Windows 8 RTM Activation Watermark

Discussion in 'Windows 8' started by Chris123NT, Aug 5, 2012.

  1. Chris123NT

    Chris123NT MDL Expert

    Oct 23, 2010
    Ok, I am posting this to report my findings, and hopefully with this information someone can write a permanent patch to disable the desktop watermark forever, so here goes:

    I rather quickly determined that the watermark is somehow tied to explorer.exe since restarting that process makes the watermark disappear, and the 3 hours later it shows up again. So I started looking through various DLL's and found the same key image that appears in the watermark as a bitmap in twinui.dll.

    So I downloaded a copy of Process explorer and started looking for threads within explorer.exe relating to twinui.dll, and this is what I found:

    Thread ID 3332 (this can Vary) twinui.dll!DllGetActivationFactory+0x5aad0

    I used the tools in process explorer to kill this thread within explorer, and since I have done that the watermark has NOT come back, and it has been way more than the normal 3 hour interval.

    So here's my question, anyone here good with a disassembler/hex editing that can patch explorer.exe to get rid of this watermark permanently? As doing that is a little outside of my expertise lol.

    Hope this post helps people who have been looking into this.