Cool_Tools/ExplorerPatcher
1
0
Fork 0
mirror of https://github.com/valinet/ExplorerPatcher.git synced 2024-11-27 17:00:59 +01:00
Code Releases Wiki Activity

Added ability to disable "modern search box"

Browse Source 
* Also, improved classic taskbar code path patching
This commit is contained in:
Valentin Radu 2021-09-05 20:26:39 +03:00
parent 7b01e93f95
commit 12eb7c15f3
8 changed files with 592 additions and 374 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
CHANGELOG.md
View File

@ -2,6 +2,26 @@
This document includes the same release notes as in the [Releases](https://github.com/valinet/ExplorerPatcher/releases) section on GitHub.
## 22449.1000.0.18
Tested on the following builds: 22449.1000, 22000.176, 22000.1.
New in this version:
* Ability to disable the "modern search box" in File Explorer and uses the classic functional search from early Windows 10 versions or Windows 7/8. To disable this and still use the new search, set `General\AllowModernSearchBox = 1` in `settings.ini`
Fixes:
* Much improved algorithm for enabling the classic taskbar after symbols have downloaded on newer builds
* Restored compatibility with RTM build of Windows 11 (22000.1)
## 22449.1000.0.16
New in this version:
- Compatibility with OS build 22449.1000.0.16.
- Fixed bug that prevented console from showing when the `AllocConsole` setting was specified in `settings.ini`
## 22000.168.0.14
* Start menu and search now respect the taskbar alignment setting

8
ExplorerPatcher/ExplorerPatcher.rc
View File

@ -51,8 +51,8 @@ END
//
VS_VERSION_INFO VERSIONINFO
FILEVERSION 22449,1000,0,16
PRODUCTVERSION 22449,1000,0,16
FILEVERSION 22449,1000,0,18
PRODUCTVERSION 22449,1000,0,18
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
@ -69,12 +69,12 @@ BEGIN
BEGIN
VALUE "CompanyName", "VALINET Solutions SRL"
VALUE "FileDescription", "ExplorerPatcher"
VALUE "FileVersion", "22449.1000.0.16"
VALUE "FileVersion", "22449.1000.0.18"
VALUE "InternalName", "ExplorerPatcher.dll"
VALUE "LegalCopyright", "Copyright (C) 2006-2021 VALINET Solutions SRL. All rights reserved."
VALUE "OriginalFilename", "ExplorerPatcher.dll"
VALUE "ProductName", "ExplorerPatcher"
VALUE "ProductVersion", "22449.1000.0.16"
VALUE "ProductVersion", "22449.1000.0.18"
END
END
BLOCK "VarFileInfo"

820
ExplorerPatcher/dllmain.c
View File

@ -108,8 +108,8 @@ DEFINE_GUID(__uuidof_IAuthUILogonSound,
#define EXPLORER_SB_NAME "explorer"
#define EXPLORER_SB_0 "CTray::_HandleGlobalHotkey"
#define EXPLORER_SB_1 "CTray::v_WndProc"
#define EXPLORER_SB_2 "CTray::_FireDesktopSwitchIfReady"
#define EXPLORER_SB_3 "CTray::Init"
#define EXPLORER_SB_2 "CTray::Init"
#define EXPLORER_SB_3 "winrt::impl::consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2*::IsExtensionAvailable" // should be always last
#define EXPLORER_SB_CNT 4
#define EXPLORER_PATCH_OFFSET "Offset"
#define EXPLORER_PATCH_OFFSET_OK "OffsetOK"
@ -123,7 +123,7 @@ DEFINE_GUID(__uuidof_IAuthUILogonSound,
#define TWINUI_PCSHELL_SB_4 "CLauncherTipContextMenu::_ExecuteShutdownCommand"
#define TWINUI_PCSHELL_SB_5 "CLauncherTipContextMenu::_ExecuteCommand"
#define TWINUI_PCSHELL_SB_6 "CLauncherTipContextMenu::ShowLauncherTipContextMenu"
#define TWINUI_PCSHELL_SB_7 "winrt::Windows::Internal::Shell::implementation::MeetAndChatManager::OnMessage"
#define TWINUI_PCSHELL_SB_7 "winrt::Windows::Internal::Shell::implementation::MeetAndChatManager::OnMessage" // should be always last
#define TWINUI_PCSHELL_SB_CNT 8
#define TWINUI_SB_NAME "twinui"
#define TWINUI_SB_0 "CImmersiveHotkeyNotification::_GetMonitorForHotkeyNotification"
@ -147,6 +147,10 @@ DEFINE_GUID(__uuidof_IAuthUILogonSound,
#define STARTDOCKED_SB_3 "StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps"
#define STARTDOCKED_SB_4 "StartDocked::StartSizingFrame::StartSizingFrame"
#define STARTDOCKED_SB_CNT 5
#define EXPLORERFRAME_SB_NAME "ExplorerFrame"
#define EXPLORERFRAME_SB_0 "CUniversalSearchBand::IsModernSearchBoxEnabled"
#define EXPLORERFRAME_SB_CNT 1
const char* explorer_SN[EXPLORER_SB_CNT] = {
EXPLORER_SB_0,
EXPLORER_SB_1,
@ -185,6 +189,9 @@ const char* startdocked_SN[STARTDOCKED_SB_CNT] = {
STARTDOCKED_SB_3,
STARTDOCKED_SB_4
};
const char* explorerframe_SN[EXPLORERFRAME_SB_CNT] = {
EXPLORERFRAME_SB_0
};
#pragma pack(push, 1)
typedef struct symbols_addr
{
@ -195,6 +202,7 @@ typedef struct symbols_addr
DWORD windowsuifileexplorer_PTRS[WINDOWSUIFILEEXPLORER_SB_CNT];
DWORD windowsuixaml_PTRS[WINDOWSUIXAML_SB_CNT];
DWORD startdocked_PTRS[STARTDOCKED_SB_CNT];
DWORD explorerframe_PTRS[EXPLORERFRAME_SB_CNT];
} symbols_addr;
#pragma pack(pop)
@ -635,11 +643,21 @@ static INT64(*CTray_v_WndProcFunc)(
_In_ LPARAM lParam
);
static INT64(*CTray__FireDesktopSwitchIfReadyFunc)(
static char(*winrt_impl_consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2_winrt_WindowsUdk_ApplicationModel_AppExtensions_XamlExtensions_IsExtensionAvailableFunc)(
void* _this,
unsigned int a2
void* a2,
void* a3
);
char winrt_impl_consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2_winrt_WindowsUdk_ApplicationModel_AppExtensions_XamlExtensions_IsExtensionAvailableHook(
void* _this,
void* a2,
void* a3
)
{
return FALSE;
}
DEFINE_GUID(IID_ILauncherTipContextMenu,
0xb8c1db5f,
0xcbb3, 0x48bc, 0xaf, 0xd9,
@ -714,6 +732,16 @@ INT64 ContextMenuPresenter_DoContextMenuHook(
static BOOL(*CUniversalSearchBand_IsModernSearchBoxEnabledFunc)(void*, INT64, INT64);
BOOL CUniversalSearchBand_IsModernSearchBoxEnabledHook(void* _this, INT64 a2, INT64 a3)
{
return FALSE;
}
DEFINE_GUID(CLSID_ImmersiveShell,
0xc2f03a33,
0x21f5, 0x47fa, 0xb4, 0xbb,
@ -1563,7 +1591,6 @@ INT64 CTray_HandleGlobalHotkeyHook(
);
}
BOOL notFirstTimeCTray_v_WndProcHook = FALSE;
INT64 CTray_v_WndProcHook(
void* _this,
_In_ HWND hWnd,
@ -1572,11 +1599,6 @@ INT64 CTray_v_WndProcHook(
_In_ LPARAM lParam
)
{
if (!notFirstTimeCTray_v_WndProcHook)
{
notFirstTimeCTray_v_WndProcHook = TRUE;
CTray__FireDesktopSwitchIfReadyFunc(_this, 2);
}
return CTray_v_WndProcFunc(
_this,
hWnd,
@ -2113,18 +2135,32 @@ DWORD DownloadSymbols(TCHAR* wszSettingsPath)
return 2;
}
printf("Reading symbols...\n");
if (VnGetSymbols(
int rv = 0;
if (rv = VnGetSymbols(
szSettingsPath,
symbols_PTRS.explorer_PTRS,
explorer_SN,
EXPLORER_SB_CNT
))
{
FreeLibraryAndExitThread(
hModule,
3
);
return 3;
printf("Chosen Explorer patching method: dynamic (%d).\n", rv);
if (VnGetSymbols(
szSettingsPath,
symbols_PTRS.explorer_PTRS,
explorer_SN,
EXPLORER_SB_CNT - 1
))
{
FreeLibraryAndExitThread(
hModule,
3
);
return 3;
}
}
else
{
printf("Chosen Explorer patching method: static.\n");
}
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
@ -2153,7 +2189,6 @@ DWORD DownloadSymbols(TCHAR* wszSettingsPath)
char twinui_pcshell_sb_dll[MAX_PATH];
ZeroMemory(
twinui_pcshell_sb_dll,
@ -2200,11 +2235,20 @@ DWORD DownloadSymbols(TCHAR* wszSettingsPath)
TWINUI_PCSHELL_SB_CNT
))
{
FreeLibraryAndExitThread(
hModule,
5
);
return 5;
printf("Hooking Win+C is not available for this build.\n");
if (VnGetSymbols(
szSettingsPath,
symbols_PTRS.twinui_pcshell_PTRS,
twinui_pcshell_SN,
TWINUI_PCSHELL_SB_CNT - 1
))
{
FreeLibraryAndExitThread(
hModule,
5
);
return 5;
}
}
VnWriteUInt(
TEXT(TWINUI_PCSHELL_SB_NAME),
@ -2549,6 +2593,68 @@ DWORD DownloadSymbols(TCHAR* wszSettingsPath)
char explorerframe_sb_dll[MAX_PATH];
ZeroMemory(
explorerframe_sb_dll,
(MAX_PATH) * sizeof(char)
);
GetSystemDirectoryA(
explorerframe_sb_dll,
MAX_PATH
);
strcat_s(
explorerframe_sb_dll,
MAX_PATH,
"\\"
);
strcat_s(
explorerframe_sb_dll,
MAX_PATH,
EXPLORERFRAME_SB_NAME
);
strcat_s(
explorerframe_sb_dll,
MAX_PATH,
".dll"
);
printf("Downloading symbols for \"%s\"...\n", explorerframe_sb_dll);
if (VnDownloadSymbols(
NULL,
explorerframe_sb_dll,
szSettingsPath,
MAX_PATH
))
{
FreeLibraryAndExitThread(
hModule,
6
);
return 6;
}
printf("Reading symbols...\n");
if (VnGetSymbols(
szSettingsPath,
symbols_PTRS.explorerframe_PTRS,
explorerframe_SN,
EXPLORERFRAME_SB_CNT
))
{
FreeLibraryAndExitThread(
hModule,
7
);
return 7;
}
VnWriteUInt(
TEXT(EXPLORERFRAME_SB_NAME),
TEXT(EXPLORERFRAME_SB_0),
symbols_PTRS.explorerframe_PTRS[0],
wszSettingsPath
);
char windowsuixaml_sb_dll[MAX_PATH];
ZeroMemory(
windowsuixaml_sb_dll,
@ -2612,6 +2718,8 @@ DWORD DownloadSymbols(TCHAR* wszSettingsPath)
VnWriteString(
TEXT("OS"),
TEXT("Build"),
@ -2619,27 +2727,54 @@ DWORD DownloadSymbols(TCHAR* wszSettingsPath)
wszSettingsPath
);
__x_ABI_CWindows_CData_CXml_CDom_CIXmlDocument* inputXml2 = NULL;
hr = String2IXMLDocument(
DownloadOKXML,
wcslen(DownloadOKXML),
&inputXml2,
if (symbols_PTRS.explorer_PTRS[EXPLORER_SB_CNT - 1])
{
__x_ABI_CWindows_CData_CXml_CDom_CIXmlDocument* inputXml = NULL;
HRESULT hr = String2IXMLDocument(
InstallOK,
wcslen(InstallOK),
&inputXml,
#ifdef DEBUG
stdout
#else
NULL
#endif
);
hr = ShowToastMessage(
inputXml,
APPID,
sizeof(APPID) / sizeof(TCHAR) - 1,
#ifdef DEBUG
stdout
#else
NULL
#endif
);
}
else
{
__x_ABI_CWindows_CData_CXml_CDom_CIXmlDocument* inputXml2 = NULL;
hr = String2IXMLDocument(
DownloadOKXML,
wcslen(DownloadOKXML),
&inputXml2,
#ifdef DEBUG
stdout
stdout
#else
NULL
NULL
#endif
);
hr = ShowToastMessage(
inputXml2,
APPID,
sizeof(APPID) / sizeof(TCHAR) - 1,
);
hr = ShowToastMessage(
inputXml2,
APPID,
sizeof(APPID) / sizeof(TCHAR) - 1,
#ifdef DEBUG
stdout
stdout
#else
NULL
NULL
#endif
);
);
}
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
@ -3099,10 +3234,20 @@ __declspec(dllexport) DWORD WINAPI main(
RegCloseKey(hKeySettings);
}
symbols_PTRS.explorerframe_PTRS[0] = VnGetUInt(
TEXT(EXPLORERFRAME_SB_NAME),
TEXT(EXPLORERFRAME_SB_0),
0,
wszSettingsPath
);
BOOL bNeedToDownload = FALSE;
for (UINT i = 0; i < sizeof(symbols_addr) / sizeof(DWORD); ++i)
{
if (!((DWORD*)&symbols_PTRS)[i])
if (!((DWORD*)&symbols_PTRS)[i] &&
(((DWORD*)&symbols_PTRS) + i) != symbols_PTRS.explorer_PTRS + EXPLORER_SB_CNT - 1 &&
(((DWORD*)&symbols_PTRS) + i) != symbols_PTRS.twinui_pcshell_PTRS + TWINUI_PCSHELL_SB_CNT - 1
)
{
bNeedToDownload = TRUE;
}
@ -3216,292 +3361,306 @@ __declspec(dllexport) DWORD WINAPI main(
FreeLibraryAndExitThread(hModule, rv);
return rv;
}*/
CTray__FireDesktopSwitchIfReadyFunc = (INT64(*)(HWND, int))
((uintptr_t)hExplorer + symbols_PTRS.explorer_PTRS[2]);
printf("Setup explorer functions done\n");
const char szPayload0[6] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
const char szPayload1[2] = { 0x90, 0xE9 };
UINT start = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET),
0,
wszSettingsPath
);
UINT ok = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET_OK),
0,
wszSettingsPath
);
UINT strat = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET_STRAT),
0,
wszSettingsPath
);
uintptr_t dwInjectedAddr = (uintptr_t)hExplorer;
DWORD dwOldValue = 0, dwNumberOfBytes = 0;
if (ok)
if (symbols_PTRS.explorer_PTRS[EXPLORER_SB_CNT - 1])
{
dwInjectedAddr += symbols_PTRS.explorer_PTRS[3] + start;
#ifdef _M_AMD64
if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_NOP)
winrt_impl_consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2_winrt_WindowsUdk_ApplicationModel_AppExtensions_XamlExtensions_IsExtensionAvailableFunc = (char(*)(void*, void*, void*))
((uintptr_t)hExplorer + symbols_PTRS.explorer_PTRS[EXPLORER_SB_CNT - 1]);
rv = funchook_prepare(
funchook,
(void**)&winrt_impl_consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2_winrt_WindowsUdk_ApplicationModel_AppExtensions_XamlExtensions_IsExtensionAvailableFunc,
winrt_impl_consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2_winrt_WindowsUdk_ApplicationModel_AppExtensions_XamlExtensions_IsExtensionAvailableHook
);
if (rv != 0)
{
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload0),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
(LPVOID)dwInjectedAddr,
szPayload0,
sizeof(szPayload0)
);
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload0),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
FreeLibraryAndExitThread(hModule, rv);
return rv;
}
else if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_ALWAYS_JUMP)
{
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload1),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
(LPVOID)dwInjectedAddr,
szPayload1,
sizeof(szPayload1)
);
printf("%d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload1),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
#elif _M_ARM64
if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_NOP)
{
uint32_t instruction = 0xD503201F;
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
(LPVOID)dwInjectedAddr,
&instruction,
sizeof(uint32_t)
);
printf("%d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
else if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_ALWAYS_JUMP)
{
uint32_t instruction;
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
&instruction,
(LPVOID)dwInjectedAddr,
sizeof(uint32_t)
);
instruction <<= 8;
instruction >>= 13;
instruction &= 0b00010111111111111111111111111111;
instruction |= 0b00010100000000000000000000000000;
memcpy(
(LPVOID)dwInjectedAddr,
&instruction,
sizeof(uint32_t)
);
printf("%d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
#endif
}
else
{
UINT dirty = VnGetUInt(
const char szPayload0[6] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
const char szPayload1[2] = { 0x90, 0xE9 };
UINT start = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_DIRTY),
TEXT(EXPLORER_PATCH_OFFSET),
0,
wszSettingsPath
);
if (dirty)
{
FreeConsole();
TerminateProcess(
OpenProcess(
PROCESS_TERMINATE,
FALSE,
GetCurrentProcessId()
),
EXIT_CODE_EXPLORER
);
}
uintptr_t CTray_Init = dwInjectedAddr + (uintptr_t)symbols_PTRS.explorer_PTRS[3];
char m[BYTES_TO_DISASSEMBLE];
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
PAGE_EXECUTE_READ,
&dwOldValue
);
memcpy(
m,
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE
);
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
);
printf("Copied %d bytes to disassemble.\n", BYTES_TO_DISASSEMBLE);
#if HOW_TO_HOOK == HOOK_WITH_FUNCHOOK
_DecodedInst decodedInstructions[1000];
UINT decodedInstructionsCount = 0;
_DecodeResult res = distorm_decode(
0,
(const unsigned char*)m,
BYTES_TO_DISASSEMBLE,
Decode64Bits,
decodedInstructions,
1000,
&decodedInstructionsCount
);
printf("Disassembled bytes.\n");
BOOL found = FALSE;
for (UINT i = 0; i < decodedInstructionsCount; ++i)
{
if ((!strcmp(decodedInstructions[i].mnemonic.p, "JZ") ||
!strcmp(decodedInstructions[i].mnemonic.p, "JNZ")) &&
decodedInstructions[i].offset > start)
{
found = TRUE;
start = decodedInstructions[i].offset;
printf("Attempting offset %lld with strat %lld...\n", decodedInstructions[i].offset, strat);
if (strat == 0)
{
memcpy(
m + start,
szPayload0,
sizeof(szPayload0)
);
}
else if (strat == 1)
{
memcpy(
m + start,
szPayload1,
sizeof(szPayload1)
);
}
break;
}
}
if (!found)
{
start = 0;
strat++;
}
#endif
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
PAGE_EXECUTE_READWRITE,
&dwOldValue
);
memcpy(
(LPVOID)CTray_Init,
m,
BYTES_TO_DISASSEMBLE
);
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
);
UINT new_ok = VnGetUInt(
UINT ok = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET_OK),
0,
wszSettingsPath
);
if (!new_ok)
{
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET),
start,
wszSettingsPath
);
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET_STRAT),
strat,
wszSettingsPath
);
}
TCHAR wszExplorerPath[MAX_PATH + 1];
wszExplorerPath[0] = L'\"';
GetSystemDirectory(wszExplorerPath + 1, MAX_PATH);
wcscat_s(wszExplorerPath, MAX_PATH + 1, L"\\rundll32.exe\" \"");
GetModuleFileName(hModule, wszExplorerPath + wcslen(wszExplorerPath), MAX_PATH - wcslen(wszExplorerPath));
wcscat_s(wszExplorerPath, MAX_PATH, L"\",ZZLaunchExplorerDelayed");
wprintf(L"Command to launch: \" %s \"\n.", wszExplorerPath);
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;
BOOL b = CreateProcess(
NULL,
wszExplorerPath,
NULL,
NULL,
TRUE,
CREATE_UNICODE_ENVIRONMENT,
NULL,
NULL,
&si,
&pi
);
VnWriteUInt(
UINT strat = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_DIRTY),
1,
TEXT(EXPLORER_PATCH_OFFSET_STRAT),
0,
wszSettingsPath
);
FreeConsole();
CreateThread(0, 0, DetermineInjectionSuccess, wszSettingsPath, 0, 0);
return 0;
}
uintptr_t dwInjectedAddr = (uintptr_t)hExplorer;
DWORD dwOldValue = 0, dwNumberOfBytes = 0;
if (ok)
{
dwInjectedAddr += symbols_PTRS.explorer_PTRS[2] + start;
#ifdef _M_AMD64
if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_NOP)
{
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload0),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
(LPVOID)dwInjectedAddr,
szPayload0,
sizeof(szPayload0)
);
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload0),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
else if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_ALWAYS_JUMP)
{
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload1),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
(LPVOID)dwInjectedAddr,
szPayload1,
sizeof(szPayload1)
);
printf("%d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(szPayload1),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
#elif _M_ARM64
if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_NOP)
{
uint32_t instruction = 0xD503201F;
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
(LPVOID)dwInjectedAddr,
&instruction,
sizeof(uint32_t)
);
printf("%d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
else if (strat == STRAT_REPLACE_ANY_TYPE_OF_JUMP_WITH_ALWAYS_JUMP)
{
uint32_t instruction;
printf("Results: %d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
PAGE_EXECUTE_READWRITE,
&dwOldValue
), GetLastError());
memcpy(
&instruction,
(LPVOID)dwInjectedAddr,
sizeof(uint32_t)
);
instruction <<= 8;
instruction >>= 13;
instruction &= 0b00010111111111111111111111111111;
instruction |= 0b00010100000000000000000000000000;
memcpy(
(LPVOID)dwInjectedAddr,
&instruction,
sizeof(uint32_t)
);
printf("%d (%d) ", VirtualProtect(
(LPVOID)dwInjectedAddr,
sizeof(uint32_t),
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
), GetLastError());
printf("when altering taskbar code path using strat 1.\n");
}
#endif
}
else
{
UINT dirty = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_DIRTY),
0,
wszSettingsPath
);
if (dirty)
{
FreeConsole();
TerminateProcess(
OpenProcess(
PROCESS_TERMINATE,
FALSE,
GetCurrentProcessId()
),
EXIT_CODE_EXPLORER
);
}
uintptr_t CTray_Init = dwInjectedAddr + (uintptr_t)symbols_PTRS.explorer_PTRS[2];
char m[BYTES_TO_DISASSEMBLE];
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
PAGE_EXECUTE_READ,
&dwOldValue
);
memcpy(
m,
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE
);
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
);
printf("Copied %d bytes to disassemble.\n", BYTES_TO_DISASSEMBLE);
#if HOW_TO_HOOK == HOOK_WITH_FUNCHOOK
_DecodedInst decodedInstructions[1000];
UINT decodedInstructionsCount = 0;
_DecodeResult res = distorm_decode(
0,
(const unsigned char*)m,
BYTES_TO_DISASSEMBLE,
Decode64Bits,
decodedInstructions,
1000,
&decodedInstructionsCount
);
printf("Disassembled bytes.\n");
BOOL found = FALSE;
for (UINT i = 0; i < decodedInstructionsCount; ++i)
{
if ((!strcmp(decodedInstructions[i].mnemonic.p, "JZ") ||
!strcmp(decodedInstructions[i].mnemonic.p, "JNZ")) &&
decodedInstructions[i].offset > start)
{
found = TRUE;
start = decodedInstructions[i].offset;
printf("Attempting offset %lld with strat %lld...\n", decodedInstructions[i].offset, strat);
if (strat == 0)
{
memcpy(
m + start,
szPayload0,
sizeof(szPayload0)
);
}
else if (strat == 1)
{
memcpy(
m + start,
szPayload1,
sizeof(szPayload1)
);
}
break;
}
}
if (!found)
{
start = 0;
strat++;
}
#endif
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
PAGE_EXECUTE_READWRITE,
&dwOldValue
);
memcpy(
(LPVOID)CTray_Init,
m,
BYTES_TO_DISASSEMBLE
);
VirtualProtect(
(LPVOID)CTray_Init,
BYTES_TO_DISASSEMBLE,
dwOldValue,
(PDWORD)(&dwNumberOfBytes)
);
UINT new_ok = VnGetUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET_OK),
0,
wszSettingsPath
);
if (!new_ok)
{
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET),
start,
wszSettingsPath
);
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_OFFSET_STRAT),
strat,
wszSettingsPath
);
}
TCHAR wszExplorerPath[MAX_PATH + 1];
wszExplorerPath[0] = L'\"';
GetSystemDirectory(wszExplorerPath + 1, MAX_PATH);
wcscat_s(wszExplorerPath, MAX_PATH + 1, L"\\rundll32.exe\" \"");
GetModuleFileName(hModule, wszExplorerPath + wcslen(wszExplorerPath), MAX_PATH - wcslen(wszExplorerPath));
wcscat_s(wszExplorerPath, MAX_PATH, L"\",ZZLaunchExplorerDelayed");
wprintf(L"Command to launch: \" %s \"\n.", wszExplorerPath);
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;
BOOL b = CreateProcess(
NULL,
wszExplorerPath,
NULL,
NULL,
TRUE,
CREATE_UNICODE_ENVIRONMENT,
NULL,
NULL,
&si,
&pi
);
VnWriteUInt(
TEXT(EXPLORER_SB_NAME),
TEXT(EXPLORER_PATCH_DIRTY),
1,
wszSettingsPath
);
FreeConsole();
CreateThread(0, 0, DetermineInjectionSuccess, wszSettingsPath, 0, 0);
return 0;
}
}
LoadLibraryW(L"user32.dll");
HANDLE hUser32 = GetModuleHandle(L"user32.dll");
@ -3543,17 +3702,20 @@ __declspec(dllexport) DWORD WINAPI main(
return rv;
}
winrt_Windows_Internal_Shell_implementation_MeetAndChatManager_OnMessageFunc = (INT64(*)(void*, POINT*))
((uintptr_t)hTwinuiPcshell + symbols_PTRS.twinui_pcshell_PTRS[7]);
rv = funchook_prepare(
funchook,
(void**)&winrt_Windows_Internal_Shell_implementation_MeetAndChatManager_OnMessageFunc,
winrt_Windows_Internal_Shell_implementation_MeetAndChatManager_OnMessageHook
);
if (rv != 0)
if (symbols_PTRS.twinui_pcshell_PTRS[TWINUI_PCSHELL_SB_CNT - 1])
{
FreeLibraryAndExitThread(hModule, rv);
return rv;
winrt_Windows_Internal_Shell_implementation_MeetAndChatManager_OnMessageFunc = (INT64(*)(void*, POINT*))
((uintptr_t)hTwinuiPcshell + symbols_PTRS.twinui_pcshell_PTRS[TWINUI_PCSHELL_SB_CNT - 1]);
rv = funchook_prepare(
funchook,
(void**)&winrt_Windows_Internal_Shell_implementation_MeetAndChatManager_OnMessageFunc,
winrt_Windows_Internal_Shell_implementation_MeetAndChatManager_OnMessageHook
);
if (rv != 0)
{
FreeLibraryAndExitThread(hModule, rv);
return rv;
}
}
printf("Setup twinui.pcshell functions done\n");
@ -3644,6 +3806,32 @@ __declspec(dllexport) DWORD WINAPI main(
LoadLibraryW(L"ExplorerFrame.dll");
HANDLE hExplorerFrame = GetModuleHandle(L"ExplorerFrame.dll");
CUniversalSearchBand_IsModernSearchBoxEnabledFunc = (BOOL(*)(void*, INT64, INT64))
((uintptr_t)hExplorerFrame + symbols_PTRS.explorerframe_PTRS[0]);
UINT bAllowModernSearchBox = VnGetUInt(
L"General",
L"AllowModernSearchBox",
0,
wszSettingsPath
);
if (!bAllowModernSearchBox)
{
rv = funchook_prepare(
funchook,
(void**)&CUniversalSearchBand_IsModernSearchBoxEnabledFunc,
CUniversalSearchBand_IsModernSearchBoxEnabledHook
);
if (rv != 0)
{
FreeLibraryAndExitThread(hModule, rv);
return rv;
}
}
printf("Setup ExplorerFrame functions done\n");
rv = funchook_install(funchook, 0);
if (rv != 0)
{

14
README.md
View File

@ -10,6 +10,7 @@ Current functionality enabled by this patcher includes:
* ability to customize the maximum number of "Most used" apps displayed in the app list in Start
* ability to show the Start menu on the monitor containing the cursor when you press the Windows key*
* disable the new context menus in File Explorer and restore the classic ones
* disable the "modern search box" in File Explorer and revert to the proper working one from initial Windows 10 builds (or from Windows 7 and 8)
* skin the "Safe to Remove Hardware" pop-up to match the context menus of the taskbar
* disables the logon delay which happened if you were to enable the classic taskbar using `UndockingDisabled`
* play log on sound, if enabled
@ -30,9 +31,9 @@ Screenshots: [<1>](https://gist.githubusercontent.com/valinet/d0f72ff09773702584
Simply copy the downloaded DLL named `dxgi.dll` to `%windir%` (usually `C:\Windows`) and restart Explorer.
At first launch, the application will notify you about missing symbols and will automatically download them from Microsoft. Then, it will try to determine some patch offsets for Explorer. The process involves automatically restarting Explorer a couple of times and evaluating the results. Please be patient and let this do its job; you will know it is done when you will see the old taskbar instead of the new one. Also, the application will show a notification to let you know it is done.
At first launch, the application will notify you about missing symbols and will automatically download them from Microsoft. When this is done, a notification will show informing you that everything's done and Explorer will restart and display the old taskbar.
When it is done, the classic taskbar will be available and fully functioning, but you will notice the system tray misses the status icons. Those can be easily enabled by opening `Run` and going to `%windir%\explorer.exe shell:::{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\SystemIcons` and enabling each system icon you wish from there. For a list of other useful registry settings that can help you make the most out of this application, like disabling taskbar grouping, read [here](https://github.com/valinet/ExplorerPatcher/issues/9).
After Explorer restarts, the classic taskbar will be available and fully functioning, but you will notice the system tray misses the status icons. Those can be easily enabled by opening `Run` and going to `%windir%\explorer.exe shell:::{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\SystemIcons` and enabling each system icon you wish from there. For a list of other useful registry settings that can help you make the most out of this application, like disabling taskbar grouping, read [here](https://github.com/valinet/ExplorerPatcher/issues/9).
After you get the classic taskbar working, to make it work with the Start menu and search and enable related functionality, copy the DLL to the following 2 locations as well:
@ -41,10 +42,18 @@ After you get the classic taskbar working, to make it work with the Start menu a
After that is done, kill both `StartMenuExperienceHost.exe` and `SearchHost.exe` from Task Manager, or simply log out and back in or restart the computer.
Two of the applets in the system tray do not work in this mode: battery and network. To replace the battery applet, I recommend the much more capable [Battery Mode](https://en.bmode.tarcode.ru/) application which has very good integration and allows showing both classic power modes and Windows 10 power schemes (better battery, better performance etc), changing the display brightness (for laptop screens AND monitors) etc. To replace the network icon, I recommend using the control center to switch networks and keep the legacy icon only as an indicator. You can also have it open the "Network" section in the Settings app as described [here](https://winaero.com/change-network-icon-click-action-in-windows-10).
Downloaded symbols and application configuration is saved in the `%appdata%\ExplorerPatcher` folder.
To uninstall, simply delete `dxgi.dll` from all the directories above. If you get a "file in use" error when attempting to do so, simply rename it everywhere to `dxgia.dll`, reboot the computer and then delete the renamed DLL.
#### A note on antivirus false positives
The DLL you download may trigger a false positive alert in your antivirus program. This is fairly normal, a sign that the product you are using is decently capable, since it features detection methods a bit more advanced than what was state of the art in 1999. The program being flagged is usually done through heuristic analysis, not via a database of know viruses. That means that the antivirus program thinks that due to the nature of the code in this application, it likely may be a virus, a program that the user does not really mean to run. Injecting code into other executables is rarely done by legitimate programs. One such kind of legitimate programs is this patcher, that you deliberately choose to run and let it alter Explorer's code and memory in a controlled manner so that you achieve a certain effect. Thus, this patcher falls in the category of false positives: your antivirus thought such a program was not something you meant to run, but that's not the case this time.
If you still feel a bit iffy running this, then that's why the source code is available on the web site. You can take a look and even compile the DLL yourself and make an informed decision when running the software. Never run untrusted binaries from questionable sources, especially when you lack access to the source code and a way to reproduce that binary.
#### How does this work?
The way the application gets loaded is by exploiting the DLL search order in Windows. I take advantage of the fact that Explorer is one of the few system processes located in `%windir%` and not in `%windir%\System32`, so it does not affect most apps. Also, `%windir%` is not first in the search path. Read more about this technique [here](https://itm4n.github.io/windows-dll-hijacking-clarified/). The main advantage here is that you do not have to keep an extra process running in the memory; plus, due to the diverse nature of how Explorer is launched, hooking it can be difficult.
@ -56,6 +65,7 @@ I picked `dxgi.dll` because it is not on the `HKEY_LOCAL_MACHINE\SYSTEM\CurrentC
The `settings.ini` file contains, among the offsets for the various hooked/exploited functions, a few parameters that you can tweak:
* `General\AllowImmersiveContextMenus = 1` will show the new context menus in Explorer instead of the legacy one
* `General\AllowModernSearchBox = 1` will leave the modern search box enabled in File Explorer
* `General\AllocConsole = 1` will show a console when the application runs (useful for diagnostics).
The rest of the parameters that you can tweak and have them work with the application are located in the registry and are described [here](https://github.com/valinet/ExplorerPatcher/issues/9).

38
configs/_x64/22000.1/settings.ini Normal file
View File

@ -0,0 +1,38 @@
[explorer]
CTray::_HandleGlobalHotkey=71672
CTray::v_WndProc=241168
CTray::Init=576060
winrt::impl::consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2*::IsExtensionAvailable=0
OffsetOK=1
Dirty=0
OffsetStrat=0
Offset=247
[twinui.pcshell]
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc=724498
CLauncherTipContextMenu::GetMenuItemsAsync=5263856
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu=5462776
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu=5464832
CLauncherTipContextMenu::_ExecuteShutdownCommand=5326612
CLauncherTipContextMenu::_ExecuteCommand=5325776
CLauncherTipContextMenu::ShowLauncherTipContextMenu=5271264
winrt::Windows::Internal::Shell::implementation::MeetAndChatManager::OnMessage=0
[twinui]
CImmersiveHotkeyNotification::_GetMonitorForHotkeyNotification=2405544
IsDesktopInputContext=2401732
CImmersiveHotkeyNotification::OnMessage=731760
[stobject]
SysTrayWndProc=13168
HotPlugButtonClick=86576
[Windows.UI.FileExplorer]
ContextMenuPresenter::DoContextMenu=81056
[StartDocked]
StartDocked::LauncherFrame::ShowAllApps=1308600
StartDocked::LauncherFrame::OnVisibilityChanged=1302960
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps=2758832
StartDocked::StartSizingFrame::StartSizingFrame=1148940
[ExplorerFrame]
CUniversalSearchBand::IsModernSearchBoxEnabled=96688
[Windows.UI.Xaml]
CJupiterWindow::StaticCoreWindowSubclassProc=791040
[OS]
Build=10.0.22000.1

38
configs/_x64/22000.168/settings.ini
View File

@ -1,38 +0,0 @@
[explorer]
CTray::_HandleGlobalHotkey=6992
CTray::v_WndProc=62144
CTray::_FireDesktopSwitchIfReady=160304
CTray::Init=186208
Dirty=0
Offset=472
OffsetStrat=1
OffsetOK=1
[twinui.pcshell]
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc=2183030
CLauncherTipContextMenu::GetMenuItemsAsync=6072240
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu=6242504
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu=6244560
CLauncherTipContextMenu::_ExecuteShutdownCommand=6131272
CLauncherTipContextMenu::_ExecuteCommand=6130436
CLauncherTipContextMenu::ShowLauncherTipContextMenu=6077440
winrt::Windows::Internal::Shell::implementation::MeetAndChatManager::OnMessage=313504
[twinui]
CImmersiveHotkeyNotification::_GetMonitorForHotkeyNotification=2411916
IsDesktopInputContext=43992
CImmersiveHotkeyNotification::OnMessage=410208
CMessageNotificationHolder::OnMessage=456832
[stobject]
SysTrayWndProc=19808
HotPlugButtonClick=96336
[Windows.UI.FileExplorer]
ContextMenuPresenter::DoContextMenu=265520
[StartDocked]
Windows::UI::Core::IVisibilityChangedEventArgs::Visible::get=402004
StartDocked::LauncherFrame::ShowAllApps=1609404
StartDocked::LauncherFrame::OnVisibilityChanged=1601824
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps=15376
StartDocked::StartSizingFrame::StartSizingFrame=1444588
[Windows.UI.Xaml]
CJupiterWindow::StaticCoreWindowSubclassProc=2038048
[OS]
Build=10.0.22000.168

12
configs/_x64/22000.176/settings.ini
View File

@ -1,12 +1,12 @@
[explorer]
CTray::_HandleGlobalHotkey=6992
CTray::v_WndProc=62144
CTray::_FireDesktopSwitchIfReady=160304
CTray::Init=186208
winrt::impl::consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2*::IsExtensionAvailable=187568
OffsetOK=0
Dirty=0
Offset=472
OffsetStrat=1
OffsetOK=1
OffsetStrat=0
Offset=0
[twinui.pcshell]
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc=2183030
CLauncherTipContextMenu::GetMenuItemsAsync=6072240
@ -20,18 +20,18 @@ winrt::Windows::Internal::Shell::implementation::MeetAndChatManager::OnMessage=3
CImmersiveHotkeyNotification::_GetMonitorForHotkeyNotification=2411916
IsDesktopInputContext=43992
CImmersiveHotkeyNotification::OnMessage=410208
CMessageNotificationHolder::OnMessage=456832
[stobject]
SysTrayWndProc=19808
HotPlugButtonClick=96336
[Windows.UI.FileExplorer]
ContextMenuPresenter::DoContextMenu=265520
[StartDocked]
Windows::UI::Core::IVisibilityChangedEventArgs::Visible::get=402004
StartDocked::LauncherFrame::ShowAllApps=1609404
StartDocked::LauncherFrame::OnVisibilityChanged=1601824
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps=15376
StartDocked::StartSizingFrame::StartSizingFrame=1444588
[ExplorerFrame]
CUniversalSearchBand::IsModernSearchBoxEnabled=338164
[Windows.UI.Xaml]
CJupiterWindow::StaticCoreWindowSubclassProc=2038048
[OS]

16
configs/_x64/22449.1000/settings.ini
View File

@ -1,12 +1,12 @@
[explorer]
CTray::_HandleGlobalHotkey=23552
CTray::v_WndProc=58096
CTray::_FireDesktopSwitchIfReady=153368
CTray::Init=28636
OffsetOK=1
winrt::impl::consume_WindowsUdk_ApplicationModel_AppExtensions_IXamlExtensions2*::IsExtensionAvailable=27820
OffsetOK=0
Dirty=0
OffsetStrat=1
Offset=386
OffsetStrat=0
Offset=0
[twinui.pcshell]
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc=2170710
CLauncherTipContextMenu::GetMenuItemsAsync=5975344
@ -25,14 +25,14 @@ SysTrayWndProc=23952
HotPlugButtonClick=98012
[Windows.UI.FileExplorer]
ContextMenuPresenter::DoContextMenu=263760
[OS]
Build=10.0.22449.1000
[General]
AllocConsole=0
[StartDocked]
StartDocked::LauncherFrame::ShowAllApps=1352856
StartDocked::LauncherFrame::OnVisibilityChanged=1345888
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps=2819344
StartDocked::StartSizingFrame::StartSizingFrame=1174212
[ExplorerFrame]
CUniversalSearchBand::IsModernSearchBoxEnabled=271960
[Windows.UI.Xaml]
CJupiterWindow::StaticCoreWindowSubclassProc=1299824
[OS]
Build=10.0.22449.1000