Following are some information of the leaked M1, about TWINAPI.DLL and TWINUI.DLL Exported functions of TWINAPI.DLL CreateCompanionWindow CreateImmersiveWindow DllCanUnloadNow DllGetClassObject EmulateCreateWindowInBand EmulateGetWindowBand EmulateSetWindowBand GetImmersiveMode IsImmersiveWindow IsWindowServiceSupported QueryWindowService RegisterWindowService UnregisterAllWindowServices UnregisterWindowService New functions in USER32.DLL that TWINAPI.DLL imports: CreateWindowInBand GetWindowBand SetWindowBand TWINUI.DLL also imports some new functions from DUI70.DLL DUSER.DLL SHELL32.DLL and KERNEL32.DLL and it exports a function called LaunchSystemFlow
resources from TWINUI.DLL.MUI, it looks like it has a builtin screenshot snapping and sending feature Menus: 1900 &Dock &Close 1901 &Dock &Close 1902 &Undock &Minimize &Close Strings: 1002,Selection Basket 1003,Save Bar 1004,Picker 1005,%1!d! item selected 1006,%1!d! items selected 1007,SELECT 1008,SELECT FOLDER 1009,SAVE 1010,%1 (%2) 1011,Title Bar 1012,Up 1013,Close 1014,File Types 1015,Quick Access Links 1600,Recent Programs Page 1601,Docked Programs 1602,Dock and undock programs here 1605,Recent Programs 1606,Programs you've used recently 2100,Search Pane 2101,Search Box 2102,Search Button 2103,Clear Button 2104,Close Button 2105,Search Pane List 2106,Searchable Application List Item 2107,Search Suggestion List Item 2110," Search" 2111," Search %1" 2112,Search in applications 2701,Share 2702,Take a screenshot 2703,This is a screenshot of what I’m doing right now 2704,Stash 2705,There are no destinations for the selected content. Please choose another piece of content. 2706,Destinations are unavailable. 2707,Content is unavailable. 2708,Unable to perform user action. 3003,Fetching... 3004,Horizontal Scroll Bar 3005,Vertical Scroll Bar 3006,Touch View 3007,Expand Group 3008,Collapse Group 3009,Count 3010,%1!d! items 3011,%1!d! item 3012,%1!d! items selected 3013,%1!d! item selected 3014,%1!s!, %2!s! 3015,item %1!d! of %2!d! 3016,Group Header 3017,%1!s! %2!s! 3018,%1: 3019,(%1!u!) 3020,(Empty) 3021,(Show all %1!d!) 3022,This folder is empty. 3023,Unspecified 3024,Extra Large Icons 3025,Large Icons 3026,Medium Icons 3027,Small Icons 3028,List 3029,Details 3030,Tiles 3031,Content 3032,File and folder view reentrancy 3033,The file and folder view encountered an unexpected state 3502,Start menu 3503,Search 4502,Launch %s 4503,Open notification 4504,%s notification 4505,%s to new notification. 4506,99+ 5003,Horizon Frame 5004,Horizon 6101,Toast Content Host 6103,Toast Close Button 7101,SEARCH 7102,SHARE 7103,PLAY 7104,PRINT 7105,PIN 7106,STASH 7107,LOOKUP 7110,CharmBar 7502,Other user 7503,Logged on 7504,User Name 7505,My Settings 7506,My Look 7507,Switch user 7508,Add user 7509,Log off 7510,Lock PC 22017,Lookup Flow 22018,Choose an application for Lookup: 22019,Error launching the target application. 22097,lookup_heading 22098,lookup_scroller 22099,lookup_list 22100,lookup_error
there is a new NINPUT.DLL which describe itself as 'Microsoft Pen and Touch Input Component' it exports a function named: DefaultInputHandler it imports new functions from USER32.DLL GetPointerDeviceRects GetPointerType GetPointerInfo GetPointerInfoHistory GetPointerTouchInfo GetPointerTouchInfoHistory GetPointerPenInfo GetPointerPenInfoHistory GetPointerDevice and a new function from DWMAPI.DLL DwmRenderGesture
there are some AppX related libraries: AppxBitsDataSource.dll AppXDeploymentClient.dll which exports: AppxAddPackage AppxRemovePackage AppXDeploymentServer.dll which exports: EnqueueAddRequest EnqueueRemoveRequest RemoveDeploymentRequest AppxPackaging.dll
In twinui.dll there are loads of bitmap images that are from the UI itself. It also calls itself 'Microsoft Windows Immersive Shell' and there are several references to 'tiles' and 'toasts', I don't know what toasts are though... I wonder if this Immersive shell is actually unlockable in build 7850? I would think not, seeing as though there are not many registry entries relating to 'Immersive Shell' and the twinui.dll seems incomplete. I was surprised to see this file in this build considering how early on in the development the build is. I guess this 'immersive' in Win8 is equivalent to the Superbar in Win7. Both were known about but hidden. And both were present very very early on in the development process. My guess is that the builds with the newer logon screen can probably unlock 'Immersive Shell'. Its still very much incomplete in build 7850.
there is a new WebCam.exe which descript itself as 'Webcam Capture Application' and Microsoft-Windows-WebcamExperience-WebcamExe, it has there images in its UI, obviously in Metro style, apparently they are: <AccessibleButton id="atom(idDelayedPhotoCaptureBtn)" ... <AccessibleButton id="atom(idInstantPhotoCaptureBtn)" ... <AccessibleButton id="atom(idVideoCaptureBtn)" ...
in Android, a Toast is just a popup message window, Windows Live Messenger's notify windows are Toast too, and TwinUI's Toast looks like this, a content element and a close button : Code: <duixml> <HWNDElement resid="ToastContentHost" sheet="ToastContentStyle" layout="borderlayout()" contentalign="middlecenter" accessible="true" accname="resstr(6101, library(twinui.dll))" accrole="pane" active="mouse"> <Element id="atom(ToastContentContainer)" layoutpos="client" layout="filllayout()" contentalign="middlecenter"></Element> </HWNDElement> <Element resid="ToastCloseButtonContainer" layoutpos="right" contentalign="topright" layout="filllayout()"> <Button id="atom(ToastCloseButton)" contentalign="topright" layoutpos="top" accessible="true" accname="resstr(6103, library(twinui.dll))" accrole="pushbutton" active="mouse"/> </Element> <stylesheets> <style resid="ToastContentStyle"> <if id="atom(ToastCloseButton)"> <Button content="themeable(graphic(6201,2,-1,0,0,0,0,library(twinui.dll)), graphic(6204,2,-1,0,0,0,0,library(twinui.dll)))"/> <if mousefocused="true"> <Button content="themeable(graphic(6207,2,-1,0,0,0,0,library(twinui.dll)), graphic(6210,2,-1,0,0,0,0,library(twinui.dll)))"/> </if> <if pressed="true"> <Button content="themeable(graphic(6213,2,-1,0,0,0,0,library(twinui.dll)), graphic(6210,2,-1,0,0,0,0,library(twinui.dll)))"/> </if> <ifgreaterequal DPI="120"> <Button content="themeable(graphic(6202,2,-1,0,0,0,0,library(twinui.dll)), graphic(6205,2,-1,0,0,0,0,library(twinui.dll)))"/> <if mousefocused="true"> <Button content="themeable(graphic(6208,2,-1,0,0,0,0,library(twinui.dll)), graphic(6211,2,-1,0,0,0,0,library(twinui.dll)))"/> </if> <if pressed="true"> <Button content="themeable(graphic(6214,2,-1,0,0,0,0,library(twinui.dll)), graphic(6211,2,-1,0,0,0,0,library(twinui.dll)))"/> </if> </ifgreaterequal> <ifgreaterequal DPI="144"> <Button content="themeable(graphic(6203,2,-1,0,0,0,0,library(twinui.dll)), graphic(6206,2,-1,0,0,0,0,library(twinui.dll)))"/> <if mousefocused="true"> <Button content="themeable(graphic(6209,2,-1,0,0,0,0,library(twinui.dll)), graphic(6212,2,-1,0,0,0,0,library(twinui.dll)))"/> </if> <if pressed="true"> <Button content="themeable(graphic(6215,2,-1,0,0,0,0,library(twinui.dll)), graphic(6212,2,-1,0,0,0,0,library(twinui.dll)))"/> </if> </ifgreaterequal> </if> </style> </stylesheets> </duixml>
there are apprepapi.dll and apprepsync.dll, which are related to the 'Application Reputation APIs', these should be the OS integrated version the IE's SmartScreen features: see: b l ogs.msdn.c o m/b/ie/archive/2011/03/10/internet-explorer-9-security-part-2-protection-from-socially-engineered-attacks.aspx
there is a dcomp.dll, which is 'Microsoft DirectComposition Library', looks like a new component of DirectX, it exports a function : DCompositionCreateDevice
there are a bunch of new dlls related to devices management das.dll "Device Association Service" deviceassociation.dll 'Device Association Client DLL' DeviceDriverRetrievalClient.dll 'Device Driver Retrieval Client' DeviceMetadataRetrievalClient 'Windows MRC' DeviceSetupManager.dll "Device Setup Manager" DeviceSetupManagerAPI.dll "Device Setup Manager Client API" DeviceStateProviders.dll "TODO: <File description>" DeviceStateQEC.dll "Microsoft DSAP Enforcement Client" devinv.dll "Device Inventory Library" DevPropMgr.dll "Microsoft Windows Device Property Manager" DsmUserTask.exe "Device Setup Manager User Task Handler" Dsui.dll "Device Setup UI Pages" and surprise, there are some of these dlls in some online dll databases and their version is 6.2.7978.0 ! systemexplorer.n e t/db/devicesetupmanager.dll.html
there is a lot of new files related to 'Data Protection' dpapi.dll, dpapisrv.dll, dpcat.dll, dpcfg.dll, dpengine.dll, dpevents.dll, dpmanage.exe, dpsvc.dll, dpsvcctl.dll
there is a explorerindicator.dll, which is 'Explorer Input Indicator', which uses these strings: 100,Touch Keyboard 101,Settings... 102,Deskband Indicator it calls into another new dll: inputswitch.dll which is "Microsoft Windows Input Switcher" 1001,Alt-1 1002,Alt-2 1003,Alt-3 1004,Alt-4 1005,Alt-5 1006,Alt-6 1007,Alt-7 1008,Alt-8 1009,Alt-9 1010,Alt-0 1011,Alt-Caps Lock 1012,Shift-Esc 1013,%1!s! - %2!s! 1110,Text Input Mode Switching
there is fbappinv.exe which is 'Application Inventory Module for Win8 Feedback tool' and there is FeedbackTool.dll which is 'Feedback Tool'
there is fsavailux.exe which uses some strings like 101,Spot Verifier 102,Provides Disk Corruption Spot Verification Capabilities. 200,Restart Now 201,Restart Later 202,Action Center 205,Before restarting, save any open files and close all programs. 206,You don't have permission to restart this computer. 207,Restart this computer to fix file system corruption
there is glcnd.exe which is 'Microsoft-Windows-Reader' and glcndFilter.dll which maybe a library for the reader. its the modern PDF reader in Windows. it uses these strings: 1600,LAYOUT 1601,FILE 1602,FIND 1603,CONTENT 1604,ROTATE 1605,Zoom Label 1606,0% 1607,OPEN 1608,SAVE AS 1609,ONE PAGE 1610,TWO PAGE 1611,FIND IN THIS DOCUMENT 50001,Reader 50010,UI Root 50020,Reader Open Dialog 50021,PDF files (*.pdf) 50101,SEARCHING ... 50102,%1!d! RESULTS (SEARCHING ...) 50103,%1!d! OF %2!d! RESULTS 50104,PAGE %1!d! 50105,HISTORY 50106,SUGGESTION 50201,%1!s!%% 50301,There is an error in opening this document. 50302,Glcnd