Findings in the M1 7850 leak

Discussion in 'Windows 8' started by NaiveUser, Apr 15, 2011.

  1. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    Following are some information of the leaked M1, about TWINAPI.DLL and TWINUI.DLL

    Exported functions of TWINAPI.DLL

    CreateCompanionWindow
    CreateImmersiveWindow
    DllCanUnloadNow
    DllGetClassObject
    EmulateCreateWindowInBand
    EmulateGetWindowBand
    EmulateSetWindowBand
    GetImmersiveMode
    IsImmersiveWindow
    IsWindowServiceSupported
    QueryWindowService
    RegisterWindowService
    UnregisterAllWindowServices
    UnregisterWindowService

    New functions in USER32.DLL that TWINAPI.DLL imports:

    CreateWindowInBand
    GetWindowBand
    SetWindowBand

    TWINUI.DLL also imports some new functions from DUI70.DLL DUSER.DLL SHELL32.DLL and KERNEL32.DLL
    and it exports a function called LaunchSystemFlow
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    resources from TWINUI.DLL.MUI, it looks like it has a builtin screenshot snapping and sending feature

    Menus:

    1900
    &Dock
    &Close

    1901
    &Dock
    &Close

    1902
    &Undock
    &Minimize
    &Close

    Strings:

    1002,Selection Basket
    1003,Save Bar
    1004,Picker
    1005,%1!d! item selected
    1006,%1!d! items selected
    1007,SELECT

    1008,SELECT FOLDER
    1009,SAVE
    1010,%1 (%2)
    1011,Title Bar
    1012,Up
    1013,Close
    1014,File Types
    1015,Quick Access Links

    1600,Recent Programs Page
    1601,Docked Programs
    1602,Dock and undock programs here
    1605,Recent Programs
    1606,Programs you've used recently

    2100,Search Pane
    2101,Search Box
    2102,Search Button
    2103,Clear Button
    2104,Close Button
    2105,Search Pane List
    2106,Searchable Application List Item
    2107,Search Suggestion List Item
    2110," Search"
    2111," Search %1"

    2112,Search in applications

    2701,Share
    2702,Take a screenshot
    2703,This is a screenshot of what I’m doing right now

    2704,Stash
    2705,There are no destinations for the selected content. Please choose another piece of content.
    2706,Destinations are unavailable.
    2707,Content is unavailable.
    2708,Unable to perform user action.

    3003,Fetching...
    3004,Horizontal Scroll Bar
    3005,Vertical Scroll Bar
    3006,Touch View
    3007,Expand Group

    3008,Collapse Group
    3009,Count
    3010,%1!d! items
    3011,%1!d! item
    3012,%1!d! items selected
    3013,%1!d! item selected
    3014,%1!s!, %2!s!
    3015,item %1!d! of %2!d!
    3016,Group Header
    3017,%1!s! %2!s!
    3018,%1:
    3019,(%1!u!)
    3020,(Empty)
    3021,(Show all %1!d!)
    3022,This folder is empty.
    3023,Unspecified

    3024,Extra Large Icons
    3025,Large Icons
    3026,Medium Icons
    3027,Small Icons
    3028,List
    3029,Details
    3030,Tiles
    3031,Content
    3032,File and folder view reentrancy
    3033,The file and folder view encountered an unexpected state

    3502,Start menu
    3503,Search

    4502,Launch %s
    4503,Open notification
    4504,%s notification
    4505,%s to new notification.
    4506,99+

    5003,Horizon Frame
    5004,Horizon

    6101,Toast Content Host
    6103,Toast Close Button

    7101,SEARCH
    7102,SHARE
    7103,PLAY

    7104,PRINT
    7105,PIN
    7106,STASH
    7107,LOOKUP
    7110,CharmBar

    7502,Other user
    7503,Logged on

    7504,User Name
    7505,My Settings
    7506,My Look
    7507,Switch user
    7508,Add user
    7509,Log off
    7510,Lock PC

    22017,Lookup Flow
    22018,Choose an application for Lookup:
    22019,Error launching the target application.

    22097,lookup_heading
    22098,lookup_scroller
    22099,lookup_list
    22100,lookup_error
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is a new NINPUT.DLL which describe itself as 'Microsoft Pen and Touch Input Component'

    it exports a function named: DefaultInputHandler
    it imports new functions from USER32.DLL

    GetPointerDeviceRects
    GetPointerType
    GetPointerInfo
    GetPointerInfoHistory
    GetPointerTouchInfo
    GetPointerTouchInfoHistory
    GetPointerPenInfo
    GetPointerPenInfoHistory
    GetPointerDevice

    and a new function from DWMAPI.DLL

    DwmRenderGesture
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there are some AppX related libraries:

    AppxBitsDataSource.dll

    AppXDeploymentClient.dll which exports:
    AppxAddPackage
    AppxRemovePackage

    AppXDeploymentServer.dll which exports:
    EnqueueAddRequest
    EnqueueRemoveRequest
    RemoveDeploymentRequest

    AppxPackaging.dll
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Zack...

    Zack... MDL Member

    Jan 13, 2011
    106
    23
    10
    In twinui.dll there are loads of bitmap images that are from the UI itself. It also calls itself 'Microsoft Windows Immersive Shell' and there are several references to 'tiles' and 'toasts', I don't know what toasts are though...

    I wonder if this Immersive shell is actually unlockable in build 7850? I would think not, seeing as though there are not many registry entries relating to 'Immersive Shell' and the twinui.dll seems incomplete.

    I was surprised to see this file in this build considering how early on in the development the build is. I guess this 'immersive' in Win8 is equivalent to the Superbar in Win7.

    Both were known about but hidden. And both were present very very early on in the development process. My guess is that the builds with the newer logon screen can probably unlock 'Immersive Shell'. Its still very much incomplete in build 7850.
     
  6. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    #6 NaiveUser, Apr 15, 2011
    Last edited: Apr 15, 2011
    (OP)
    there is a new WebCam.exe which descript itself as 'Webcam Capture Application'
    and Microsoft-Windows-WebcamExperience-WebcamExe, it has there images in its UI, obviously in Metro style,
    apparently they are:
    <AccessibleButton id="atom(idDelayedPhotoCaptureBtn)" ...
    <AccessibleButton id="atom(idInstantPhotoCaptureBtn)" ...
    <AccessibleButton id="atom(idVideoCaptureBtn)" ...
     

    Attached Files:

    • 302.png
      302.png
      File size:
      11.1 KB
      Views:
      95
    • 300.png
      300.png
      File size:
      12.2 KB
      Views:
      49
    • 301.png
      301.png
      File size:
      10.5 KB
      Views:
      44
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    aerolite.msstyles w w w . fileserve . c o m /file/qFMnBzy
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    yep, some PNGs here
     

    Attached Files:

    • 7206.png
      7206.png
      File size:
      1.1 KB
      Views:
      1,322
    • 7201.png
      7201.png
      File size:
      878 bytes
      Views:
      1,303
    • 7204.png
      7204.png
      File size:
      662 bytes
      Views:
      1,264
    • 7207.png
      7207.png
      File size:
      838 bytes
      Views:
      1,326
    • 7205.png
      7205.png
      File size:
      770 bytes
      Views:
      1,327
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    more from TwinUI.dll
     

    Attached Files:

    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    #10 NaiveUser, Apr 15, 2011
    Last edited by a moderator: Apr 20, 2017
    (OP)
    in Android, a Toast is just a popup message window,
    Windows Live Messenger's notify windows are Toast too,
    and TwinUI's Toast looks like this, a content element and a close button :

    Code:
    <duixml>
    <HWNDElement resid="ToastContentHost" sheet="ToastContentStyle" layout="borderlayout()" contentalign="middlecenter" accessible="true" accname="resstr(6101, library(twinui.dll))" accrole="pane" active="mouse">
    <Element id="atom(ToastContentContainer)" layoutpos="client" layout="filllayout()" contentalign="middlecenter"></Element>
    </HWNDElement>
    <Element resid="ToastCloseButtonContainer" layoutpos="right" contentalign="topright" layout="filllayout()">
    <Button id="atom(ToastCloseButton)" contentalign="topright" layoutpos="top" accessible="true" accname="resstr(6103, library(twinui.dll))" accrole="pushbutton" active="mouse"/>
    </Element>
    <stylesheets>
    <style resid="ToastContentStyle">
    <if id="atom(ToastCloseButton)">
    <Button content="themeable(graphic(6201,2,-1,0,0,0,0,library(twinui.dll)), graphic(6204,2,-1,0,0,0,0,library(twinui.dll)))"/>
    <if mousefocused="true">
    <Button content="themeable(graphic(6207,2,-1,0,0,0,0,library(twinui.dll)), graphic(6210,2,-1,0,0,0,0,library(twinui.dll)))"/>
    </if>
    <if pressed="true">
    <Button content="themeable(graphic(6213,2,-1,0,0,0,0,library(twinui.dll)), graphic(6210,2,-1,0,0,0,0,library(twinui.dll)))"/>
    </if>
    <ifgreaterequal DPI="120">
    <Button content="themeable(graphic(6202,2,-1,0,0,0,0,library(twinui.dll)), graphic(6205,2,-1,0,0,0,0,library(twinui.dll)))"/>
    <if mousefocused="true">
    <Button content="themeable(graphic(6208,2,-1,0,0,0,0,library(twinui.dll)), graphic(6211,2,-1,0,0,0,0,library(twinui.dll)))"/>
    </if>
    <if pressed="true">
    <Button content="themeable(graphic(6214,2,-1,0,0,0,0,library(twinui.dll)), graphic(6211,2,-1,0,0,0,0,library(twinui.dll)))"/>
    </if>
    </ifgreaterequal>
    <ifgreaterequal DPI="144">
    <Button content="themeable(graphic(6203,2,-1,0,0,0,0,library(twinui.dll)), graphic(6206,2,-1,0,0,0,0,library(twinui.dll)))"/>
    <if mousefocused="true">
    <Button content="themeable(graphic(6209,2,-1,0,0,0,0,library(twinui.dll)), graphic(6212,2,-1,0,0,0,0,library(twinui.dll)))"/>
    </if>
    <if pressed="true">
    <Button content="themeable(graphic(6215,2,-1,0,0,0,0,library(twinui.dll)), graphic(6212,2,-1,0,0,0,0,library(twinui.dll)))"/>
    </if>
    </ifgreaterequal>
    </if>
    </style>
    </stylesheets>
    </duixml>
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there are apprepapi.dll and apprepsync.dll, which are related to the 'Application Reputation APIs', these should be the OS integrated version the IE's SmartScreen features:
    see: b l ogs.msdn.c o m/b/ie/archive/2011/03/10/internet-explorer-9-security-part-2-protection-from-socially-engineered-attacks.aspx
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is a bdechangepin.exe, which is "BitLocker Drive Encryption: PIN Change Tool"
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  13. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is a CreateBootableUFD.exe, which can create bootable USB Flash Devices.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  14. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is a dcomp.dll, which is 'Microsoft DirectComposition Library', looks like a new component of DirectX,
    it exports a function : DCompositionCreateDevice
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  15. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    #15 NaiveUser, Apr 15, 2011
    Last edited: Apr 15, 2011
    (OP)
    there are a bunch of new dlls related to devices management

    das.dll "Device Association Service"
    deviceassociation.dll 'Device Association Client DLL'
    DeviceDriverRetrievalClient.dll 'Device Driver Retrieval Client'
    DeviceMetadataRetrievalClient 'Windows MRC'
    DeviceSetupManager.dll "Device Setup Manager"
    DeviceSetupManagerAPI.dll "Device Setup Manager Client API"
    DeviceStateProviders.dll "TODO: <File description>" :biggrin:
    DeviceStateQEC.dll "Microsoft DSAP Enforcement Client"
    devinv.dll "Device Inventory Library"
    DevPropMgr.dll "Microsoft Windows Device Property Manager"
    DsmUserTask.exe "Device Setup Manager User Task Handler"
    Dsui.dll "Device Setup UI Pages"

    and surprise, there are some of these dlls in some online dll databases and their version is 6.2.7978.0 !
    systemexplorer.n e t/db/devicesetupmanager.dll.html
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  16. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is a lot of new files related to 'Data Protection'

    dpapi.dll, dpapisrv.dll, dpcat.dll, dpcfg.dll, dpengine.dll, dpevents.dll, dpmanage.exe, dpsvc.dll, dpsvcctl.dll
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  17. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    #17 NaiveUser, Apr 15, 2011
    Last edited: Apr 15, 2011
    (OP)
    there is a explorerindicator.dll, which is 'Explorer Input Indicator', which uses these strings:

    100,Touch Keyboard
    101,Settings...
    102,Deskband Indicator

    it calls into another new dll: inputswitch.dll which is "Microsoft Windows Input Switcher"

    1001,Alt-1
    1002,Alt-2
    1003,Alt-3
    1004,Alt-4
    1005,Alt-5
    1006,Alt-6
    1007,Alt-7

    1008,Alt-8
    1009,Alt-9
    1010,Alt-0
    1011,Alt-Caps Lock
    1012,Shift-Esc
    1013,%1!s! - %2!s!

    1110,Text Input Mode Switching
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is fbappinv.exe which is 'Application Inventory Module for Win8 Feedback tool' and there is FeedbackTool.dll which is 'Feedback Tool'
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  19. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    there is fsavailux.exe which uses some strings like

    101,Spot Verifier
    102,Provides Disk Corruption Spot Verification Capabilities.

    200,Restart Now
    201,Restart Later
    202,Action Center
    205,Before restarting, save any open files and close all programs.
    206,You don't have permission to restart this computer.
    207,Restart this computer to fix file system corruption
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  20. NaiveUser

    NaiveUser MDL Senior Member

    Apr 14, 2011
    419
    522
    10
    #20 NaiveUser, Apr 15, 2011
    Last edited: Apr 15, 2011
    (OP)
    there is glcnd.exe which is 'Microsoft-Windows-Reader' and glcndFilter.dll which maybe a library for the reader. its the modern PDF reader in Windows.
    it uses these strings:

    1600,LAYOUT
    1601,FILE
    1602,FIND
    1603,CONTENT
    1604,ROTATE
    1605,Zoom Label
    1606,0%
    1607,OPEN
    1608,SAVE AS
    1609,ONE PAGE
    1610,TWO PAGE
    1611,FIND IN THIS DOCUMENT

    50001,Reader
    50010,UI Root

    50020,Reader Open Dialog
    50021,PDF files (*.pdf)

    50101,SEARCHING ...
    50102,%1!d! RESULTS (SEARCHING ...)
    50103,%1!d! OF %2!d! RESULTS
    50104,PAGE %1!d!
    50105,HISTORY
    50106,SUGGESTION

    50201,%1!s!%%

    50301,There is an error in opening this document.
    50302,Glcnd
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...