Skip to content

3.0

Choose a tag to compare

View all tags
@Firever-ultix Firever-ultix released this 28 Oct 21:41
· 17 commits to main since this release
3.0
1fbeeed

🚀 WinUltix v3.0.0 — Major Architectural & Kernel Internals Release

Version 3.0.0 represents the largest low-level engineering overhaul in the history of WinUltix. I have unified all P/Invoke interop layers into a single core engine (Core_Helpers.ps1), migrated every heavy audit and execution workflow into real-time streamed background Runspaces ($UltixSync), replaced external Out-GridView windows with custom double-buffered dark WinForms grids, and introduced native kernel32.dll / ntdll.dll CPU topology and live DPC interrupt telemetry.

🧠 Core Engine & Architecture (Core_Helpers.ps1)

  • Unified C# P/Invoke Runtime: Consolidated all native Win32/NT API calls into a single pre-compiled WinUltix namespace shared across the main UI thread and all background Runspaces:
    • [WinUltix.NativeMethods]: Native Win32 DWM Dark Title Bars (DWMWA_USE_IMMERSIVE_DARK_MODE = 20) across all forms and modals + High-DPI GDI scaling (SetProcessDpiAwarenessContext(-5)).
    • [WinUltix.ShellInterop]: Non-invasive shell and taskbar refresh via SHChangeNotify and SendMessageTimeout (WM_SETTINGCHANGE).
    • [WinUltix.PrivilegeEnabler]: Process token privilege escalation (SeTakeOwnershipPrivilege, SeRestorePrivilege) for modifying TrustedInstaller-protected registry keys.
    • [WinUltix.AppActivator]: Direct COM IApplicationActivationManager interop for deterministic Start Menu binary compilation.
    • [WinUltix.ListViewColumnSorter]: High-speed case-insensitive column sorting for WinForms ListView grids.
    • [WinUltix.CpuTopology]: Native kernel32.dll!GetLogicalProcessorInformationEx parser inspecting physical core masks, EfficiencyClass, and L3 Cache sizes.
    • [WinUltix.NtDll]: Native ntdll.dll!NtQueryTimerResolution, NtSetTimerResolution (live 0.5ms clock request), and NtQuerySystemInformation (SystemInterruptInformation 0x17) per-processor DPC telemetry.
  • Real-Time $UltixSync Runspace Streaming (Invoke-AsyncTask): Pre-hydrates background Runspaces via InitialSessionState (Get-UltixUserProfiles, Get-UltixFastSize, Set-ProtectedServiceStart, Get-UltixPowerAcIndex) and injects a thread-safe $UltixSync context (ConcurrentQueue log streaming + live progress reporting polled every 150ms).
  • Unified UI Factories & Protected Modals: Added New-UltixButton (with UseMnemonic = $false), New-UltixActionRow, Invoke-UltixAuditFlow, Enable-UltixDoubleBuffer, Show-ActionModal (with Select All, Deselect All, Select Detected, and live selection counter), and Show-UltixGridModal (live search filter, column sorting, state-preserving checkboxes, and IsLocked row protection for critical system services).
  • JSON Profile Snapshot Engine (Export-WinUltixProfile / Import-WinUltixProfile): Exports and restores active Registry tweaks, custom SRP+IFEO rules, disabled Services, Telemetry Tasks, Affinity Lasso rosters, and Z7 Hardware Locks (WinUltix_Snapshot_v1).
  • Zero-Bloat Custom GDI+ Dark UI ([WinUltix.DarkTabControl], [WinUltix.DarkProgressBar] & Color-Coded RichTextBox):
    • [WinUltix.DarkTabControl]: Eliminated legacy Win32 white 3D borders (TCM_ADJUSTRECT 0x1328 WndProc override) and gray tab strips in favor of an owner-drawn dark header with hover tracking and an active LightSkyBlue top accent bar.
    • [WinUltix.DarkProgressBar]: Replaced the glossy Vista-era green progress bar with a flat, double-buffered dark GDI+ status bar featuring a SteelBlue fill and a centered READY / 0%–100% readout.
    • Semantic Log Terminal (Write-GUI): Upgraded $global:infoBox to a syntax-highlighted RichTextBox that automatically color-codes timestamps (DarkGray), section headers (Cyan), [OK]/[+] completions (LightGreen), [!]/WARNING audit flags (Orange), and [ERROR]/[-] failures (IndianRed).

🧹 Module Z1: Deep System Cleanup (Z1_Cleanup.ps1)

  • Core Engine Consolidation: Replaced local directory walkers and CIM boilerplate with shared Runspace intrinsics (Get-UltixFastSize, Get-UltixUserProfiles, Invoke-UltixAuditFlow, and New-UltixActionRow), cutting module code footprint by ~40%.
  • Full Asynchronous Execution ($UltixSync): Migrated Invoke-InteractiveCleanup (wevtutil.exe cl channel loops, takeown.exe/icacls.exe SID *S-1-5-32-544 ACL overrides, and recursive Remove-Item passes) into an isolated background Runspace with real-time log and progress streaming.
  • High-Speed .NET I/O Enumeration: Replaced slow Get-ChildItem -Recurse | Measure-Object pipelines with a stack-based [System.IO.Directory]::EnumerateFiles scanner that skips NTFS ReparsePoint junctions and survives UnauthorizedAccessException locks.
  • Symmetrical Windows Update Service Hygiene: Added try/finally state preservation for wuauserv, bits, dosvc, and TrustedInstaller during SoftwareDistribution, DeliveryOptimization, and Logs\CBS purges—restarting only services that were actively running prior to cleanup.
  • Expanded Multi-Profile Browser & Shader Coverage: Added multi-profile enumeration (Default and Profile *) for Chromium browsers (Chrome, Edge, Brave, Vivaldi) covering Cache, Code Cache, and GPUCache, alongside DirectX D3DSCache, global/per-user Windows Error Reporting (WER) queues, and CBS servicing logs.

🗑️ Module Z2: Bloatware, Recall & OneDrive Amputation (Z2_Bloatware.ps1)

  • 100% Asynchronous Execution Pipeline: Moved all 5 heavy I/O and CBS servicing executors (Invoke-RemoveOneDrive, Invoke-RemoveCapabilities, Invoke-GarbageCollector, Invoke-RemoveBloatware, and Invoke-RemoveCapabilityStubs) off the UI thread into isolated Runspaces with live $UltixSync telemetry.
  • Windows Recall & AI Lockdown (24H2 / 25H2 / 26H2): Added deep inspection and payload removal for the Recall Windows Optional Feature (Disable-WindowsOptionalFeature -Online -FeatureName "Recall" -Remove) alongside DisableAIDataAnalysis and TurnOffSavingSnapshots GPO enforcement.
  • Granular 64-Item Bloatware Catalog: Unbundled grouped third-party casual games, social media clients, and OEM trialware suites into 64 individually selectable items (Spotify, TikTok, Netflix, Candy Crush, McAfee, Norton, Lenovo/Dell/HP stubs) with automatic AppxAllUserStore\Deprovisioned locking.
  • Transitive Appx Garbage Collector Hardening: Implemented a transitive closure loop for Framework -> Framework dependency chains, added IsResourcePackage exclusions, and shielded Windows 11 24H2–26H2 shell components (MicrosoftWindows.Client.*, Windows.CBSPreview) across both installed and provisioned stores.
  • Multi-Profile HKEY_USERS OneDrive Amputation: Extended OneDrive registry inspection and Run hook neutralization across all loaded Registry::HKEY_USERS\<SID> hives while evacuating locked FileSyncShell64.dll shell extensions to %TEMP%.

🛡️ Module Z3: Registry, Dual-Layer SRP+IFEO & Gaming (Z3_Registry.ps1)

  • Handle-Cached Registry Audit Engine (Invoke-RegistryAudit): Implemented a per-run registry handle cache ($keyCache with deterministic .Dispose()) and direct .NET RegistryKey.GetValue() inspection. Accurately distinguishes uninitialized (Default) keys ($null) from initialized empty strings ("" required by InprocServer32 for the classic Win10 context menu) and supports MatchRegex evaluation.
  • Scoped Dual-Layer SRP + IFEO Lockdown: Hardened Get-RegState_SRP to verify master Safer API switches (DefaultLevel = 262144, TransparentEnabled = 1). Upgraded Invoke-ApplySRP to enforce kernel UseFilter = 1 + FilterFullPath subkeys for custom .exe targets (preventing filename collisions across apps) while streaming background gpupdate.exe /force token refreshes via $UltixSync.
  • Live Win32 Shell Broadcasts: Replaced blunt explorer.exe termination during Taskbar and Explorer tweaks with live SHChangeNotify and WM_SETTINGCHANGE broadcasts, restarting explorer.exe or SearchHost.exe strictly when flagged by RestartShell / RestartSearch.
  • New Low-Level Kernel, Boot & Gaming Rules:
    • Added Boot: Disable Explorer Startup Delay (StartupDelayInMSec = 0 in Explorer\Serialize).
    • Added Kernel: Consolidate SvcHost Processes (SvcHostSplitThresholdInKB dynamically calculated from physical RAM capacity).
    • Added Gaming: Disable Multiplane Overlay (MPO) (OverlayTestMode = 5 in HKLM:\SOFTWARE\Microsoft\Windows\Dwm).
    • Added Gaming: Enable Windowed Game Optimizations (Flip Model) (non-destructive SwapEffectUpgradeEnable=1; injection/removal in DirectXUserGlobalSettings).
    • Migrated WNS App Push/Toast notification blocks (NoCloudApplicationNotification and NoToastApplicationNotification) to HKLM machine policies with clean DELETE_VALUE revert support.

⚙️ Module Z4: Services, Power/Display Tuner & Native Start Menu Compiler (Z4_Services.ps1)

  • TrustedInstaller / SYSTEM Service DACL Escalation: Integrated Set-ProtectedServiceStart to dynamically enable SeTakeOwnershipPrivilege and SeRestorePrivilege tokens, allowing WinUltix to cleanly lock or revert ACL-protected services (WaaSMedicSvc, DoSvc, WSAIFabricSvc) without Access Denied exceptions.
  • Interactive 8-Point Power & Display Optimizer (Get-PowerDisplayState & Invoke-ApplyPowerDisplay): Upgraded the Power & Display button into a full, symmetrically reversible interactive modal using Get-UltixPowerAcIndex. Audits and configures System Hibernation (hiberfil.sys), Standby/Sleep timeout, Monitor turn-off timeout (60 min AC), HDD/SATA AHCI spin-down (DISKIDLE), USB Selective Suspend (protecting DACs, VR headsets, and 4K/8KHz wireless dongles), Power Plan PCIe Link State Power Management (ASPM), 100% Minimum Processor AC state, and Display Content Adaptive Brightness Control (CABC / OLED auto-dimming).
  • Asynchronous Service, Task & Start Menu Enforcement ($UltixSync): Migrated Invoke-ApplyServices, Invoke-ApplyTasks, and Clear-StartMenu (7-stage MDM ConfigureStartPins + COM IApplicationActivationManager native start2.bin compiler) to isolated background Runspaces.
  • Expanded Gaming & Office Service Profiles (51 Targets): Added SRUM disk-logging elimination (DPS, WdiServiceHost, WdiSystemHost), NTFS Distributed Link Tracking (TrkWks), File History (fhsvc), Windows Insider (wisvc), Mobile/NFC bloat (WalletService, SEMgrSvc, autotimesvc, tzautoupdate), and legacy multicast discovery (SSDPSRV, upnphost, lmhosts).
  • Hardened Ghost Service & Driver Scanner: Filtered out per-user service templates (SERVICE_USER_SERVICE bitmask 0x40) to eliminate false positives (CDPUserSvc, OneSyncSvc) and normalized relative kernel root paths (SystemRoot\, \System32\).

🧰 Module Z5: Interactive Inspectors & DoH DNS Enforcer (Z5_Utilities.ps1)

  • Replaced Out-GridView with Native Dark Show-UltixGridModal: Eliminated external white PowerShell windows in favor of the unified, double-buffered WinForms ListView modal featuring DWM dark title bars, column sorting, and state-preserving live search filtering.
  • Full System Services Inspector with Locked Critical Rows (Show-ServicesGrid): Displays the complete OS service table while marking 25 critical kernel/RPC/SCM/Defender boot services in red ([CRITICAL - LOCKED] via IsLocked = $true) so they remain visible and searchable but cannot be accidentally checked or disabled. Added a secondary Restore to Manual (Demand) action and TrustedInstaller token escalation.
  • Scheduled Tasks Inspector (Show-TasksGrid): Built a high-signal Task Scheduler scanner that filters out core Windows OS noise to expose third-party updaters ([3rd-Party / Root]), Microsoft app bloat/telemetry ([MS App / Updater], [MS Telemetry / Bloat]), and orphaned tasks pointing to missing executables ([GHOST / Missing Exe]). Supports both permanent unregistration and non-destructive state toggling.
  • Deep Startup Manager (Show-StartupGrid): Expanded autorun auditing across Run, RunOnce, Policies\Explorer\Run (x64 & WOW6432Node), and Startup folders. Added binary header & UTC FILETIME decoding for StartupApproved keys, enabling non-destructive Task Manager state toggling (Enable / Disable) alongside permanent deletion.
  • Classic Control Panel Frame for Devices & Printers: Restored the full Control Panel namespace path (shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}\0\::{A8A91A66-3A7D-4424-8D24-04E180695C7A}) in Start-ClassicPrinters so the window loads with the native top command bar (Add a device / Add a printer / Print server properties).
  • Dual-Stack IPv4/IPv6 + Native Windows 11 DoH DNS Enforcer: Upgraded Set-CustomDNS to configure both IPv4 and IPv6 resolvers and inject DohFlags = 1 (QWord) directly into Dnscache\InterfaceSpecificParameters and DohWellKnownServers for automatic kernel-level DNS-over-HTTPS encryption.

🔧 Module Z6: System Integrity & First-Aid (Z6_Integrity.ps1)

  • Real Exit Code Latching (Start-ExternalConsoleAsync): Upgraded external maintenance console invocation to cmd.exe /v:on with delayed variable expansion (!WUX_ERR!), preventing pause >nul from masking command failures and formatting non-zero exit codes into both decimal and 0x{0:X8} HRESULT hex notation.
  • Real-Time DISM Progress Streaming (Get-WinSxSState): Replaced blocking StandardOutput.ReadToEnd() with a live StreamReader.ReadLine() loop that intercepts carriage-return (\r) progress frames from dism.exe /AnalyzeComponentStore and streams completion percentages directly to $UltixSync.Progress.
  • Windows Update & Cryptographic First-Aid (Repair-WindowsUpdateSubsystem): Added an asynchronous 5-stage repair worker that stops wuauserv, cryptSvc, bits, dosvc, and msiserver, purges corrupted BITS transfer queues (qmgr*.dat), flushes catroot2 and SoftwareDistribution\DataStore, re-registers 31 core cryptographic/WU COM DLLs via regsvr32.exe /s, and restarts servicing daemons.
  • WMI / CIM Repository Diagnostics & Salvage (Invoke-WMIAudit & Repair-WMIRepository): Added a live CIM health audit (winmgmt /verifyrepository + active probes against root\cimv2 and root\StandardCimv2) paired with a non-destructive winmgmt /salvagerepository and wmiadap.exe /f repair routine.
  • Shell Icon & Thumbnail Cache First-Aid (Clear-ShellIconCache): Added an asynchronous shell cache rebuilder that cleanly cycles explorer.exe to release memory-mapped file handles, purges corrupted iconcache_*.db and thumbcache_*.db databases, and invokes ie4uinit.exe -show.

⚡ Module Z7: Low-Level Hardware & Interrupt Tuning (Z7_Hardware.ps1)

  • Native kernel32.dll CPU & L3 Cache Topology Detection: Upgraded Get-CPUTopologyProfile to inspect SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX structures (RelationProcessorCore & RelationCache). Accurately isolates Intel Hybrid E-Core clusters (EfficiencyClass = 0) and asymmetric AMD Dual-CCD 3D V-Cache processors (pinning background apps to the non-V-Cache L3 CCD regardless of BIOS CCD enumeration order).
  • 3-Line Live Kernel DPC & Per-Core Distribution Monitor (NtQuerySystemInformation): Added a real-time 1Hz telemetry panel on the Hardware tab (with tab-aware auto-pause and a ? per-core log report) and inside Show-MsiModal. Queries SystemInterruptInformation (0x17) and maps logical threads (LP#) to physical CPU core masks (C0..Cn) to display Boot Baseline, Live 1s Delta (DPC/s, Core 0 Share %, Hotspot LP#), and a full Per-Core distribution bar.
  • 6-Column Sortable MSI Grid, Smart DPC Bottleneck Classifier & Core 0 Offload: Upgraded Show-MsiModal from a flat CheckedListBox to a double-buffered, 6-column sortable ListView (MSI, PCI Device Name, Driver, Priority, IRQ Mask, DPC Assessment). Automatically flags unoptimized GPU (nvlddmkm.sys/amdkmdag.sys) and Network NDIS drivers on Core 0 with ★ OFFLOAD TO C1, tags USB XHCI controllers as Optional C1, and shields multi-queue NVMe/SATA controllers (Keep Spread) from single-core pinning. Includes a Select ★ GPU/NIC quick-select button and shortened URL-safe Base64 backup subkeys (<100 chars).
  • Dynamic 2Hz Timer Resolution Readout & Live 0.5ms Test Pulse (Show-TimerModal): Added live 500ms (2Hz) polling of NtQueryTimerResolution with color-coded status feedback alongside a Test 0.5ms Lock button (NtSetTimerResolution(5000, true)) that actively requests a 0.5ms kernel tick so users can verify sub-millisecond clock transitions in real time (auto-releasing when the modal closes).
  • Asynchronous & Symmetrically Reversible Network Optimizer: Moved NDIS/TCP modification and adapter re-initialization (Restart-NetAdapter + 2s settle delay) into an isolated background Runspace ($UltixSync), eliminated *EEE wildcard collisions via exact -eq filtering, and implemented HKLM:\SOFTWARE\WinUltix\Network_Backup for 100% symmetric rollback.
  • Accurate AC Hex Parser & Self-Healing CPPC Engine: Fixed powercfg.exe /qh parsing to read the Current AC Power Setting Index ($hexLines[-2]) instead of Minimum Possible Setting ($hexLines[0]), and added automatic self-healing if a previous backup key contained zeroed values.
  • Hardware Profile Snapshot Hooks & Dark Pre-Flight Macro: Added Export-UltixHardwareSnapshot and Import-UltixHardwareSnapshot for JSON profiles, and injected DWM dark title bar support, High-DPI GDI scaling, and live ENGAGED [ARMED] / RELEASED [STANDBY] status detection into the generated PreFlight.ps1 desktop shortcut.
Assets 4
Loading