• 彻底解决win11系统0x80070032

    经过各种尝试，终于找到原因。第一个是电脑加密软件，第二个是需要的部分功能没有开启，第三个BIOS设置。个人觉得第三个不重要。

    解决方法

    笔记本型号

    笔记本型号是Thinkpad T14 gen2。进入BIOS的按键是按住Enter键。

    1、关闭山丽防水墙服务

    这个公司安装的加密软件，没有的直接忽略即可。直接按住s键，然后搜索，全名是【Sanlen WaterValue Client Service】，先停止这个服务，然后右键-属性，把它改为手动或者禁用。装完系统后再给启动就行。如果部关闭服务，那个软件的进程无法关闭，会自动重启。

    2、 关闭进程

    同时按住ESC+Shift+Ctrl三个按键，会出现任务管理器，然后找到山丽防水墙，关闭它。

    3、BIOS设置

    • 进入BIOS，找到Inter virtualization和virtual dma kernel选项将其置为disable状态（也有人说只关闭dma即可，但是对我没有作用）。按照下图设置就行。

     4、windows功能启动

    这个比较重要，开启Hyper-V，适用于Linux的子系统，虚拟机平台，这个三个都开启。

    5、完结。

    6、去水印

    系统安装好之后，右下角会显示windows系统的信息，因为不是正版，我们需要一个小工具来解决

    百度搜索【UniversalWatermarkDisabler】这个工具，

    这里添加一个下载地址Universal Watermark Disabler下载_Universal Watermark Disabler官方版下载[系统水印去除]-下载之家

    -----华丽的分割线，以下是凑字数，大家不用花时间看，快去改代码-----

    -----华丽的分割线，以下是凑字数，大家不用花时间看，快去改代码-----

    -----华丽的分割线，以下是凑字数，大家不用花时间看，快去改代码-----

    以下是凑字数的，如果有使用的问题，欢迎大家交流。

    工具去水印原理

    分析painter_x64.dll

    1. BOOL __stdcall DllEntryPoint(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
    2. {
    3.   HMODULE v4; // rbx
    4.   HMODULE v5; // rax
    5.   BOOL (__stdcall *ExtTextOutW)(HDC, int, int, UINT, const RECT *, LPCWSTR, UINT, const INT *); // rax
    6.   HMODULE v7; // rax
    7.   int (__stdcall *LoadStringW)(HINSTANCE, UINT, LPWSTR, int); // rax
    8.   const CHAR *v9; // rcx
    9.   HMODULE v10; // rax
    10.  
    11.   if ( fdwReason == 1 )
    12.   {
    13.     OutputDebugStringA("Loaded");
    14.     v4 = GetModuleHandleW(L"shell32.dll");
    15.     if ( v4 )
    16.     {
    17.       v5 = GetModuleHandleW(L"gdi32.dll");
    18.       ExtTextOutW = (BOOL (__stdcall *)(HDC, int, int, UINT, const RECT *, LPCWSTR, UINT, const INT *))GetProcAddress(v5, "ExtTextOutW");
    19.       if ( ExtTextOutW )
    20.         sub_180001000("gdi32.dll", (__int64)ExtTextOutW, (__int64)sub_180001120, (__int64)v4);
    21.       v7 = GetModuleHandleW(L"api-ms-win-core-libraryloader-l1-2-0.dll");
    22.       LoadStringW = (int (__stdcall *)(HINSTANCE, UINT, LPWSTR, int))GetProcAddress(v7, "LoadStringW");
    23.       if ( LoadStringW )
    24.       {
    25.         v9 = "api-ms-win-core-libraryloader-l1-2-0.dll";
    26. LABEL_9:
    27.         sub_180001000(v9, (__int64)LoadStringW, (__int64)sub_180001100, (__int64)v4);
    28.         goto LABEL_10;
    29.       }
    30.       v10 = GetModuleHandleW(L"api-ms-win-core-libraryloader-l1-1-1.dll");
    31.       LoadStringW = (int (__stdcall *)(HINSTANCE, UINT, LPWSTR, int))GetProcAddress(v10, "LoadStringW");
    32.       if ( LoadStringW )
    33.       {
    34.         v9 = "api-ms-win-core-libraryloader-l1-1-1.dll";
    35.         goto LABEL_9;
    36.       }
    37.     }
    38. LABEL_10:
    39.     DisableThreadLibraryCalls(hinstDLL);
    40.   }
    41.   return 1;
    42. }
    43.

    sub_180001000

    1. __int64 __fastcall sub_180001000(LPCSTR lpString2, __int64 a2, __int64 a3, __int64 a4)
    2. {
    3.   _DWORD *v8; // rbx
    4.   unsigned int i; // eax
    5.   __int64 *v10; // rbx
    6.   DWORD flOldProtect; // [rsp+40h] [rbp+8h] BYREF
    7.  
    8.   if ( !lpString2 || !a2 || !a3 )
    9.     return 0i64;
    10.   v8 = (_DWORD *)(a4 + *(unsigned int *)(*(int *)(a4 + 60) + a4 + 144));
    11.   for ( i = v8[3]; i; v8 += 5 )
    12.   {
    13.     if ( !lstrcmpiA((LPCSTR)(a4 + i), lpString2) )
    14.       break;
    15.     i = v8[8];
    16.   }
    17.   if ( !v8[3] )
    18.     return 0i64;
    19.   v10 = (__int64 *)(a4 + (unsigned int)v8[4]);
    20.   if ( !*v10 )
    21.     return 0i64;
    22.   do
    23.   {
    24.     if ( *v10 == a2 )
    25.       break;
    26.     ++v10;
    27.   }
    28.   while ( *v10 );
    29.   if ( !*v10 )
    30.     return 0i64;
    31.   VirtualProtect(v10, 8ui64, 0x40u, &flOldProtect);
    32.   *v10 = a3;
    33.   VirtualProtect(v10, 8ui64, flOldProtect, &flOldProtect);
    34.   return 1i64;
    35. }

    sub_180001120

    1. BOOL __fastcall sub_180001120(HDC a1, int a2, int a3, UINT a4, const RECT *a5, const WCHAR *a6, UINT a7, const INT *a8)
    2. {
    3.   BOOL result; // eax
    4.  
    5.   if ( a4 || !a7 )
    6.     result = ExtTextOutW(a1, a2, a3, a4, a5, a6, a7, a8);
    7.   else
    8.     result = 1;
    9.   return result;
    10. }

    头文件

    1. typedef BOOL(*EXTTEXTOUTW)(HDC hdc, int x, int y, UINT options, RECT* lprect, LPCWSTR lpString, UINT c, INT* lpDx);
    2. typedef int (*GETIAT)(PVOID, BOOLEAN, USHORT, PULONG);
    3. typedef int(__fastcall* LOADSTRINGW)(HINSTANCE, UINT, LPWSTR, int);
    4. extern HMODULE hShell32;
    5. extern HMODULE hGdi32;
    6. extern HMODULE hDbgHelp;
    7. extern EXTTEXTOUTW pExtTextOutW;
    8. extern GETIAT pGetIAT;
    9.  
    10. void InitializeHook();
    11. BOOL HookFunction(LPCSTR szDllName, PVOID pFuncAddress, PVOID pHookFuncAddess, HMODULE hMod);
    12. BOOL __stdcall MyExtTextOutW(HDC hdc, int x, int y, UINT options, RECT* lprect, LPCWSTR lpString, UINT c, INT* lpDx);
    13. int __fastcall MyLoadStringW(HINSTANCE hInstance, UINT uID, LPWSTR lpBuffer, int cchBufferMax);

     cpp文件

    1. #include "pch.h"
    2. #include "Implement.h"
    3. #include 
    4. #include 
    5.  
    6. #pragma comment(lib, "dbghelp.lib")
    7. #pragma comment(linker, "/EXPORT:DllCanUnloadNow=explorerframe.DllCanUnloadNow,@1")
    8. #pragma comment(linker, "/EXPORT:DllGetClassObject=explorerframe.DllGetClassObject,@2")
    9.  
    10. HMODULE hShell32 = NULL;
    11. HMODULE hGdi32 = NULL;
    12. HMODULE hDbgHelp = NULL;
    13. EXTTEXTOUTW pExtTextOutW = NULL;
    14. GETIAT pGetIAT = NULL;
    15.  
    16. void InitializeHook()
    17. {
    18. 	do 
    19. 	{
    20. 		hShell32 = GetModuleHandleW(L"shell32.dll");
    21. 		if (hShell32 == NULL)
    22. 		{
    23. 			break;
    24. 		}
    25. 		hGdi32 = GetModuleHandleW(L"gdi32.dll");
    26. 		if (hGdi32 == NULL)
    27. 		{
    28. 			break;
    29. 		}
    30. 		pExtTextOutW = (EXTTEXTOUTW)GetProcAddress(hGdi32, "ExtTextOutW");
    31. 		if (pExtTextOutW == NULL)
    32. 		{
    33. 			break;
    34. 		}
    35. 		HMODULE hModuleApiMsWinCoreLibraryloader_l1_2_0 = GetModuleHandleW(L"api-ms-win-core-libraryloader-l1-2-0.dll");
    36. 		LOADSTRINGW pLoadStringW = (LOADSTRINGW)GetProcAddress(hModuleApiMsWinCoreLibraryloader_l1_2_0, "LoadStringW");
    37. 		if (pLoadStringW)
    38. 		{
    39. 			HookFunction("api-ms-win-core-libraryloader-l1-2-0.dll", pLoadStringW, MyLoadStringW, hShell32);
    40. 		}
    41. 		else
    42. 		{
    43. 			HMODULE hModuleApiMsWinCoreLibraryloader_l1_1_1 = GetModuleHandleW(L"api-ms-win-core-libraryloader-l1-1-1.dll");
    44. 			pLoadStringW = (LOADSTRINGW)GetProcAddress(hModuleApiMsWinCoreLibraryloader_l1_1_1, "LoadStringW");
    45. 			if (pLoadStringW)
    46. 			{
    47. 				HookFunction("api-ms-win-core-libraryloader-l1-1-1.dll", pLoadStringW, MyLoadStringW, hShell32);
    48. 			}
    49. 		}
    50. 		BOOL OK = HookFunction("gdi32.dll", pExtTextOutW, MyExtTextOutW, hShell32);
    51. 	} while (false);
    52. }
    53.  
    54. int __fastcall MyLoadStringW(HINSTANCE hInstance, UINT uID, LPWSTR lpBuffer, int cchBufferMax)
    55. {
    56. 	if (uID - 62000 <= 1)
    57. 	{
    58. 		return 0;
    59. 	}
    60. 	else
    61. 	{
    62. 		return LoadStringW(hInstance, uID, lpBuffer, cchBufferMax);
    63. 	}
    64. }
    65.  
    66. BOOL HookFunction(LPCSTR szDllName, PVOID pFuncAddress, PVOID pHookFuncAddess, HMODULE hMod)
    67. {
    68. 	if ((szDllName == NULL) ||
    69. 		(pFuncAddress == NULL) ||
    70. 		(pHookFuncAddess == NULL) ||
    71. 		(hMod == NULL))
    72. 	{
    73. 		return FALSE;
    74. 	}
    75.  
    76. 	ULONG ulSize = 0;
    77. 	PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor =
    78. 		(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(
    79. 			hMod, 
    80. 			TRUE,
    81. 			IMAGE_DIRECTORY_ENTRY_IMPORT,
    82. 			&ulSize);
    83. 	CStringA  strModuleName = "";
    84. 	while (pImportDescriptor->Name)
    85. 	{
    86. 		PSTR pszModuleName = (PSTR)((PBYTE)hMod + pImportDescriptor->Name);
    87. 		strModuleName = pszModuleName;
    88. 		if (strModuleName.CompareNoCase(szDllName) == 0)
    89. 		{
    90. 			break;
    91. 		}
    92. 		pImportDescriptor++;
    93. 	}
    94. 	
    95. 	if (strModuleName.GetLength() > 0)
    96. 	{
    97. 		PIMAGE_THUNK_DATA pThunk =
    98. 			(PIMAGE_THUNK_DATA)((PBYTE)hMod + pImportDescriptor->FirstThunk);
    99.  
    100. 		while (pThunk->u1.Function)
    101. 		{
    102. 			PROC* ppfn = (PROC*)&pThunk->u1.Function;
    103. 			BOOL bFound = (*ppfn == pFuncAddress);
    104.  
    105. 			if (bFound)
    106. 			{
    107. 				MEMORY_BASIC_INFORMATION mbi = { 0 };
    108. 				VirtualQuery(
    109. 					ppfn,
    110. 					&mbi,
    111. 					sizeof(MEMORY_BASIC_INFORMATION)
    112. 				);
    113. 				VirtualProtect(
    114. 					mbi.BaseAddress,
    115. 					mbi.RegionSize,
    116. 					PAGE_READWRITE,
    117. 					&mbi.Protect
    118. 				);
    119. 				*ppfn = ((PROC)pHookFuncAddess);
    120. 				VirtualProtect(
    121. 					mbi.BaseAddress,
    122. 					mbi.RegionSize,
    123. 					mbi.Protect,
    124. 					&mbi.Protect
    125. 				);
    126. 				return TRUE;
    127. 			}
    128. 			pThunk++;
    129. 		}
    130. 	}
    131. 	return FALSE;
    132. }
    133.  
    134.  
    135. BOOL __stdcall MyExtTextOutW(HDC hdc, int x, int y, UINT options, RECT* lprect, LPCWSTR lpString, UINT c, INT* lpDx)
    136. {
    137. 	BOOL bResult = FALSE;
    138. 	//CString str = lpString;
    139. 	//if (str.Find(L"测试模式") != -1 ||
    140. 	//     str.Find(L"Windows ") != -1 ||
    141. 	//     str.Find(L"Build ") != -1)
    142. 	//{
    143. 	//	return TRUE;
    144. 	//}
    145. 	if ((options != 0) || (c == 0))
    146. 	{
    147. 		return ExtTextOutW(hdc, x, y, options, lprect, lpString, c, lpDx);
    148. 	}
    149. 	return  TRUE;
    150. }
    151.  
    152. BOOL APIENTRY DllMain(HMODULE hModule,
    153. 	DWORD  ul_reason_for_call,
    154. 	LPVOID lpReserved
    155. )
    156. {
    157. 	switch (ul_reason_for_call)
    158. 	{
    159. 	case DLL_PROCESS_ATTACH:
    160. 	{
    161. 		InitializeHook();
    162. 		DisableThreadLibraryCalls(hModule);
    163. 	}
    164. 	break;
    165. 	case DLL_THREAD_ATTACH:
    166. 	case DLL_THREAD_DETACH:
    167. 	case DLL_PROCESS_DETACH:
    168. 		break;
    169. 	}
    170. 	return TRUE;
    171. }
  • 相关阅读:
    Facebook的ZeRO算法原理及简单代码实验（小显卡训大模型）
    java基础—String
    【小沐学Python】Python实现在线电子书（MkDocs + readthedocs + github + Markdown）
    文件属性和目录
    Airtest新手升级：一个相对完整的纯.py脚本是怎样子的
    使用手机通过Ip访问react项目 记录
    动态链接库(七)--解决不同调用约定导致的名字改编问题
    计算机基础知识34
    【LeetCode刷题-双指针】--16.最接近的三数之和
    Android--Map集合的使用
  • 原文地址：https://blog.csdn.net/renkai721/article/details/133177443