Skip to content

Instantly share code, notes, and snippets.

@ADeltaX
Last active September 24, 2024 12:49
Show Gist options
  • Save ADeltaX/a0b5366f91df26c5fa2aeadf439346c9 to your computer and use it in GitHub Desktop.
Save ADeltaX/a0b5366f91df26c5fa2aeadf439346c9 to your computer and use it in GitHub Desktop.
Example of creating a window using a private api on a dll-injected immersive process
#include "pch.h"
#pragma comment(lib, "gdi32.lib")
enum ZBID
{
ZBID_DEFAULT = 0,
ZBID_DESKTOP = 1,
ZBID_UIACCESS = 2,
ZBID_IMMERSIVE_IHM = 3,
ZBID_IMMERSIVE_NOTIFICATION = 4,
ZBID_IMMERSIVE_APPCHROME = 5,
ZBID_IMMERSIVE_MOGO = 6,
ZBID_IMMERSIVE_EDGY = 7,
ZBID_IMMERSIVE_INACTIVEMOBODY = 8,
ZBID_IMMERSIVE_INACTIVEDOCK = 9,
ZBID_IMMERSIVE_ACTIVEMOBODY = 10,
ZBID_IMMERSIVE_ACTIVEDOCK = 11,
ZBID_IMMERSIVE_BACKGROUND = 12,
ZBID_IMMERSIVE_SEARCH = 13,
ZBID_GENUINE_WINDOWS = 14,
ZBID_IMMERSIVE_RESTRICTED = 15,
ZBID_SYSTEM_TOOLS = 16,
ZBID_LOCK = 17,
ZBID_ABOVELOCK_UX = 18,
};
LRESULT CALLBACK TrashParentWndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
{
switch (message)
{
case WM_CREATE:
break;
case WM_DESTROY:
PostQuitMessage(0);
break;
case WM_WINDOWPOSCHANGING:
return 0;
case WM_CLOSE:
HANDLE myself;
myself = OpenProcess(PROCESS_ALL_ACCESS, false, GetCurrentProcessId());
TerminateProcess(myself, 0);
return true;
break;
default:
break;
}
return DefWindowProc(hwnd, message, wParam, lParam);
}
HWND hwnd = NULL;
typedef HWND(WINAPI* CreateWindowInBand)(_In_ DWORD dwExStyle, _In_opt_ ATOM atom, _In_opt_ LPCWSTR lpWindowName, _In_ DWORD dwStyle, _In_ int X, _In_ int Y, _In_ int nWidth, _In_ int nHeight, _In_opt_ HWND hWndParent, _In_opt_ HMENU hMenu, _In_opt_ HINSTANCE hInstance, _In_opt_ LPVOID lpParam, DWORD band);
void CreateWin(HMODULE hModule, UINT zbid, const wchar_t* title, const wchar_t* classname)
{
{
HINSTANCE hInstance = hModule;
WNDCLASSEX wndParentClass = {};
wndParentClass.cbSize = sizeof(WNDCLASSEX);
wndParentClass.cbClsExtra = 0;
wndParentClass.hIcon = NULL;
wndParentClass.lpszMenuName = NULL;
wndParentClass.hIconSm = NULL;
wndParentClass.lpfnWndProc = TrashParentWndProc;
wndParentClass.hInstance = hInstance;
wndParentClass.style = CS_HREDRAW | CS_VREDRAW;
wndParentClass.hCursor = LoadCursor(0, IDC_ARROW);
wndParentClass.hbrBackground = (HBRUSH)GetStockObject(WHITE_BRUSH);
wndParentClass.lpszClassName = classname;
auto res = RegisterClassEx(&wndParentClass);
const auto hpath = LoadLibrary(L"user32.dll");
const auto pCreateWindowInBand = CreateWindowInBand(GetProcAddress(hpath, "CreateWindowInBand"));
auto hwndParent = pCreateWindowInBand(WS_EX_TOPMOST | WS_EX_NOACTIVATE,
res,
NULL,
0x80000000,
0, 0, 0, 0,
NULL,
NULL,
wndParentClass.hInstance,
LPVOID(res),
zbid);
SetWindowLong(hwndParent, GWL_STYLE, 0);
SetWindowLong(hwndParent, GWL_EXSTYLE, 0);
SetWindowPos(hwndParent, nullptr, 40, 40, 600, 600, SWP_SHOWWINDOW | SWP_NOZORDER);
ShowWindow(hwndParent, SW_SHOW);
UpdateWindow(hwndParent);
if (hwndParent != nullptr)
hwnd = hwndParent;
}
}
DWORD WINAPI Thrd(LPVOID lpParam)
{
CreateWin(NULL, ZBID_SYSTEM_TOOLS, L"Really Genuine Window++", L"TestPlus");
MSG msg;
while (GetMessage(&msg, nullptr, 0, 0))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
return 0;
}
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CreateThread(nullptr, 0, Thrd, hModule, NULL, NULL);
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
@ADeltaX
Copy link
Author

ADeltaX commented Mar 17, 2020

Can you use this from a regular C++ Win32 app? Thanks.

Yes.

@valinet
Copy link

valinet commented Mar 23, 2020

How? When I run it, the returned HWND is NULL. Also, what should init_apartment do, it is missing from your example. Thanks.

@valinet
Copy link

valinet commented Mar 23, 2020

Figured it out, eventually. The call to init_apartment is from the C++/WinRT langauge projection. For this example, it turns out it is not needed. What is needed though, is to properly initialize the WNDCLASSEX structure, by properly setting its size and zeroing it when declaring it, like so:

WNDCLASSEX wndParentClass = {};
wndParentClass.cbSize = sizeof(WNDCLASSEX);

In order to successfully run this, create a DLL and load it into a RuntimeBroker.exe instance that you are starting. To load a DLL in an external process, you can use the CreateRemoteThread technique. You can also close the instance that you started when your main app closes by creating a job object and setting the JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE limit flag on it.
This should be a public API, anyone can spawn RuntimeBroker.exe and open their window and do their code there, so what's the point of overprotecting this so much?
Thank you very much for the sample code you have provided.

@ADeltaX
Copy link
Author

ADeltaX commented Mar 24, 2020

Perfect, I'm happy that it worked fine for you!

I forgot to remove init_apartment since I was trying to put a xaml islands in it (without getting it to work at all). Also I forgot to zero memory wndParentClass. I've updated it accordingly.

Thank you!

PS:

This should be a public API, anyone can spawn RuntimeBroker.exe and open their window and do their code there, so what's the point of overprotecting this so much?

It's Microsoft, they haven't thought about dll injection lol

@valinet
Copy link

valinet commented Mar 24, 2020

It's Microsoft, they haven't thought about dll injection lol

Yeah, right? I was showing this to a friend and taking with him about how open Windows is in this regard... On Linux, it is much harder to achieve this, as far as I know.

I forgot to remove init_apartment since I was trying to put a xaml islands in it (without getting it to work at all).

For me, it would not run with the call there... Weird... Anyway, since you took the time to update it, please remove the using namespace winrt line at the top of the document as well.

Anyway, thank you very much again for this, I hope to turn it into a cool project that I am currently working on.

@ADeltaX
Copy link
Author

ADeltaX commented Mar 24, 2020

init_apartment needs C++/WinRT "compiler toolchain" to work. Also it works only in Release AFAIK.

Anyway, since you took the time to update it, please remove the using namespace winrt line at the top of the document as well.

Updated! 😀

@valinet
Copy link

valinet commented Mar 24, 2020

init_apartment needs C++/WinRT "compiler toolchain" to work.

All right, this I have installed.

Also it works only in Release AFAIK.

All right, I did not know that. I was running in Debug, indeed.

Updated! 😀

Thanks ;)

@valinet
Copy link

valinet commented Mar 24, 2020

Anyway, how did you figure about this? Did you need it for some project, or...?
Also, do you happen to know of any hidden API or stuff like that than can hide buttons on the taskbar for UWP apps. The ITaskBarList interfaces (specifically DeleteTab()) work for regular apps, but not for UWP. Do you have any insight on this?
Thank you.

@jhuewel
Copy link

jhuewel commented Dec 17, 2020

Nice Work! Can this be used in a c# app?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment