boot drivers which we need// to process//DynamicUpdate SlpIsDynamicUpdate(WinntSifHandle, DynamicUpdateRootDir);//// Add the dynamic update source device as OEM source device since it could// have F6//if (DynamicUpdate) {kd kc 5#00 setupldr!SlpIsDynamicUpdate01 setupldr!SlInit02 setupldr!BlStartup03 setupldr!NtProcessStartupWARNING: Frame IP not in any known module. Following frames may be wrong.04 0x0kd dvInfHandle 0x8021ddf8DynamicUpdateRootDir 0x00348af0BOOLEANSlpIsDynamicUpdate(IN PVOID InfHandle,OUT PCSTR *DynamicUpdateRootDir){BOOLEAN Result FALSE;if (InfHandle) {PCHAR DynUpdateKey SlGetSectionKeyIndex(InfHandle,WINNT_SETUPPARAMS_A,WINNT_SP_DYNUPDTBOOTDRIVERPRESENT_A,0);PCHAR DynUpdateRoot SlGetSectionKeyIndex(InfHandle,WINNT_SETUPPARAMS_A,WINNT_SP_DYNUPDTBOOTDRIVERROOT_A,0);//// DynamicUpdateBootDriverPresent and DynamicUpateBootDriverRoot// should have valid values//Result (BOOLEAN) (DynUpdateKey DynUpdateRoot !_stricmp(DynUpdateKey, yes));if (Result DynamicUpdateRootDir) {*DynamicUpdateRootDir SlCopyStringA(DynUpdateRoot);}}return Result;}kd teax00000000 ebx00000000 ecx00324462 edx00000030 esi80078600 edi00000000eip0031b9a8 esp00060b90 ebp00060bb0 iopl0 nv up di ng nz na po nccs0008 ss0010 ds0010 es0010 fs0030 gs0000 efl00000082setupldr!SlGetSectionKeyIndex:0031b9a8 55 push ebpkd dvINFHandle 0x8021ddf8SectionName 0x00323fde setupparamsKey 0x00323fbe DynamicUpdateBootDriverPresentValueIndex 0kd dt _INF 0x8021ddf8setupldr!_inf0x000 pSection : 0x8021ea48 _sectionkd dx -r1 ((setupldr!_section *)0x8021ea48)((setupldr!_section *)0x8021ea48) : 0x8021ea48 [Type: _section *][0x000] pNext : 0x8021e920 [Type: _section *][0x004] pName : 0x8021e36d : VMwareData [Type: char *][0x008] pLine : 0x8021ea58 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e920)((setupldr!_section *)0x8021e920) : 0x8021e920 [Type: _section *][0x000] pNext : 0x8021e868 [Type: _section *][0x004] pName : 0x8021e335 : GuiRunOnce [Type: char *][0x008] pLine : 0x8021e930 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e868)((setupldr!_section *)0x8021e868) : 0x8021e868 [Type: _section *][0x000] pNext : 0x8021e820 [Type: _section *][0x004] pName : 0x8021e2ff : Display [Type: char *][0x008] pLine : 0x8021e878 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e820)((setupldr!_section *)0x8021e820) : 0x8021e820 [Type: _section *][0x000] pNext : 0x8021e7d8 [Type: _section *][0x004] pName : 0x8021e2db : Branding [Type: char *][0x008] pLine : 0x8021e830 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e7d8)((setupldr!_section *)0x8021e7d8) : 0x8021e7d8 [Type: _section *][0x000] pNext : 0x8021e790 [Type: _section *][0x004] pName : 0x8021e2b3 : Networking [Type: char *][0x008] pLine : 0x8021e7e8 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e790)((setupldr!_section *)0x8021e790) : 0x8021e790 [Type: _section *][0x000] pNext : 0x8021e710 [Type: _section *][0x004] pName : 0x8021e28c : Identification [Type: char *][0x008] pLine : 0x8021e7a0 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e710)((setupldr!_section *)0x8021e710) : 0x8021e710 [Type: _section *][0x000] pNext : 0x8021e620 [Type: _section *][0x004] pName : 0x8021e258 : LicenseFilePrintData [Type: char *][0x008] pLine : 0x8021e720 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e620)((setupldr!_section *)0x8021e620) : 0x8021e620 [Type: _section *][0x000] pNext : 0x8021e050 [Type: _section *][0x004] pName : 0x8021e224 : UserData [Type: char *][0x008] pLine : 0x8021e630 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021e050)((setupldr!_section *)0x8021e050) : 0x8021e050 [Type: _section *][0x000] pNext : 0x8021deb8 [Type: _section *][0x004] pName : 0x8021add6 : GuiUnattended [Type: char *][0x008] pLine : 0x8021e060 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021deb8)((setupldr!_section *)0x8021deb8) : 0x8021deb8 [Type: _section *][0x000] pNext : 0x8021de00 [Type: _section *][0x004] pName : 0x8021ad3c : Unattended [Type: char *][0x008] pLine : 0x8021dec8 [Type: _line *]kd dx -r1 ((setupldr!_section *)0x8021de00)((setupldr!_section *)0x8021de00) : 0x8021de00 [Type: _section *][0x000] pNext : 0x0 [Type: _section *][0x004] pName : 0x8021ad06 : Data [Type: char *][0x008] pLine : 0x8021de10 [Type: _line *]kd teax00000000 ebx00000000 ecx00323fde edx00000030 esi00000000 edi00000000eip0031b9a8 esp00060b90 ebp00060bb0 iopl0 nv up di pl zr na pe nccs0008 ss0010 ds0010 es0010 fs0030 gs0000 efl00000046setupldr!SlGetSectionKeyIndex:0031b9a8 55 push ebpkd dvINFHandle 0x8021ddf8SectionName 0x00324006 setupparamsKey 0x00323fea DynamicUpdateBootDriverRootValueIndex 0//// DynamicUpdateBootDriverPresent and DynamicUpateBootDriverRoot// should have valid values//Result (BOOLEAN) (DynUpdateKey DynUpdateRoot !_stricmp(DynUpdateKey, yes));if (Result DynamicUpdateRootDir) {*DynamicUpdateRootDir SlCopyStringA(DynUpdateRoot);}//// Are there any dyamic update boot drivers which we need// to process//DynamicUpdate SlpIsDynamicUpdate(WinntSifHandle, DynamicUpdateRootDir);//// Add the dynamic update source device as OEM source device since it could// have F6//if (DynamicUpdate) { 不符合条件。if (BlBootingFromNet || (Status ESUCCESS)) {//// Find out if this is a pre-install, by looking at OemPreinstall key// in [unattended] section of winnt.sif//p SlGetSectionKeyIndex(WinntSifHandle,WINNT_UNATTENDED_A,WINNT_U_OEMPREINSTALL_A,0);if(p !_stricmp(p,yes)) {PreInstall TRUE;}kd dx -r1 ((setupldr!_line *)0x8021dec8)((setupldr!_line *)0x8021dec8) : 0x8021dec8 [Type: _line *][0x000] pNext : 0x8021df00 [Type: _line *][0x004] pName : 0x8021ad47 : UnattendMode [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021ded0))(*((setupldr!char * (*)[10])0x8021ded0)) [Type: char * [10]][0] : 0x8021ad54 : FullUnattended [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]kd dx -r1 ((setupldr!_line *)0x8021df00)((setupldr!_line *)0x8021df00) : 0x8021df00 [Type: _line *][0x000] pNext : 0x8021df38 [Type: _line *][0x004] pName : 0x8021ad63 : OemSkipEula [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021df08))(*((setupldr!char * (*)[10])0x8021df08)) [Type: char * [10]][0] : 0x8021ad6f : Yes [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]kd dx -r1 ((setupldr!_line *)0x8021df38)((setupldr!_line *)0x8021df38) : 0x8021df38 [Type: _line *][0x000] pNext : 0x8021df70 [Type: _line *][0x004] pName : 0x8021ad73 : OemPreinstall [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021df40))(*((setupldr!char * (*)[10])0x8021df40)) [Type: char * [10]][0] : 0x8021ad81 : No [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]kd dx -r1 ((setupldr!_line *)0x8021df70)((setupldr!_line *)0x8021df70) : 0x8021df70 [Type: _line *][0x000] pNext : 0x8021dfa8 [Type: _line *][0x004] pName : 0x8021ad84 : TargetPath [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021df78))(*((setupldr!char * (*)[10])0x8021df78)) [Type: char * [10]][0] : 0x8021ad8f : \WINDOWS [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]kd dx -r1 ((setupldr!_line *)0x8021dfa8)((setupldr!_line *)0x8021dfa8) : 0x8021dfa8 [Type: _line *][0x000] pNext : 0x8021dfe0 [Type: _line *][0x004] pName : 0x8021ad98 : Repartition [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021dfb0))(*((setupldr!char * (*)[10])0x8021dfb0)) [Type: char * [10]][0] : 0x8021ada4 : Yes [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]kd dx -r1 ((setupldr!_line *)0x8021dfe0)((setupldr!_line *)0x8021dfe0) : 0x8021dfe0 [Type: _line *][0x000] pNext : 0x8021e018 [Type: _line *][0x004] pName : 0x8021ada8 : UnattendSwitch [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021dfe8))(*((setupldr!char * (*)[10])0x8021dfe8)) [Type: char * [10]][0] : 0x8021adb7 : Yes [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]kd dx -r1 ((setupldr!_line *)0x8021e018)((setupldr!_line *)0x8021e018) : 0x8021e018 [Type: _line *][0x000] pNext : 0x0 [Type: _line *][0x004] pName : 0x8021adbb : DriverSigningPolicy [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021e020))(*((setupldr!char * (*)[10])0x8021e020)) [Type: char * [10]][0] : 0x8021adcf : Ignore [Type: char *][1] : 0x0 [Type: char *][2] : 0x0 [Type: char *][3] : 0x0 [Type: char *][4] : 0x0 [Type: char *][5] : 0x0 [Type: char *][6] : 0x0 [Type: char *][7] : 0x0 [Type: char *][8] : 0x0 [Type: char *][9] : 0x0 [Type: char *]p SlGetSectionKeyIndex(WinntSifHandle,WINNT_UNATTENDED_A,WINNT_U_OEMPREINSTALL_A,0);kd peax8021ad81 ebx00000000 ecx00000000 edx0000000a esi80078600 edi003482a3eip0032740d esp00060bc0 ebp00060df4 iopl0 nv up di pl nz na po nccs0008 ss0010 ds0010 es0010 fs0030 gs0000 efl00000002setupldr!SlInit0x13c7:0032740d 3bc3 cmp eax,ebxkd db 8021ad818021ad81 4e 6f 00 54 61 72 67 65-74 50 61 74 68 00 5c 57 No.if(p !_stricmp(p,yes)) {PreInstall TRUE;}p SlGetSectionKeyIndex(WinntSifHandle,WINNT_SETUPPARAMS_A,WINNT_S_SKIPMISSING_A,0);if(p (*p ! 0)) {IgnoreMissingFiles TRUE;}//// Find out if this is a Win9x upgrade//Win9xUnsupHdc FALSE;p SlGetSectionKeyIndex(WinntSifHandle,WINNT_DATA_A,WINNT_D_WIN95UPGRADE_A,0);if(p !_stricmp(p, WINNT_A_YES_A)) {kd dx -r1 ((setupldr!_line *)0x8021de10)((setupldr!_line *)0x8021de10) : 0x8021de10 [Type: _line *][0x000] pNext : 0x8021de48 [Type: _line *][0x004] pName : 0x8021ad0b : AutoPartition [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 ((setupldr!_line *)0x8021de48)((setupldr!_line *)0x8021de48) : 0x8021de48 [Type: _line *][0x000] pNext : 0x8021de80 [Type: _line *][0x004] pName : 0x8021ad1b : MsDosInitiated [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 ((setupldr!_line *)0x8021de80)((setupldr!_line *)0x8021de80) : 0x8021de80 [Type: _line *][0x000] pNext : 0x0 [Type: _line *][0x004] pName : 0x8021ad2a : UnattendedInstall [Type: char *][0x008] InternalValues [Type: char * [10]][0x030] pFirstExternalValue : 0x0 [Type: _value *]kd dx -r1 (*((setupldr!char * (*)[10])0x8021de88))(*((setupldr!char * (*)[10])0x8021de88)) [Type: char * [10]][0] : 0x8000f040 : Yes [Type: char *]//// At this point, we know that we wre able to read winnt.sif.// So attempt to read migrate.inf. Borrow the BadFileName buffer// for temporary use.检测migrate.inf文件是否存在//strcpy(BadFileName,BootPath);strcat(BadFileName,WINNT_MIGRATE_INF_FILE_A);if( SlInitIniFile(NULL,BootDeviceId,BadFileName,MigrateInfHandle,BlLoaderBlock-SetupLoaderBlock-MigrateInfFile,BlLoaderBlock-SetupLoaderBlock-MigrateInfFileLength,DontCare) ! ESUCCESS ) {MigrateInfHandle NULL;BlLoaderBlock-SetupLoaderBlock-MigrateInfFile NULL;BlLoaderBlock-SetupLoaderBlock-MigrateInfFileLength 0;}kd teax80078678 ebx00000000 ecx8007867c edx8012b750 esi003256f0 edi003482aaeip0031be17 esp00060ba0 ebp00060df4 iopl0 nv up di ng nz na pe nccs0008 ss0010 ds0010 es0010 fs0030 gs0000 efl00000086setupldr!SlInitIniFile:0031be17 55 push ebpkd dvDevicePath 0x00000000 DeviceId 0xaINFFile 0x00348298 \I386\migrate.infpINFHandle 0x0034a798pINFBuffer 0x80078678INFBufferSize 0x8007867cErrorLine 0x00060dd0ActualBase 0x31be17FileInfo struct _FILE_INFORMATION//// find out size of INF file//Status BlGetFileInformation(FileID, FileInfo);if (Status ! ESUCCESS) {BlClose(FileID);goto xx0;}\I386\migrate.inf文件不存在。//// Attempt also to read unsupdrv.inf. Borrow the BadFileName buffer// for temporary use.检测unsupdrv.inf文件是否存在//strcpy(BadFileName,BootPath);strcat(BadFileName,WINNT_UNSUPDRV_INF_FILE_A);if( SlInitIniFile(NULL,BootDeviceId,BadFileName,UnsupDriversInfHandle,BlLoaderBlock-SetupLoaderBlock-UnsupDriversInfFile,BlLoaderBlock-SetupLoaderBlock-UnsupDriversInfFileLength,DontCare) ! ESUCCESS ) {UnsupDriversInfHandle NULL;BlLoaderBlock-SetupLoaderBlock-UnsupDriversInfFile NULL;BlLoaderBlock-SetupLoaderBlock-UnsupDriversInfFileLength 0;}SlGetMigratedHardwareIds(SetupBlock, UnsupDriversInfHandle);kd teax80078680 ebx00000000 ecx80078684 edx8012b750 esi003256fd edi003482abeip0031be17 esp00060ba0 ebp00060df4 iopl0 nv up di ng nz na po nccs0008 ss0010 ds0010 es0010 fs0030 gs0000 efl00000082setupldr!SlInitIniFile:0031be17 55 push ebpkd kc 4#00 setupldr!SlInitIniFile01 setupldr!SlInit02 setupldr!BlStartup03 setupldr!NtProcessStartupkd dvDevicePath 0x00000000 DeviceId 0xaINFFile 0x00348298 \I386\unsupdrv.infpINFHandle 0x0034a794pINFBuffer 0x80078680INFBufferSize 0x80078684ErrorLine 0x00060dd0if ( !BlBootingFromNet ) {BlLoaderBlock-NtBootPathName BootPath;}kd dt setupldr!BlLoaderBlock0x800770000x000 LoadOrderListHead : _LIST_ENTRY [ 0x80077000 - 0x80077000 ]0x008 MemoryDescriptorListHead : _LIST_ENTRY [ 0x80077160 - 0x800772c8 ]0x010 BootDriverListHead : _LIST_ENTRY [ 0x0 - 0x0 ]0x018 KernelStack : 00x01c Prcb : 00x020 Process : 00x024 Thread : 00x028 RegistryLength : 00x02c RegistryBase : (null)0x030 ConfigurationRoot : 0x80078988 _CONFIGURATION_COMPONENT_DATA0x034 ArcBootDeviceName : 0x8021cb28 multi(0)disk(0)cdrom(159)0x038 ArcHalDeviceName : (null)0x03c NtBootPathName : 0x8021cb48 \I386\0x040 NtHalPathName : (null)0x044 LoadOptions : 0x80152090 /FASTDETECT /NOGUIBOOT /NODEBUG0x048 NlsData : (null)0x04c ArcDiskInformation : (null)0x050 OemFontFile : (null)0x054 SetupLoaderBlock : 0x80078600 _SETUP_LOADER_BLOCK0x058 Extension : 0x80077068 _LOADER_PARAMETER_EXTENSION0x05c u : __unnamedkd dx -r1 ((setupldr!_SETUP_LOADER_BLOCK *)0x80078600)((setupldr!_SETUP_LOADER_BLOCK *)0x80078600) : 0x80078600 [Type: _SETUP_LOADER_BLOCK *][0x000] ArcSetupDeviceName : 0x0 [Type: char *][0x004] VideoDevice [Type: _DETECTED_DEVICE][0x02c] KeyboardDevices : 0x0 [Type: _DETECTED_DEVICE *][0x030] ComputerDevice [Type: _DETECTED_DEVICE][0x058] ScsiDevices : 0x0 [Type: _DETECTED_DEVICE *][0x05c] OemSourceDevices : 0x0 [Type: _DETECTED_OEM_SOURCE_DEVICE *][0x060] ScalarValues [Type: _SETUP_LOADER_BLOCK_SCALARS][0x068] IniFile : 0x80100000 : ....[Version]..signature$Windows NT$ [Type: char *][0x06c] IniFileLength : 0x6fa78 [Type: unsigned long][0x070] WinntSifFile : 0x8000f000 : [Data]..AutoPartition1..MsDosInitiated0 [Type: char *][0x074] WinntSifFileLength : 0x46e [Type: unsigned long][0x078] MigrateInfFile : 0x0 [Type: char *][0x07c] MigrateInfFileLength : 0x0 [Type: unsigned long][0x080] UnsupDriversInfFile : 0x0 [Type: char *][0x084] UnsupDriversInfFileLength : 0x0 [Type: unsigned long]