WinUltix v3.14 — The "Zero-WMI" Engineering, Real-Time ETW & Performance Release

WinUltix v3.14 (formerly WinUltix Pro) is a major architectural hardening release focused on 100% Zero-WMI native execution, real-time Kernel ETW per-driver ISR/DPC profiling, sub-millisecond .NET / P/Invoke hardware and registry scanning, 100% locale-independent & 7-bit ASCII-pure operation, expanded 64-tool coverage, and full asynchronous Runspace responsiveness.

---

🚀 Highlights & New Capabilities

• Real-Time Kernel ETW Per-Driver (.sys) ISR & DPC Profiler (Hardware Tab):
  • Built-in lock-free native C# profiler ([WinUltix.DpcDriverProfiler]) inside the MSI & IRQ Affinity Enforcer that opens a private real-time EVENT_TRACE_SYSTEM_LOGGER_MODE kernel trace (EVENT_TRACE_FLAG_DPC | EVENT_TRACE_FLAG_INTERRUPT) using raw QPC timestamps.
  • Maps kernel routine instruction pointers (RIP across ETW opcodes 50, 66, 67, 68, 69) to loaded kernel drivers (SystemModuleInformation = 11) via $O(\log N)$ binary search and zero-allocation Interlocked counters.
  • Tracks Cumulative Session Average (Avg Load µs/s), Worst Single-Call Latency Spike (Max µs), and Live 1-Second Load (1s) with a 1-click [ Reset Stats ] button, multi-mode zero-jitter sorting, dynamic via tcpip.sys / via ndis.sys stack attribution, and optional [x] Show OS Kernel .sys visibility (exposing dxgkrnl.sys, Wdf01000.sys, ntoskrnl.exe, tcpip.sys, usbport.sys, ntfs.sys, iorate.sys, and ndis.sys directly alongside PCI hardware).
• Instant <1 ms Zero-WMI System & Hardware Fingerprint Banner (Main Log):
  • Every startup and exported .txt log now prints a 4-line hardware specification header (Write-UltixSystemBanner) queried in under 1 ms without WMI:
    • [SYS] OS: Exact Windows 10/11 edition, DisplayVersion (24H2/25H2/26H2), OS Build + UBR, and BIOS motherboard model (BaseBoardProduct).
    • [CPU] PRC: CPU name, physical/logical core count, detected topology profile (Intel Hybrid P+E, AMD 8C Single-CCD, AMD Dual-CCD X3D, Standard <6C - Lasso Off), and total L3 Cache (with per-CCD domain split on asymmetric X3D CPUs).
    • [RAM] MEM: Native C# kernel32!GetSystemFirmwareTable('RSMB') SMBIOS Type 17 parser reporting total capacity, DDR generation, active memory speed (MT/s), stick layout (2x 16 GB), occupied DIMM slots (2/4 Slots), multi-vendor SPD PartNumber CAS decoding, and automatic XMP/EXPO vs. JEDEC BIOS reset warnings.
    • [GPU] GFX: Active PCI GPU discovery via CfgMgr32, true 64-bit VRAM capacity (qwMemorySize), live negotiated PCIe Bus Link Speed & Width (PCIe 4.0 x16 / PCIe 5.0 x16), and WDDM-to-NVIDIA driver version translation.
• Live UI Font Scaling ([ A- ] / [ A+ ]) & Segoe UI Semibold Typography Engine:
  • Centralized typography engine ($global:UltixTypography & Get-UltixFont) rendered in crisp Segoe UI Semibold with live [ A- ] / [ A+ ] scaling buttons in the footer (-1.0 pt to +1.5 pt safety bounds, 0.5x proportional damping on compact 2-column controls, frozen 9.75 pt footer & 9.0 pt tab headers, and automatic persistence in HKCU:\Software\WinUltix).
• [ OPTIONAL ] (OptIn) Safety Architecture & WinGet Ecosystem Shield:
  • Rules that affect everyday peripherals, accounts, or package managers—such as Microphone/Webcam access, Toast Notifications, Print Spooler, Biometrics, Bluetooth, Xbox Live, Modern Standby S0, Remote Desktop, VBS/HVCI, USB Mass Storage blackout layers, and WinGet dependencies (DoSvc, edgeupdate, edgeupdatem, MicrosoftEdgeUpdate.exe)—are tagged as [ OPTIONAL ] (unchecked by default) so a default 1-click run never breaks daily workflows.
• 5-Button Live SCM Service Controller (System Services Manager):
  • Upgraded Show-ServicesGrid with 5 dedicated live action buttons (Start, Stop, Set Automatic, Set Manual, Set Disabled) backed by native advapi32!ChangeServiceConfigW / ControlService P/Invoke (SetServiceConfigLive / StopServiceLive with SYSTEM token impersonation). Clicking Start on a Disabled (Start=4) service automatically unlocks it to Manual (3) in both the registry and live SCM memory before starting.
• 2 New System First-Aid Tools (Integrity Tab):
  • Repair Time & NTP Clock Sync (w32time): Unlocks and re-registers W32Time, configures resilient pool.ntp.org / time.cloudflare.com peers, and forces an immediate clock resync to fix broken TLS, DoH, and Xbox Live authentication.
  • Repair UWP, Store, WinGet & Xbox Gaming Services: Automatically unlocks and starts AppXSvc, ClipSVC, StateRepository, InstallService, dosvc, and GamingServices, flushes WindowsStore cache (wsreset.exe -i), and re-registers existing Shell, Store, WinGet (DesktopAppInstaller), and Xbox AppxManifest.xml files without reinstalling removed bloatware.
• Live 1:1 Raw Mouse Input Reload (SPI_SETMOUSE): Zeroing out mouse acceleration curves in Tweaks now invokes user32!SystemParametersInfoW (SPI_SETMOUSE | SPIF_SENDCHANGE) to reload win32kfull.sys pointer tables instantly in real time without logging out.
• Expanded Service Profiles (12 Office / 60 Gaming) & Per-User Template Lockdown: Added GameInputSvc, dmwappushservice, InventorySvc, wercplsupport, pla, SCardSvr, and 5 Per-User background service templates (CDPUserSvc, OneSyncSvc, PimIndexMaintenanceSvc, UnistoreSvc, UserDataSvc) with automatic UserServiceFlags = 0 locking and live _LUID session termination.
• WPD / MTP Smartphone Protection in USB Perimeter Guard: Extended WriteProtect and TotalBlock layers to symmetrically enforce and revert Deny_Write / Deny_Read policies across both USB Mass Storage drives and MTP smartphones/portable devices.
• 8 Classic Win32 Admin Applets: Added direct 1-click launchers for Group Policy / RegEdit (gpedit.msc with automatic regedit.exe fallback on Home SKUs) and Computer Management (compmgmt.msc).

---

🧠 Core Engine & Main Launcher (Core_Helpers.ps1 & WinUltix.ps1)

• Single-Pass C# P/Invoke Consolidation & Pre-Compiled Host PE Fast-Path: Merged [WinUltix.UsbProberV2], [WinUltix.HubProbeResult], [WinUltix.SmbiosRamInfo], [WinUltix.DpcDriverProfiler], [WinUltix.DarkTabControl], and [WinUltix.DarkProgressBar] into Core_Helpers.ps1 with instant <0.3 ms Assembly::LoadFrom loading and high-resolution 256x256 bicubic splash screen rendering when launched via WinUltix.exe.
• Zero-WMI Native kernel32 & cfgmgr32 Queries: Added [WinUltix.NativeMethods]::GetTotalPhysicalMemoryKB() (GlobalMemoryStatusEx), [WinUltix.NativeMethods]::GetProcessExecutablePath(int pid) (OpenProcess + QueryFullProcessImageNameW), [WinUltix.NativeMethods]::IsVolumeDirty(string drive) (DeviceIoControl FSCTL_IS_VOLUME_DIRTY), [WinUltix.PnpTree]::IsDeviceDisabled(string instanceId) (CM_Get_DevNode_Status), and [WinUltix.PnpTree]::GetPcieLinkInfo(string instanceId) (CM_Get_DevNode_PropertyW DEVPKEY_PciDevice_*).
• 100% Locale-Independent Canonical INF Resolver & Ownership Helpers: Upgraded Format-UltixDeviceName to translate @driver.inf,%token%; prefixes into canonical English hardware names across all OS languages. Replaced localized takeown.exe /D Y calls with SID-based Grant-UltixDirectoryAdminAccess (icacls.exe *S-1-5-32-544) and added Unlock-UltixTrustedInstaller.
• Zero-WMI Multi-Profile Discovery (Get-UltixUserProfiles): Replaced Win32_UserProfile CIM enumeration with direct HKLM\...\ProfileList registry traversal (S-1-5-21-*) and live HKEY_USERS\<SID> hive detection with a pure Zero-WMI HKCU: fallback.
• Asynchronous & Full-Fidelity JSON Profile Engine: Moved Export-WinUltixProfile and Import-WinUltixProfile into background Runspaces (Invoke-AsyncTask) with re-entrancy progress preservation and thread-safe UI shims. Profiles preserve exact numerical Win32PrioritySeparation quantum values alongside Office (Light) services, 7-Point Power & Display settings, and 4-Layer USB Security Guard locks.

🧹 Deep Hygiene & Orphan Sweepers (Z1_Cleanup.ps1)

• Native .NET Registry Traversal (DriverStore, MSI/MSP, & Ghost Services): Replaced slow PowerShell provider loops across HKLM\SYSTEM\CurrentControlSet\Enum, Control\Class, Services, and Installer\UserData with direct [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey() calls and deterministic handle disposal, cutting scan times by up to 5x.
• Interactive JSON Backup & Restore in Registry Orphan Sweeper (Show-RegistryOrphanSweeper): Added SaveFileDialog and OpenFileDialog prompts so users can choose custom save and restore locations for registry orphan .json backups while maintaining an automatic emergency shadow copy in %LOCALAPPDATA%\WinUltix\RegOrphans_LastBackup.json.
• Zero-WMI Kernel Driver Enumeration & System32 Shield (Get-GhostServicesState): Replaced Win32_SystemDriver CIM queries with native [System.ServiceProcess.ServiceController]::GetDevices(), added OpenSubKey($svcName, $true) write-access filtering, shielded inbox System32/SysWOW64 OS binaries, and verified mounted volumes (DriveInfo.IsReady) so services on unplugged external drives are never flagged as ghosts.
• Locale-Hardened pnputil & App Paths Parsers: Hardened Get-DriverStoreOrphans_Worker to parse all regional date formats (MM/dd/yyyy, dd.MM.yyyy, yyyy-MM-dd) and upgraded Get-RegistryOrphans_Worker (App Paths) to strip quotes and CLI switches before verifying disk binaries.
• Smart Temp Deduplication, Modern Browser/GPU Cache Grouping & Clean TiWorker Release: Eliminated duplicate scanning of $env:TEMP, consolidated multi-folder Chromium (Network\Cache, Service Worker\CacheStorage) and NVIDIA PerDriverVersion\DXCache shader paths while hiding uninstalled apps, and released Logs\CBS locks by stopping TiWorker.exe.

🗑️ Debloat & Package Engine (Z2_Bloatware.ps1)

• Single-Pass DISM Deprovisioning (Invoke-RemoveBloatware): Eliminated repeated Get-AppxProvisionedPackage -Online calls inside the removal loop by caching online provisioned package names in an O(1) case-insensitive HashSet prior to execution.
• Unified Protected Package Shield (Get-UltixProtectedAppxRegex): Centralized the critical shell, gaming, WinGet (DesktopAppInstaller), runtime, and media codec whitelist across Get-BloatwareState, Get-GarbageCollectorState, Show-AppxGrid, and Show-AppxProvGrid, and marked Windows Photos, Windows Camera, and Xbox apps as [ OPTIONAL ].
• OEM vs. Inbox NIC Driver Verification for FODs (Get-UltixInboxNicFodStatus): Expanded the FOD preset to 16 targets (adding XPS.Viewer, Ethernet.Client, and Wifi.Client). WinUltix now inspects active physical network adapters in <1 ms—automatically locking Ethernet.Client / Wifi.Client in both the preset and Show-CapsGrid if an active adapter relies on a Microsoft inbox driver, while allowing removal when vendor oemXX.inf drivers are active.
• Symmetric Enable / Disable in Optional Features (DISM) (Show-OptFeaturesGrid): Added an Enable Selected Features secondary action button alongside Disable Selected Features and locked core .NET Framework 4.8 (NetFx4-AdvSrvs) rows in red ([CRITICAL - LOCKED]).
• Hardened Multi-Profile & Per-Machine OneDrive Amputation (Get-OneDriveState / Invoke-RemoveOneDrive): Added detection and removal of per-machine installations (Program Files\Microsoft OneDrive), *OneDrive* scheduled tasks, and Explorer\Desktop\NameSpace CLSIDs across all loaded HKEY_USERS\<SID> hives.

⚡ Tweaks, Shell & Security Engine (Z3_Registry.ps1 & Z5_Utilities.ps1)

• Symmetric Start Menu Backup & Restore (start2_backup.bin): Clear-StartMenu now automatically backs up your original start2.bin layout database to %LOCALAPPDATA%\WinUltix\start2_backup.bin before compiling the 3-icon Start Menu and supports full 1-click restoration via Revert Selected.
• 100% Asynchronous Registry, SRP+IFEO & Policy Pipeline: Migrated Invoke-ApplyRegistry, Invoke-ApplySRP, Invoke-StartMenuAudit, and all Z3/Z5 policy workflows into background Runspaces (Invoke-UltixAuditFlow + Invoke-AsyncTask) with full tab control locking (-ControlsToDisable) and deterministic post-execution shell broadcasts (Update-ShellEnvironment).
• Zero-WMI Dynamic SvcHost RAM Threshold (Get-RegState_SystemBoot): Replaced Win32_ComputerSystem CIM queries with native [WinUltix.NativeMethods]::GetTotalPhysicalMemoryKB() (kernel32!GlobalMemoryStatusEx) to compute SvcHostSplitThresholdInKB in <0.1 ms.
• Quantum Scheduler Preset Protection (Get-RegState_Gaming & Invoke-ApplyRegistry): Expanded Win32PrioritySeparation validation (ValidValues = @(38, 40, 42, 22, 24)) and added a pre-write guard in Invoke-ApplyRegistry so applying the Extreme Gaming profile never overwrites a custom Quantum Scheduler matrix preset selected in Z7.
• Zero-WMI .NET DNS & Native DoH Enforcer: Replaced slow Get-NetRoute, Get-NetAdapter, and external netsh.exe calls in Set-CustomDNS with <2 ms native [System.Net.NetworkInformation.NetworkInterface] gateway enumeration and direct Tcpip6 registry cleanup.
• SRP + IFEO Custom Target Safety & Cleanup Symmetry: Added a critical OS binary guard to the custom target selector (+) to prevent accidental shell/kernel self-lockout, and upgraded the custom target purge (-) to automatically unlock active Safer and IFEO kernel filters before clearing HKLM:\SOFTWARE\WinUltix\SRP.

⚙️ Services, Scheduled Tasks & Startup Engine (Z4_Services.ps1)

• Native Win32 Registry Service Auditor (Invoke-ServicesAudit): Consolidated Get-ServicesState_Light and Get-ServicesState_Heavy into a single native [Microsoft.Win32.Registry] reader over one open HKLM\SYSTEM\CurrentControlSet\Services handle, cutting service profile audit times from ~120 ms to <1 ms.
• 8-Branch Telemetry Scheduled Tasks Lockdown: Expanded Get-TelemetryTasksState to disable \Microsoft\Windows\Application Experience\* (CompatTelRunner.exe), \Microsoft\Windows\Autochk\*, and \Microsoft\Windows\DiskDiagnostic\* alongside CEIP, Feedback, PerformanceTrace, WER, and XblGameSave.
• Scheduled Tasks [GHOST] Detection & TaskCache DACL Filtering (Get-ScheduledTasks_Worker & Test-UltixTaskAdminWritable): Added task WorkingDirectory and $env:PATH resolution, shielded unplugged removable drives, excluded internal OS servicing folders, and added binary TaskCache\Tree RawSecurityDescriptor DACL parsing (Test-UltixTaskAdminWritable) to hide tasks locked exclusively by TrustedInstaller.
• Multi-Profile Deep Startup Manager: Upgraded Get-StartupState_Worker with in-memory StartupApproved binary caching and multi-profile HKEY_USERS enumeration.

🚑 System Integrity & First-Aid Module (Z6_Integrity.ps1)

• Native P/Invoke FSCTL_IS_VOLUME_DIRTY Auditor (Invoke-SystemHealthAudit): Replaced Win32_LogicalDisk CIM and external CLI parsers with 100% locale-independent kernel32!DeviceIoControl (FSCTL_IS_VOLUME_DIRTY) volume health checks.
• Single-Pass Batch COM DLL Re-Registration (Repair-WindowsUpdateSubsystem): Consolidated 21 active Cryptographic, WinTrust, and Windows Update COM libraries into a single regsvr32.exe /s batch process—cutting Stage 4 execution time to <150 ms.
• Service Auto-Heal & Strict Handle Disposal: Added automatic Start = 4 (Disabled) recovery via Set-ProtectedServiceStart inside Repair-PrintSubsystem, Repair-WindowsUpdateSubsystem, Repair-UwpGamingRuntime, and Unlock-UltixTrustedInstaller.

🔧 Hardware & Diagnostics Cockpit (Z7_Hardware.ps1)

• Zero-WMI Affinity Lasso & Deterministic Handle Disposal: Replaced Win32_Process CIM queries in Get-HardwareState_Affinity with native kernel32!QueryFullProcessImageNameW ([WinUltix.NativeMethods]::GetProcessExecutablePath), cutting Affinity Lasso load and refresh times to <15 ms.
• Universal .NET PCI IRQ Scanner, ImagePath .sys Resolver & 1280px ETW Cockpit: Rebuilt Get-HardwareState_IRQ around direct [Microsoft.Win32.Registry]::LocalMachine traversal, cfgmgr32!CM_Get_DevNode_Status active-node filtering (<5 ms), ClassGUID hardware classification, C0..Cn physical core mask labeling, and automatic kernel binary resolution via Services\<Service>\ImagePath.
• USB XHCI Wireless Dongle Deduplication & Contention Filtering (Get-UsbTopologyMap): Collapsed virtual pairing slots created by composite 2.4GHz receivers into a single physical USB port entry, classified composite mouse/keyboard receivers as [MOUSE / HID], isolated BTHUSB Bluetooth adapters from virtual BTHENUM audio nodes, and separated USB 2.0 SD/Flash Card Readers ([CARD READER]) from bulk storage drives.
• SysMain & MMAgent Interoperability (Show-NVMeModal): Get-HardwareState_NVMe, Invoke-ApplyNVMeTweaks, and Restore OS Defaults now seamlessly handle systems where SysMain is disabled (Start = 4) by the Gaming Heavy service profile without throwing 0x80070422 errors.
• Quick Selection Controls in Network NDIS & TCP Tuner (Show-NetworkModal): Added Select All and Deselect All toolbar buttons for 1-click batch optimization or default restoration.