windows: 判断 win7 是否支持 sha256 驱动

修复 Image Name 为空时报错，例如 7601.24214.180801-1700.win7sp1_ldr_escrow_CLIENT_ULTIMATE_x64FRE_en-us.iso

trans.sh

@@ -704,26 +704,27 @@ is_have_rdnss() {
     [ -n "$rdnss" ]
 }
 
+# dd 完检测到镜像是 windows 时会改写此方法
 is_windows() {
-    for dir in /os /wim; do
+    [ "$distro" = windows ]
-        [ -d $dir/Windows/System32 ] && return 0
-    done
-    return 1
 }
 
 # 15063 或之后才支持 rdnss
 is_windows_support_rdnss() {
+    [ "$build_ver" -ge 15063 ]
+}
+
+get_windows_version_from_dll() {
+    local dll=$1
+    [ -f "$dll" ] || error_and_exit "File not found: $dll"
+
     apk add pev
-    for dir in /os /wim; do
+    local ver
-        dll=$dir/Windows/System32/kernel32.dll
+    ver="$(peres -v "$dll" | grep 'Product Version:' | awk '{print $NF}')"
-        if [ -f $dll ]; then
+    echo "Version: $ver" >&2
-            build_ver="$(peres -v $dll | grep 'Product Version:' | cut -d. -f3)"
+    IFS=. read -r nt_ver_major nt_ver_minor build_ver rev_ver _ < <(echo "$ver")
-            echo "Windows Build Version: $build_ver"
+    nt_ver="$nt_ver_major.$nt_ver_minor"
     apk del pev
-            [ "$build_ver" -ge 15063 ] && return 0 || return 1
-        fi
-    done
-    error_and_exit "Not found kernel32.dll"
 }
 
 is_elts() {
@@ -2781,9 +2782,15 @@ modify_windows() {
     # https://learn.microsoft.com/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-setup
 
     # 判断用 SetupComplete 还是组策略
-    state_ini=$os_dir/Windows/Setup/State/State.ini
+    # 默认视为 IMAGE_STATE_COMPLETE，除非有 State.ini，因为 dd 镜像可能精简了 State.ini
-    cat $state_ini
+    # 但最好还是从注册表获取
-    if grep -q IMAGE_STATE_COMPLETE $state_ini; then
+    image_state=IMAGE_STATE_COMPLETE
+    if state_ini=$(find_file_ignore_case $os_dir/Windows/Setup/State/State.ini); then
+        cat -n $state_ini
+        image_state=$(grep -i '^ImageState=' $state_ini | cut -d= -f2 | tr -d '\r')
+    fi
+
+    if [ "$image_state" = IMAGE_STATE_COMPLETE ]; then
         use_gpo=true
     else
         use_gpo=false
@@ -3556,8 +3563,12 @@ modify_os_on_disk() {
                 # find /mnt/c -iname windows -type d -maxdepth 1
                 # find: /mnt/c/pagefile.sys: Permission denied
                 # find: /mnt/c/swapfile.sys: Permission denied
-                # shellcheck disable=SC2010
+                # shellcheck disable=SC1090
-                if ls -d /os/*/ | grep -i '/windows/' 2>/dev/null; then
+                # find_file_ignore_case 也在这个文件里面
+                . <(wget -O- $confhome/windows-driver-utils.sh)
+                if ntoskrnl_exe=$(find_file_ignore_case /os/Windows/System32/ntoskrnl.exe 2>/dev/null); then
+                    # 其他地方会用到
+                    is_windows() { true; }
                     # 重新挂载为读写、忽略大小写
                     umount /os
                     mount -t ntfs3 -o nocase /dev/$part /os
@@ -3565,6 +3576,8 @@ modify_os_on_disk() {
                     if mount | grep ' /os ' | grep -wq ro; then
                         error_and_exit "Can't mount windows partition /dev/$part as rw."
                     fi
+                    # 获取版本号，其他地方会用到
+                    get_windows_version_from_dll "$ntoskrnl_exe"
                     modify_windows /os
                     return
                 fi
@@ -4846,6 +4859,7 @@ dd_qcow() {
     # 将前1M从内存 dd 到硬盘
     umount /installer/
     dd if=/first-1M of=/dev/$xda
+    rm -f /first-1M
 
     # gpt 分区表开头记录了备份分区表的位置
     # 如果 qcow2 虚拟容量 大于 实际硬盘容量
@@ -5148,7 +5162,7 @@ get_server_name_by_build_ver() {
         echo 2012
     elif [ "$build_ver" -ge 7600 ]; then
         echo 2008 r2
-    elif [ "$build_ver" -ge 6000 ]; then
+    elif [ "$build_ver" -ge 6001 ]; then
         echo 2008
     else
         error_and_exit "Unknown Build Version: $build_ver"
@@ -5230,11 +5244,15 @@ install_windows() {
     }
 
     info "Process windows iso"
+    mkdir -p /iso /wim
+
+    # find_file_ignore_case 也在这个文件里面
+    # shellcheck disable=SC1090
+    . <(wget -O- $confhome/windows-driver-utils.sh)
 
     apk add wimlib
 
     download $iso /os/windows.iso
-    mkdir -p /iso
     mount -o ro /os/windows.iso /iso
 
     # 防止用了不兼容架构的 iso
@@ -5272,12 +5290,14 @@ install_windows() {
     if [ "$image_count" = 1 ]; then
         # 只有一个版本就用那个版本
         image_name=$all_image_names
+        image_index=1
     else
         while true; do
             # 匹配成功
             # 改成正确的大小写
             if matched_image_name=$(echo "$all_image_names" | grep -ix "$image_name"); then
                 image_name=$matched_image_name
+                image_index=$(wiminfo "$iso_install_wim" "$image_name" | grep 'Index:' | awk '{print $NF}')
                 break
             fi
 
@@ -5298,7 +5318,7 @@ install_windows() {
     fi
 
     get_selected_image_prop() {
-        get_image_prop "$iso_install_wim" "$image_name" "$1"
+        get_image_prop "$iso_install_wim" "$image_index" "$1"
     }
 
     # 多会话的信息来自注册表，因为没有官方 iso
@@ -5344,12 +5364,45 @@ install_windows() {
         ;;
     esac
 
+    # 挂载 install.wim，检查
+    # 1. 是否自带 sac 组件
+    # 2. 是否自带 nvme 驱动
+    # 3. 是否支持 sha256
+
+    wimmount "$iso_install_wim" "$image_index" /wim/
+    {
+        find_file_ignore_case /wim/Windows/System32/sacsess.exe && has_sac=true || has_sac=false
+        find_file_ignore_case /wim/Windows/INF/stornvme.inf && has_stornvme=true || has_stornvme=false
+    } >/dev/null 2>&1
+
+    support_sha256=false
+    if is_nt_ver_ge 6.2; then
+        support_sha256=true
+    else
+        # https://www.hummingheads.co.jp/press/info-certificates.html
+        # https://support.microsoft.com/kb/KB3033929
+        # https://support.microsoft.com/kb/KB4474419
+        # Windows Vista SP2 ldr_escrow   6.0.6003 + KB4474419
+        # Windows 7     SP1              6.1.7601 + KB3033929
+        ntoskrnl_exe=$(find_file_ignore_case /wim/Windows/System32/ntoskrnl.exe)
+        get_windows_version_from_dll "$ntoskrnl_exe"
+        if { [ "$nt_ver" = 6.0 ] && [ "$build_ver" -ge 6003 ] && [ "$rev_ver" -ge 20555 ]; } ||
+            { [ "$nt_ver" = 6.1 ] && [ "$build_ver" -ge 7601 ] && [ "$rev_ver" -ge 18741 ]; }; then
+            support_sha256=true
+        fi
+    fi
+    wimunmount /wim/
+
     info "Selected image info"
     echo "Image Name: $image_name"
     echo "Product Version: $product_ver"
     echo "Windows Type: $windows_type"
     echo "NT Version: $nt_ver"
     echo "Build Version: $build_ver"
+    echo "-------------------------"
+    echo "Has SAC: $has_sac"
+    echo "Has StorNVMe: $has_stornvme"
+    echo "Support SHA256: $support_sha256"
     echo
 
     # 复制 boot.wim 到 /os，用于临时编辑
@@ -5401,7 +5454,7 @@ install_windows() {
     #       （意义不大，因为已经删除了 boot.wim 用来创建虚拟内存，vista 除外）
     # 缺点: 如果 install.wim 只有一个镜像，则只能缩小 10M+
     if false; then
-        time wimexport --threads "$(get_build_threads 512)" "$iso_install_wim" "$image_name" "$install_wim"
+        time wimexport --threads "$(get_build_threads 512)" "$iso_install_wim" "$image_index" "$install_wim"
         info "install.wim size"
         echo "Original:  $(get_filesize_mb "$iso_install_wim")"
         echo "Optimized: $(get_filesize_mb "$install_wim")"
@@ -5415,7 +5468,7 @@ install_windows() {
     # https://github.com/pbatard/rufus/issues/1990
     # https://learn.microsoft.com/windows/iot/iot-enterprise/Hardware/System_Requirements
     if [ "$product_ver" = "11" ] && [ "$(nproc)" -le 1 ]; then
-        wiminfo "$install_wim" "$image_name" --image-property WINDOWS/INSTALLATIONTYPE=Server
+        wiminfo "$install_wim" "$image_index" --image-property WINDOWS/INSTALLATIONTYPE=Server
     fi
 
     # 变量名     使用场景
@@ -5450,10 +5503,6 @@ install_windows() {
         drv=/os/drivers
         mkdir -p "$drv" # 驱动下载临时文件夹
 
-        # 下载脚本
-        # shellcheck disable=SC1090
-        . <(wget -O- $confhome/windows-driver-utils.sh)
-
         # 这里有坑
         # $(get_cloud_vendor) 调用了 cache_dmi_and_virt
         # 但是 $(get_cloud_vendor) 运行在 subshell 里面
@@ -5473,18 +5522,19 @@ install_windows() {
                 add_driver_huawei_virtio
 
             # gcp 官方驱动不全，需要用公版补全
-            elif [ "$vendor" = gcp ] && [ "$nt_ver" = 6.1 ] && [ "$arch_wim" = x86_64 ]; then
+            # 官方 windows server 模板没有 viorng 设备，但 linux 模板有
-                add_driver_gcp_virtio_win6_1_sha1_x64
+            elif [ "$vendor" = gcp ] && is_nt_ver_ge 6.1 && [ "$arch_wim" = x86 ] && $support_sha256; then
-                add_driver_generic_virtio \( -iname viorng.inf -or -iname balloon.inf \)
-
-            elif [ "$vendor" = gcp ] && is_nt_ver_ge 6.2 && [ "$arch_wim" = x86 ]; then
                 add_driver_gcp_virtio
                 add_driver_generic_virtio \( -iname viorng.inf -or -iname pvpanic.inf \)
 
-            elif [ "$vendor" = gcp ] && is_nt_ver_ge 6.2 && [ "$arch_wim" = x86_64 ]; then
+            elif [ "$vendor" = gcp ] && is_nt_ver_ge 6.1 && [ "$arch_wim" = x86_64 ] && $support_sha256; then
                 add_driver_gcp_virtio
                 add_driver_generic_virtio -iname viorng.inf
 
+            elif [ "$vendor" = gcp ] && [ "$nt_ver" = 6.1 ] && [ "$arch_wim" = x86_64 ] && ! $support_sha256; then
+                add_driver_gcp_virtio_win6_1_sha1_x64
+                add_driver_generic_virtio \( -iname viorng.inf -or -iname balloon.inf \)
+
             else
                 # 兜底
                 add_driver_generic_virtio
@@ -5554,8 +5604,9 @@ install_windows() {
 
         file=$(
             case "$product_ver" in
-            '7' | '2008 r2') echo 29323/eng/prowin${arch_intel}legacy.exe ;; # 24.3 sha1 签名
+            '7' | '2008 r2') $support_sha256 &&
-            # '7' | '2008 r2') echo 18713/eng/prowin${arch_intel}legacy.exe ;; # 25.0 有部分文件是 sha256 签名
+                echo echo 18713/eng/prowin${arch_intel}legacy.exe || # 25.0 有部分文件是 sha256 签名
+                echo 29323/eng/prowin${arch_intel}legacy.exe ;;      # 24.3 sha1 签名
             '8') echo 21642/eng/prowin${arch_intel}.exe ;;
             '8.1') echo 764813/Wired_driver_27.8_${arch_intel}.zip ;;
             '2012' | '2012 r2') echo 785805/Wired_driver_28.2_${arch_intel}.zip ;;
@@ -5663,8 +5714,7 @@ EOF
 
         ena_ver=$(
             case "$nt_ver" in
-            6.1) echo 2.1.4 ;; # sha1 签名
+            6.1) $support_sha256 && echo 2.2.3 || echo 2.1.4 ;;
-            # 6.1) echo 2.2.3 ;; # sha256 签名
             6.2 | 6.3) echo 2.6.0 ;;
             *) echo Latest ;;
             esac
@@ -5708,8 +5758,7 @@ EOF
 
         aws_pv_ver=$(
             case "$nt_ver" in
-            6.1) echo 8.3.2 ;; # sha1 签名
+            6.1) $support_sha256 && echo 8.3.5 || echo echo 8.3.2 ;;
-            # 6.1) echo 8.3.5 ;; # sha256 签名
             6.2 | 6.3) echo 8.4.3 ;;
             *) echo Latest ;;
             esac
@@ -5790,14 +5839,15 @@ EOF
         # 173-9        不是稳定版?
         # 185 ~ 187    win7 vioscsi 是 sha256 签名
         # 189 ~ 215    win7 vultr 气球驱动死机
-        # 217 ~ 266    win7 甲骨文 vioscsi 用不了，即使是红帽的 virtio-win-1.9.44 也用不了
+        # 217 ~ 271    win7 甲骨文 vioscsi 用不了，即使是红帽的 virtio-win-1.9.45 也用不了
-        # 217 ~ 266    2k12 证书有问题
+        # 217 ~ 271    2k12 证书有问题
 
         # 2008 安装的气球驱动不能用，需要到硬件管理器重新安装设备才能用，无需更新驱动
 
         # https://github.com/virtio-win/virtio-win-pkg-scripts/issues/40
         # https://github.com/virtio-win/virtio-win-pkg-scripts/issues/61
         case "$nt_ver" in
+        # 最新版里面的 win2008 win7 是 sha1 签名的，但是甲骨文 vioscsi 用不了
         6.0 | 6.1) dir=archive-virtio/virtio-win-0.1.173-9 ;; # vista|w7|2k8|2k8R2
         6.2 | 6.3) dir=archive-virtio/virtio-win-0.1.215-2 ;; # w8|w8.1|2k12|2k12R2
         *) dir=stable-virtio ;;
@@ -5941,38 +5991,21 @@ EOF
     add_driver_aliyun_virtio() {
         info "Add drivers: Aliyun virtio"
 
-        # win7 旧驱动是 sha1 签名
+        # win7 sha1 旧驱动
-        if [ "$nt_ver" = 6.1 ]; then
+        if [ "$nt_ver" = 6.1 ] && ! $support_sha256; then
-            # 旧驱动
+            filename=210408.1454.1459_bin.zip # sha1
-            aliyun_sys=$(
+            # filename=220915.0953.0953_bin.zip # sha256
-                case "$nt_ver" in
+            # filename=new_virtio.zip           # sha256
-                6.1) echo 7 ;;
-                6.2 | 6.3) echo 8 ;;
-                *) echo 10 ;;
-                esac
-            )
 
-            filename=$(
-                case "$nt_ver" in
-                6.1) echo 210408.1454.1459_bin.zip ;; # sha1
-                *) echo 220915.0953.0953_bin.zip ;;   # sha256
-                # *) echo new_virtio.zip ;;
-                esac
-            )
-
-            region=$(
             if is_in_china; then
-                    echo cn-beijing
+                region=cn-beijing
             else
-                    echo us-west-1
+                region=us-west-1
             fi
-            )
 
             download https://windows-driver-$region.oss-$region.aliyuncs.com/virtio/$filename $drv/aliyun.zip
             unzip -o -d $drv/aliyun/ $drv/aliyun.zip
-
+            cp_drivers $drv/aliyun -ipath "*/win7/${arch}/*"
-            # 注意文件夹是 win7 Win8 win10 大小写不一致
-            cp_drivers $drv/aliyun -ipath "*/win${aliyun_sys}/${arch}/*"
         else
             # 新驱动
             aliyun_sys=$(
@@ -5996,7 +6029,7 @@ EOF
         fi
     }
 
-    # gcp virtio win7 x64
+    # gcp virtio win7 x64 sha1
     # 缺 balloon viorng
     add_driver_gcp_virtio_win6_1_sha1_x64() {
         info "Add drivers: GCP virtio win6.1 sha1 x64"
@@ -6005,15 +6038,15 @@ EOF
         for file in \
             WdfCoInstaller01009.dll WdfCoInstaller01011.dll \
             netkvm.inf netkvm.cat netkvm.sys netkvmco.dll \
-            nvme.inf nvme64.cat nvme.sys \
             pvpanic.inf pvpanic.sys pvpanic.cat \
-            vioscsi.inf vioscsi.sys vioscsi.cat; do
+            vioscsi.inf vioscsi.sys vioscsi.cat \
+            $([ -d /sys/module/nvme ] && ! $has_stornvme && echo nvme.inf nvme64.cat nvme.sys); do
             download https://storage.googleapis.com/gce-windows-drivers-public/win6.1sha1/$file $drv/gce/win6.1sha1/$file
         done
         cp_drivers $drv/gce/win6.1sha1
     }
 
-    # gcp virtio win8+
+    # gcp virtio win7+ sha256
     # x86 缺 viorng pvpanic
     # x64 缺 viorng
     # https://github.com/GoogleCloudPlatform/compute-image-tools/tree/master/daisy_workflows/image_build/windows
@@ -6063,7 +6096,9 @@ EOF
             link=$(grep -o "/pool/.*-google-compute-engine-driver-$part.*\.goo" $drv/gce/gce.json)
             wget $gce_repo$link -O- | tar xz -C $drv/gce/$part
 
-            # inf 不限版本，6.0 能装 6.1 的驱动但用不了
+            # inf 不限版本
+            # 但 win7 gvnic ndis 版本是 6.2，vista/2008 能装但用不了
+            # https://github.com/GoogleCloudPlatform/compute-virtual-ethernet-windows/blob/cad1edf7a05465f4972a81f2c015952fd228b5e3/src/gvnic.vcxproj#L298
             if false; then
                 for suffix in '' '-32'; do
                     if [ -d "$drv/gce/$part/win6.1$suffix" ]; then
@@ -6126,6 +6161,8 @@ EOF
     locale=$(get_selected_image_prop 'Default Language')
     use_default_rdp_port=$(is_need_change_rdp_port && echo false || echo true)
     password_base64=$(get_password_windows_administrator_base64)
+    # 7601.24214.180801-1700.win7sp1_ldr_escrow_CLIENT_ULTIMATE_x64FRE_en-us.iso Image Name 为空
+    # 将 xml Image Name 的值设为空可以正常安装
     sed -i \
         -e "s|%arch%|$arch|" \
         -e "s|%image_name%|$image_name|" \
@@ -6152,7 +6189,7 @@ EOF
     # 评估版 iso ei.cfg 有 EVAL 字样，填空白 key 报错 Windows Cannot find Microsoft software license terms
 
     # key
-    if [[ "$image_name" = 'Windows Vista*' ]]; then
+    if [ "$product_ver" = vista ]; then
         # vista 需密钥，密钥可与 edition 不一致
         # TODO: 改成从网页获取？
         # https://learn.microsoft.com/en-us/windows-server/get-started/kms-client-activation-keys
@@ -6169,13 +6206,6 @@ EOF
         fi
     fi
 
-    mkdir -p /wim
-
-    # 挂载 install.wim，检查是否有 sac 组件
-    wimmount "$install_wim" "$image_name" /wim/
-    [ -f /wim/Windows/System32/sacsess.exe ] && has_sac=true || has_sac=false
-    wimunmount /wim/
-
     # 挂载 boot.wim
     info "mount boot.wim"
     wimmountrw /os/boot.wim "$boot_index" /wim/
@@ -6306,7 +6336,7 @@ EOF
     # 所以复制 resize.bat 到 install.wim
     if true; then
         info "mount install.wim"
-        wimmountrw $install_wim "$image_name" /wim/
+        wimmountrw $install_wim "$image_index" /wim/
         if false; then
             # 使用 autounattend.xml
             # win7 在此阶段找不到网卡