一个安全中心的右键菜单（能实时开启和关闭 Win defender实时防护和防篡改）

qq8899399 · 发表于昨天 16:34

本帖最后由 qq8899399 于 2025-12-13 21:20 编辑

MDL 论坛翻到的一个小软件原作者项目地址是https://github.com/wesmar/WinDefCtl
核心能力
实时保护控制- 启用/禁用/检查 RTP 状态
防篡改保护控制- 启用/禁用/检查防篡改保护状态
隐蔽执行- 使用 DWM 隐形技术的隐形窗口管理
自动UAC处理- 临时抑制UAC并自动恢复
冷启动检测- 登录后首次运行时的智能预热
可靠的操作确认- 用于 UI 更改的结构密度检测

技术实施
UI自动化API - 无需操作注册表或服务
多层窗口隐藏- 不透明度控制、DWM 隐身、屏幕外定位
智能超时机制- 延长慢速硬件的等待时间（10 秒）
会话感知预热- 用于优化性能的易失性注册表标记
原子操作- 完全成功或自动回滚
UAC恢复系统- 崩溃或中断时自动恢复

对作者PS1 脚本做了修改，支持
WinDefCtl.ps1 all on 一键启用
WinDefCtl.ps1 all off 一键关闭

使用方法WinDefCtl.ps1和右键整合的批处理放同一目录然后运行批处理进行右键功能添加和删除

如图

WinDefCtl脚本如下

#Requires -RunAsAdministrator
# WinDefCtl.ps1 - Windows Defender Automation & Control Utility
# PowerShell Edition - Real-Time Protection and Tamper Protection Management
# Author: Marek Wesolowski - WESMAR - 2025
param(
[Parameter(Mandatory=$true, Position=0)]
[ValidateSet('rtp', 'tp', 'all')]
[string]$Command,
[Parameter(Mandatory=$false, Position=1)]
[ValidateSet('on', 'off', 'status')]
[string]$Action = 'status'
)
# ============================================================================
# UI Automation Setup
# ============================================================================
Add-Type -AssemblyName UIAutomationClient
Add-Type -AssemblyName UIAutomationTypes
Add-Type @"
using System;
using System.Runtime.InteropServices;
using System.Text;
public class WinAPI {
[DllImport("user32.dll")]
public static extern bool EnumWindows(EnumWindowsProc enumProc, IntPtr lParam);
[DllImport("user32.dll")]
public static extern int GetClassName(IntPtr hWnd, StringBuilder text, int count);
[DllImport("user32.dll")]
public static extern bool IsWindowVisible(IntPtr hWnd);
[DllImport("user32.dll")]
public static extern bool SetForegroundWindow(IntPtr hWnd);
[DllImport("user32.dll")]
public static extern IntPtr SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll")]
public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
[DllImport("user32.dll")]
public static extern bool IsWindow(IntPtr hWnd);
public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);
public const uint WM_SYSCOMMAND = 0x0112;
public const uint SC_CLOSE = 0xF060;
public const uint WM_CLOSE = 0x0010;
public const int SW_SHOWMINNOACTIVE = 7;
}
"@
# ============================================================================
# Registry Helper Functions
# ============================================================================
$UAC_REG_PATH = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$VOLATILE_KEY_PATH = "HKCU:\Software\Temp"
$KEY_NOT_EXISTED = 0xFF
function Read-RegistryDword {
param(
[string]$Path,
[string]$Name
)
try {
if (Test-Path $Path) {
$value = Get-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
if ($null -ne $value) {
return @{
Value = $value.$Name
Existed = $true
}
}
}
}
catch { }
return @{
Value = 0
Existed = $false
}
}
function Write-RegistryDword {
param(
[string]$Path,
[string]$Name,
[int]$Value
)
try {
if (-not (Test-Path $Path)) {
New-Item -Path $Path -Force | Out-Null
}
Set-ItemProperty -Path $Path -Name $Name -Value $Value -Type DWord -Force
return $true
}
catch {
return $false
}
}
function Remove-RegistryValue {
param(
[string]$Path,
[string]$Name
)
try {
if (Test-Path $Path) {
Remove-ItemProperty -Path $Path -Name $Name -ErrorAction SilentlyContinue
}
return $true
}
catch {
return $false
}
}
# ============================================================================
# UAC Management Functions
# ============================================================================
function Encode-UACStatus {
param(
[int]$CPBA,
[bool]$CPBAExisted,
[int]$POSD,
[bool]$POSDExisted
)
$cpbaValue = if ($CPBAExisted) { $CPBA -band 0xFF } else { $KEY_NOT_EXISTED }
$posdValue = if ($POSDExisted) { $POSD -band 0xFF } else { $KEY_NOT_EXISTED }
$encoded = $cpbaValue -bor ($posdValue -shl 8)
return $encoded
}
function Decode-UACStatus {
param([int]$Encoded)
$cpbaByte = $Encoded -band 0xFF
$posdByte = ($Encoded -shr 8) -band 0xFF
return @{
CPBA = if ($cpbaByte -ne $KEY_NOT_EXISTED) { $cpbaByte } else { 0 }
CPBAExisted = ($cpbaByte -ne $KEY_NOT_EXISTED)
POSD = if ($posdByte -ne $KEY_NOT_EXISTED) { $posdByte } else { 0 }
POSDExisted = ($posdByte -ne $KEY_NOT_EXISTED)
}
}
function Backup-UAC {
Write-Host " [*] Backing up and disabling UAC prompts..."
$cpba = Read-RegistryDword -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin"
$posd = Read-RegistryDword -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop"
$encoded = Encode-UACStatus -CPBA $cpba.Value -CPBAExisted $cpba.Existed -POSD $posd.Value -POSDExisted $posd.Existed
if (-not (Write-RegistryDword -Path $UAC_REG_PATH -Name "UACStatus" -Value $encoded)) {
return $false
}
$success = $true
$success = $success -and (Write-RegistryDword -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin" -Value 0)
$success = $success -and (Write-RegistryDword -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop" -Value 0)
return $success
}
function Restore-UAC {
Write-Host " [*] Restoring original UAC settings..."
$backup = Read-RegistryDword -Path $UAC_REG_PATH -Name "UACStatus"
if (-not $backup.Existed) {
return $false
}
$decoded = Decode-UACStatus -Encoded $backup.Value
if ($decoded.CPBAExisted) {
Write-RegistryDword -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin" -Value $decoded.CPBA | Out-Null
}
else {
Remove-RegistryValue -Path $UAC_REG_PATH -Name "ConsentPromptBehaviorAdmin" | Out-Null
}
if ($decoded.POSDExisted) {
Write-RegistryDword -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop" -Value $decoded.POSD | Out-Null
}
else {
Remove-RegistryValue -Path $UAC_REG_PATH -Name "PromptOnSecureDesktop" | Out-Null
}
Remove-RegistryValue -Path $UAC_REG_PATH -Name "UACStatus" | Out-Null
return $true
}
function Test-UACBackupExists {
$backup = Read-RegistryDword -Path $UAC_REG_PATH -Name "UACStatus"
return $backup.Existed
}
function Recover-UACIfNeeded {
if (Test-UACBackupExists) {
Write-Host " [RECOVERY] Found incomplete UAC backup, restoring..."
return Restore-UAC
}
return $true
}
# ============================================================================
# Cold Boot Detection (Volatile Registry Marker)
# ============================================================================
function Test-ColdBoot {
# Volatile key in HKCU:\Software\Temp - disappears on logout/reboot
try {
$marker = Get-ItemProperty -Path "$VOLATILE_KEY_PATH" -Name "WinDefCtl_Warmed" -ErrorAction SilentlyContinue
return ($null -eq $marker)
}
catch {
return $true
}
}
function Set-WarmMarker {
try {
# Create volatile registry key - will disappear on session end
if (-not (Test-Path $VOLATILE_KEY_PATH)) {
New-Item -Path $VOLATILE_KEY_PATH -Force | Out-Null
}
# Unfortunately PowerShell doesn't support REG_OPTION_VOLATILE directly
# We'll use reg.exe for true volatile key creation
& reg add "HKCU\Software\Temp" /v "WinDefCtl_Warmed" /t REG_DWORD /d 1 /f | Out-Null
return $true
}
catch {
return $false
}
}
# ============================================================================
# Window Management Functions
# ============================================================================
function Find-SecurityWindow {
param([int]$MaxRetries = 10)
$script:foundWindow = $null
for ($i = 0; $i -lt $MaxRetries; $i++) {
$callback = [WinAPI+EnumWindowsProc] {
param($hwnd, $lParam)
$className = New-Object System.Text.StringBuilder 256
[WinAPI]::GetClassName($hwnd, $className, 256) | Out-Null
if ($className.ToString() -eq "ApplicationFrameWindow" -and [WinAPI]::IsWindowVisible($hwnd)) {
$script:foundWindow = $hwnd
return $false
}
return $true
}
[WinAPI]::EnumWindows($callback, [IntPtr]::Zero) | Out-Null
if ($script:foundWindow) {
return $script:foundWindow
}
Start-Sleep -Milliseconds 100
}
return $null
}
function Close-SecurityWindow {
param([IntPtr]$WindowHandle)
if ($WindowHandle -eq [IntPtr]::Zero -or -not [WinAPI]::IsWindow($WindowHandle)) {
return
}
# Try SetForegroundWindow + SC_CLOSE
[WinAPI]::SetForegroundWindow($WindowHandle) | Out-Null
Start-Sleep -Milliseconds 100
[WinAPI]::SendMessage($WindowHandle, [WinAPI]::WM_SYSCOMMAND, [IntPtr][WinAPI]::SC_CLOSE, [IntPtr]::Zero) | Out-Null
# Wait for window to close
$closed = $false
for ($i = 0; $i -lt 30; $i++) {
if (-not [WinAPI]::IsWindow($WindowHandle)) {
$closed = $true
break
}
Start-Sleep -Milliseconds 100
}
# Fallback to WM_CLOSE if needed
if (-not $closed) {
[WinAPI]::SendMessage($WindowHandle, [WinAPI]::WM_CLOSE, [IntPtr]::Zero, [IntPtr]::Zero) | Out-Null
Start-Sleep -Milliseconds 1000
}
}
# ============================================================================
# Pre-Warming for Cold Boot
# ============================================================================
function Invoke-PreWarmDefender {
Write-Host " [*] Cold boot detected - pre-warming Windows Defender..."
Start-Process "windowsdefender://threatsettings" -WindowStyle Hidden
Start-Sleep -Milliseconds 800
$hwnd = Find-SecurityWindow -MaxRetries 10
if ($hwnd) {
Write-Host " [*] Pre-warm window found, waiting for full initialization..."
Start-Sleep -Milliseconds 800
Write-Host " [*] Closing pre-warm window..."
Close-SecurityWindow -WindowHandle $hwnd
Set-WarmMarker | Out-Null
Write-Host " [*] Pre-warm complete"
return $true
}
Write-Host " [WARN] Pre-warm window not found, continuing anyway..."
return $false
}
# ============================================================================
# UI Automation Functions
# ============================================================================
function Wait-UILoaded {
param(
[System.Windows.Automation.AutomationElement]$RootElement,
[int]$MaxRetries = 50
)
for ($i = 0; $i -lt $MaxRetries; $i++) {
try {
$descendants = $RootElement.FindAll(
[System.Windows.Automation.TreeScope]::Descendants,
[System.Windows.Automation.Condition]::TrueCondition
)
if ($descendants.Count -gt 10) {
return $true
}
}
catch { }
Start-Sleep -Milliseconds 100
}
return $false
}
function Get-ElementCount {
param([System.Windows.Automation.AutomationElement]$RootElement)
try {
$descendants = $RootElement.FindAll(
[System.Windows.Automation.TreeScope]::Descendants,
[System.Windows.Automation.Condition]::TrueCondition
)
return $descendants.Count
}
catch {
return 0
}
}
function Wait-StructureChange {
param(
[System.Windows.Automation.AutomationElement]$RootElement,
[int]$BaselineCount,
[bool]$ExpectIncrease,
[int]$TimeoutSeconds = 10
)
Write-Host " [*] Waiting for UI update..." -NoNewline
$maxLoops = $TimeoutSeconds * 10
for ($i = 0; $i -lt $maxLoops; $i++) {
$currentCount = Get-ElementCount -RootElement $RootElement
$structureChanged = if ($ExpectIncrease) {
$currentCount -gt $BaselineCount
} else {
$currentCount -lt $BaselineCount
}
if ($structureChanged) {
Start-Sleep -Milliseconds 200
$recheckCount = Get-ElementCount -RootElement $RootElement
$stable = if ($ExpectIncrease) {
$recheckCount -gt $BaselineCount
} else {
$recheckCount -lt $BaselineCount
}
if ($stable) {
Write-Host " [OK]"
return $true
}
}
Start-Sleep -Milliseconds 100
}
Write-Host " [WARN] Timeout."
return $false
}
function Find-FirstToggleSwitch {
param([System.Windows.Automation.AutomationElement]$RootElement)
$condition = New-Object System.Windows.Automation.PropertyCondition(
[System.Windows.Automation.AutomationElement]::ControlTypeProperty,
[System.Windows.Automation.ControlType]::Button
)
$buttons = $RootElement.FindAll([System.Windows.Automation.TreeScope]::Descendants, $condition)
foreach ($button in $buttons) {
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
if ($togglePattern) {
return $button
}
}
catch { }
}
return $null
}
function Find-LastToggleSwitch {
param([System.Windows.Automation.AutomationElement]$RootElement)
$condition = New-Object System.Windows.Automation.PropertyCondition(
[System.Windows.Automation.AutomationElement]::ControlTypeProperty,
[System.Windows.Automation.ControlType]::Button
)
$buttons = $RootElement.FindAll([System.Windows.Automation.TreeScope]::Descendants, $condition)
$lastToggle = $null
foreach ($button in $buttons) {
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
if ($togglePattern) {
$lastToggle = $button
}
}
catch { }
}
return $lastToggle
}
# ============================================================================
# Real-Time Protection Functions
# ============================================================================
function Get-RTPStatus {
param([System.Windows.Automation.AutomationElement]$RootElement)
$button = Find-FirstToggleSwitch -RootElement $RootElement
if (-not $button) {
return $null
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
$isEnabled = ($state -eq [System.Windows.Automation.ToggleState]::On)
Write-Host " [*] RTP Status: $(if ($isEnabled) { 'ENABLED' } else { 'DISABLED' })"
return $isEnabled
}
catch {
return $null
}
}
function Enable-RTP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-FirstToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::Off) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $false
}
else {
Write-Host " [*] RTP already enabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
function Disable-RTP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-FirstToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::On) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $true
}
else {
Write-Host " [*] RTP already disabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
# ============================================================================
# Tamper Protection Functions
# ============================================================================
function Get-TPStatus {
param([System.Windows.Automation.AutomationElement]$RootElement)
$button = Find-LastToggleSwitch -RootElement $RootElement
if (-not $button) {
return $null
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
$isEnabled = ($state -eq [System.Windows.Automation.ToggleState]::On)
Write-Host " [*] Tamper Protection Status: $(if ($isEnabled) { 'ENABLED' } else { 'DISABLED' })"
return $isEnabled
}
catch {
return $null
}
}
function Enable-TP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-LastToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::Off) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $false
}
else {
Write-Host " [*] Tamper Protection already enabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
function Disable-TP {
param([System.Windows.Automation.AutomationElement]$RootElement)
if (-not (Backup-UAC)) {
return $false
}
$button = Find-LastToggleSwitch -RootElement $RootElement
if (-not $button) {
Restore-UAC | Out-Null
return $false
}
try {
$togglePattern = $button.GetCurrentPattern([System.Windows.Automation.TogglePattern]::Pattern)
$state = $togglePattern.Current.ToggleState
if ($state -eq [System.Windows.Automation.ToggleState]::On) {
$baseline = Get-ElementCount -RootElement $RootElement
$togglePattern.Toggle()
$result = Wait-StructureChange -RootElement $RootElement -BaselineCount $baseline -ExpectIncrease $true
}
else {
Write-Host " [*] Tamper Protection already disabled"
$result = $true
}
Restore-UAC | Out-Null
return $result
}
catch {
Restore-UAC | Out-Null
return $false
}
}
# ============================================================================
# Process Single Command
# ============================================================================
function Process-SingleCommand {
param(
[string]$Cmd,
[string]$Act
)
Write-Host ""
Write-Host "=== Windows Defender $(if ($Cmd -eq 'rtp') { 'RTP' } else { 'Tamper Protection' }) Control ===" -ForegroundColor Cyan
Write-Host ""
# Check for incomplete UAC backup from previous crash
Recover-UACIfNeeded | Out-Null
Write-Host " [*] Opening Windows Defender..."
# Pre-warming on cold boot
if (Test-ColdBoot) {
Invoke-PreWarmDefender | Out-Null
Start-Sleep -Milliseconds 800
}
# Open Windows Security
Start-Process "windowsdefender://threatsettings" -WindowStyle Hidden
$hwndSecurity = Find-SecurityWindow -MaxRetries 10
if (-not $hwndSecurity) {
Write-Host " [ERROR] Failed to find Windows Security window" -ForegroundColor Red
return $false
}
# Get UI Automation root element
try {
$rootElement = [System.Windows.Automation.AutomationElement]::FromHandle($hwndSecurity)
}
catch {
Write-Host " [ERROR] Failed to get automation element" -ForegroundColor Red
Close-SecurityWindow -WindowHandle $hwndSecurity
return $false
}
# Wait for UI to load
if (-not (Wait-UILoaded -RootElement $rootElement -MaxRetries 50)) {
Write-Host " [ERROR] Failed to load UI (Timeout on slow system)" -ForegroundColor Red
Close-SecurityWindow -WindowHandle $hwndSecurity
return $false
}
# Execute requested action
$result = $false
if ($Cmd -eq 'rtp') {
switch ($Act) {
'status' {
$result = (Get-RTPStatus -RootElement $rootElement) -ne $null
}
'on' {
$result = Enable-RTP -RootElement $rootElement
}
'off' {
$result = Disable-RTP -RootElement $rootElement
}
}
}
elseif ($Cmd -eq 'tp') {
switch ($Act) {
'status' {
$result = (Get-TPStatus -RootElement $rootElement) -ne $null
}
'on' {
$result = Enable-TP -RootElement $rootElement
}
'off' {
$result = Disable-TP -RootElement $rootElement
}
}
}
# Close security window
Close-SecurityWindow -WindowHandle $hwndSecurity
return $result
}
# ============================================================================
# Main Execution Flow
# ============================================================================
$overallResult = $true
if ($Command -eq 'all') {
Write-Host ""
Write-Host "=== Windows Defender ALL Control ($Action) ===" -ForegroundColor Cyan
Write-Host ""
if ($Action -eq 'status') {
# Process RTP status
$rtpResult = Process-SingleCommand -Cmd 'rtp' -Act 'status'
Write-Host ""
Write-Host "---" -ForegroundColor DarkGray
# Process TP status
$tpResult = Process-SingleCommand -Cmd 'tp' -Act 'status'
$overallResult = $rtpResult -and $tpResult
}
else {
# Process RTP action
Write-Host "[1/2] Processing RTP ($Action)..." -ForegroundColor Cyan
$rtpResult = Process-SingleCommand -Cmd 'rtp' -Act $Action
Write-Host ""
Write-Host "--- Waiting 1 second ---" -ForegroundColor DarkGray
Start-Sleep -Seconds 1
# Process TP action
Write-Host "[2/2] Processing Tamper Protection ($Action)..." -ForegroundColor Cyan
$tpResult = Process-SingleCommand -Cmd 'tp' -Act $Action
$overallResult = $rtpResult -and $tpResult
Write-Host ""
Write-Host "=== Summary ===" -ForegroundColor Cyan
Write-Host " [*] RTP ($Action): $(if ($rtpResult) { 'SUCCESS' } else { 'FAILED' })" -ForegroundColor $(if ($rtpResult) { 'Green' } else { 'Red' })
Write-Host " [*] Tamper Protection ($Action): $(if ($tpResult) { 'SUCCESS' } else { 'FAILED' })" -ForegroundColor $(if ($tpResult) { 'Green' } else { 'Red' })
}
}
else {
$overallResult = Process-SingleCommand -Cmd $Command -Act $Action
}
Write-Host ""
Write-Host " [*] Operation completed." -ForegroundColor $(if ($overallResult) { 'Green' } else { 'Yellow' })
Write-Host ""
exit $(if ($overallResult) { 0 } else { 1 })

复制代码

整合右键菜单批处理如下

@ECHO OFF
PUSHD %~dp0
TITLE Hello World
>nul reg add hkcu\software\classes\.Admin\shell\runas\command /f /ve /d "cmd /x /d /r set "f0=%%2" &call "%%2" %%3" & set "_= %*"
>nul fltmc || if "%f0%" neq "%~f0" ( cd.>"%tmp%\runas.Admin" & start "%~n0" /high "%tmp%\runas.Admin" "%~f0" "%_:"=""%" &exit /b )
cd /d "%~dp0"
if "%PROCESSOR_ARCHITECTURE%"=="x86" set bits=32
if "%PROCESSOR_ARCHITECTURE%"=="AMD64" set bits=64
REM 检查命令行参数
if "%~1"=="install" (
goto install
)
if "%~1"=="uninstall" (
goto uninstall
)
Rem 设置程序路径
SET "_file_path=%~dp0"
Rem 设置命令行
SET "_cmd_cmd_enable=powershell Start-Process cmd -Verb RunAs -ArgumentList '/S /K pushd "%%V" &"%~dp0WinDefCtl.exe" rtp on &"%~dp0WinDefCtl.exe" tp on &exit'"
SET "_cmd_cmd_disabled=powershell Start-Process cmd -Verb RunAs -ArgumentList '/S /K pushd "%%V" &"%~dp0WinDefCtl.exe" rtp off &"%~dp0WinDefCtl.exe" tp off &exit'"
SET "_cmd_scripts_enable="powershell.exe" "-Command" ""& {Start-Process PowerShell.exe -ArgumentList '-ExecutionPolicy RemoteSigned -File "%~dp0WinDefCtl.ps1" all on' -Verb RunAs}""
SET "_cmd_scripts_disabled="powershell.exe" "-Command" ""& {Start-Process PowerShell.exe -ArgumentList '-ExecutionPolicy RemoteSigned -File "%~dp0WinDefCtl.ps1" all off' -Verb RunAs}""
Rem 设置注册表初始值
SET "_regkey1=HKCR\*\Shell\WindowsSecurity"
SET "_regkey2=HKCR\Directory\Shell\WindowsSecurity"
SET "_regkey3=HKCR\Directory\background\Shell\WindowsSecurity"
SET "_regkey4=HKCR\Drive\Shell\WindowsSecurity"
SET "_regkey5=HKCR\DesktopBackground\Shell\WindowsSecurity"
:Menu
SET Options=
ECHO.&ECHO. 1.安装 WinDefCtl 鼠标右键菜单
ECHO.&ECHO. 2.卸载 WinDefCtl 鼠标右键菜单
ECHO.&ECHO. 3.退出
ECHO.
SET /P Options=[92m请输入选择项目序号并按回车确认：[0m
IF /I "%Options%"=="1" GOTO install
IF /I "%Options%"=="2" GOTO uninstall
IF /I "%Options%"=="3" GOTO OUT
ECHO.&ECHO.序号无效，请重新输入！
PING -n 2 127.1>NUL
CLS
GOTO Menu
:install
REM 删除残留注册项
reg delete "%_regkey1%" /f
for %%i in ("%_regkey2%" "%_regkey3%" "%_regkey4%" "%_regkey5%") do reg delete %%i /f
Rem 单独处理 HKCR\*\Shell\WindowsSecurity(for循环直接导入通配符*会失败)
Reg.exe add "%_regkey1%" /v "Icon" /t REG_SZ /d "%%ProgramFiles%%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add "%_regkey1%" /v "MUIVerb" /t REG_SZ /d "Windows 安全中心" /f
Reg.exe add "%_regkey1%" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%_regkey1%" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "Icon" /t REG_SZ /d "%%ProgramFiles%%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "MUIVerb" /t REG_SZ /d "&安全中心主页" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\001flyout" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%_regkey1%\shell\001flyout\command" /ve /t REG_SZ /d "explorer windowsdefender:" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "MUIVerb" /t REG_SZ /d "&病毒和威胁防护" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%_regkey1%\shell\002flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "病毒和威胁防护设置主页" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://threat" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用实时防护和防篡改" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\002\command" /ve /t REG_SZ /d "%_cmd_scripts_enable%" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用实时防护和防篡改" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\002flyout\shell\003\command" /ve /t REG_SZ /d "%_cmd_scripts_disabled%" /f
Reg.exe add "%_regkey1%\shell\003flyout" /v "MUIVerb" /t REG_SZ /d "&账户保护" /f
Reg.exe add "%_regkey1%\shell\003flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\003flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://account" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "MUIVerb" /t REG_SZ /d "&防火墙和网络保护" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%_regkey1%\shell\004flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "防火墙和网络保护设置主页" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://network" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用 Windows 防火墙" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\002\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state on' -Verb runAs"" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用 Windows 防火墙" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\004flyout\shell\003\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state off' -Verb runAs"" /f
Reg.exe add "%_regkey1%\shell\005flyout" /v "MUIVerb" /t REG_SZ /d "应用和浏览器控制" /f
Reg.exe add "%_regkey1%\shell\005flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\005flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://appbrowser" /f
Reg.exe add "%_regkey1%\shell\006flyout" /v "MUIVerb" /t REG_SZ /d "&设备安全性" /f
Reg.exe add "%_regkey1%\shell\006flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\006flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://devicesecurity" /f
Reg.exe add "%_regkey1%\shell\007flyout" /v "MUIVerb" /t REG_SZ /d "&设备性能和运行状况" /f
Reg.exe add "%_regkey1%\shell\007flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\007flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://perfhealth" /f
Reg.exe add "%_regkey1%\shell\008flyout" /v "MUIVerb" /t REG_SZ /d "&家庭选项" /f
Reg.exe add "%_regkey1%\shell\008flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\008flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://family" /f
Reg.exe add "%_regkey1%\shell\009flyout" /v "MUIVerb" /t REG_SZ /d "&保护历史记录" /f
Reg.exe add "%_regkey1%\shell\009flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\009flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://history" /f
Reg.exe add "%_regkey1%\shell\010flyout" /v "MUIVerb" /t REG_SZ /d "&安全提供程序" /f
Reg.exe add "%_regkey1%\shell\010flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\010flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://providers" /f
Reg.exe add "%_regkey1%\shell\011flyout" /v "MUIVerb" /t REG_SZ /d "&通知" /f
Reg.exe add "%_regkey1%\shell\011flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%_regkey1%\shell\011flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://settings" /f
Rem Windows安全中心菜单总项
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add %%k /v "Icon" /t REG_SZ /d "%ProgramFiles%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add %%k /v "MUIVerb" /t REG_SZ /d "Windows 安全中心" /f
Reg.exe add %%k /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add %%k /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add %%k /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add %%k /v "SubCommands" /t REG_SZ /d "" /f
)
Rem 二级菜单安全中心主页
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\001flyout" /v "Icon" /t REG_SZ /d "%ProgramFiles%\Windows Defender\EppManifest.dll,-101" /f
Reg.exe add "%%k\shell\001flyout" /v "MUIVerb" /t REG_SZ /d "&安全中心主页" /f
Reg.exe add "%%k\shell\001flyout" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\001flyout" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\001flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\001flyout" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%%k\shell\001flyout\command" /ve /t REG_SZ /d "explorer windowsdefender:" /f
)
Rem 二级菜单病毒和威胁防护
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\002flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout" /v "MUIVerb" /t REG_SZ /d "&病毒和威胁防护" /f
Reg.exe add "%%k\shell\002flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%%k\shell\002flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "病毒和威胁防护设置主页" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%%k\shell\002flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://threat" /f
Reg.exe add "%%k\shell\002flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用实时防护和防篡改" /f
Reg.exe add "%%k\shell\002flyout\shell\002\command" /ve /t REG_SZ /d "%_cmd_scripts_enable%" /f
Reg.exe add "%%k\shell\002flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\002flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用实时防护和防篡改" /f
Reg.exe add "%%k\shell\002flyout\shell\003\command" /ve /t REG_SZ /d "%_cmd_scripts_disabled%" /f
)
Rem 二级菜单账户保护
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\003flyout" /v "MUIVerb" /t REG_SZ /d "&账户保护" /f
Reg.exe add "%%k\shell\003flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\003flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://account" /f
)
Rem 二级菜单防火墙和网络保护
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\004flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout" /v "MUIVerb" /t REG_SZ /d "&防火墙和网络保护" /f
Reg.exe add "%%k\shell\004flyout" /v "Position" /t REG_SZ /d "Bottom" /f
Reg.exe add "%%k\shell\004flyout" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell" /v "SubCommands" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "MUIVerb" /t REG_SZ /d "防火墙和网络保护设置主页" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "SeparatorAfter" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "SeparatorBefore" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\001" /v "CommandFlags" /t REG_DWORD /d "64" /f
Reg.exe add "%%k\shell\004flyout\shell\001\command" /ve /t REG_SZ /d "explorer windowsdefender://network" /f
Reg.exe add "%%k\shell\004flyout\shell\002" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\002" /v "MUIVerb" /t REG_SZ /d "启用 Windows 防火墙" /f
Reg.exe add "%%k\shell\004flyout\shell\002\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state on' -Verb runAs"" /f
Reg.exe add "%%k\shell\004flyout\shell\003" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\004flyout\shell\003" /v "MUIVerb" /t REG_SZ /d "禁用 Windows 防火墙" /f
Reg.exe add "%%k\shell\004flyout\shell\003\command" /ve /t REG_SZ /d "powershell.exe -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,netsh advfirewall set allprofiles state off' -Verb runAs"" /f
)
Rem 二级菜单应用和浏览器控制
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\005flyout" /v "MUIVerb" /t REG_SZ /d "&应用和浏览器控制" /f
Reg.exe add "%%k\shell\005flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\005flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://appbrowser" /f
)
Rem 二级菜单设备安全性
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\006flyout" /v "MUIVerb" /t REG_SZ /d "&设备安全性" /f
Reg.exe add "%%k\shell\006flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\006flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://devicesecurity" /f
)
Rem 二级菜单设备性能和运行状况
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\007flyout" /v "MUIVerb" /t REG_SZ /d "&设备性能和运行状况" /f
Reg.exe add "%%k\shell\007flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\007flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://perfhealth" /f
)
Rem 二级菜单家庭选项
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\008flyout" /v "MUIVerb" /t REG_SZ /d "&家庭选项" /f
Reg.exe add "%%k\shell\008flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\008flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://family" /f
)
Rem 二级菜单保护历史记录
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\009flyout" /v "MUIVerb" /t REG_SZ /d "&保护历史记录" /f
Reg.exe add "%%k\shell\009flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\009flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://history" /f
)
Rem 二级菜单安全提供程序
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\010flyout" /v "MUIVerb" /t REG_SZ /d "&安全提供程序" /f
Reg.exe add "%%k\shell\010flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\010flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://providers" /f
)
Rem 二级菜单通知
for %%k in ("%_regkey2%" "%_regkey3%" "%_regkey4%") do (
Reg.exe add "%%k\shell\011flyout" /v "MUIVerb" /t REG_SZ /d "&通知" /f
Reg.exe add "%%k\shell\011flyout" /v "HasLUAShield" /t REG_SZ /d "" /f
Reg.exe add "%%k\shell\011flyout\command" /ve /t REG_SZ /d "explorer windowsdefender://settings" /f
)
REM 添加排除WinDefCtl件夹限制访问及白名单
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ExclusionProcess '%~dp0WinDefCtl.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications '%ComSpec%'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Windows\System32\cmd.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Add-MpPreference -ControlledFolderAccessAllowedApplications '%~dp0WinDefCtl.exe'"
exit
:uninstall
REM 删除残留注册项
reg delete "%_regkey1%" /f
for %%i in ("%_regkey2%" "%_regkey3%" "%_regkey4%" "%_regkey5%") do reg delete %%i /f
REM 移除排除WinDefCtl文件夹限制访问及白名单
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ExclusionProcess '%~dp0WinDefCtl.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ControlledFolderAccessAllowedApplications '%ComSpec%'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Windows\System32\cmd.exe'"
powershell -ExecutionPolicy Bypass -NoProfile -Command "Remove-MpPreference -ControlledFolderAccessAllowedApplications '%~dp0WinDefCtl.exe'"
exit
:OUT
exit

复制代码

使用方法WinDefCtl.ps1和右键整合的批处理放同一目录然后运行批处理进行右键功能添加和删除
网盘下载自解压包也行https://cloud.189.cn/t/qUf6va6n6N3q（访问码：df2a）

小龙飞 · 发表于昨天 16:36

感谢您的分享！

geshenggang4 · 发表于昨天 16:44

感谢分享！

handsome_xiang · 发表于昨天 16:55

感谢分享！

smile_z · 发表于昨天 17:00

感谢分享

canghaisui · 发表于昨天 17:09

谢谢大佬分享

xiaozgl119 · 发表于昨天 17:16

感谢分享

pole87898843 · 发表于昨天 17:27

感谢分享

yyz2191958 · 发表于昨天 17:50

这个强大

womwom · 发表于昨天 18:06

感谢分享

bnsyy · 发表于昨天 18:07

感谢分享！

hmaaaa · 发表于昨天 18:08

感謝大大分享!^^ 辛苦了！

wang1126 · 发表于昨天 18:28

谢谢楼主分享

nie956 · 发表于昨天 18:41

这个好，感谢分享

lyrgcy · 发表于昨天 18:44

感谢分享，收下了

it323 · 发表于昨天 19:16

感谢分享！

wn168cn@163.com · 发表于昨天 19:27

感谢分享

yuaijueyuan · 发表于昨天 20:06

可以直接分析文件吗？复制出来的好像有中文符号

qq8899399 · 发表于昨天 20:13

yuaijueyuan 发表于 2025-12-13 20:06
可以直接分析文件吗？复制出来的好像有中文符号

我上传不了压缩文件。。。。。

yuaijueyuan · 发表于昨天 20:29

qq8899399 发表于 2025-12-13 20:13
我上传不了压缩文件。。。。。

上链接

qq8899399 · 发表于昨天 20:47

yuaijueyuan 发表于 2025-12-13 20:29
上链接

https://cloud.189.cn/t/qUf6va6n6N3q（访问码：df2a）

zhtq · 发表于昨天 21:13

qq8899399 发表于 2025-12-13 20:47
https://cloud.189.cn/t/qUf6va6n6N3q（访问码：df2a）

好人

in9 · 发表于昨天 21:14

谢谢楼主分享，谢谢20楼朋友上传分享！

a66 · 发表于昨天 21:36

支持折腾~

番茄盖浇饭 · 发表于昨天 21:54

感谢您的分享！

Tatsumki · 发表于昨天 22:03

这个有点意思谢谢分享

2011yousu · 发表于昨天 22:43

有能卸载小娜的吗

ynb168c · 发表于昨天 22:49

感谢分享

1801403 · 发表于 1 小时前

原版系统很有用的。

gordonhf · 发表于 1 小时前

纯路过～

		自动登录	找回密码
密码			注册

[分享] 一个安全中心的右键菜单（能实时开启和关闭 Win defender实时防护和防篡改）

点评

点评

点评

浏览过的版块

[分享] 一个 安全中心的 右键菜单（能实时开启和关闭 Win defender实时防护和防篡改）

点评

点评

点评

浏览过的版块

[分享] 一个安全中心的右键菜单（能实时开启和关闭 Win defender实时防护和防篡改）