Skip to content

Translucent Windows v1.8.0 - #4818

Merged
m417z merged 22 commits into
ramensoftware:mainfrom
Undisputed00x:main
Jul 26, 2026
Merged

Translucent Windows v1.8.0#4818
m417z merged 22 commits into
ramensoftware:mainfrom
Undisputed00x:main

Conversation

@Undisputed00x

Copy link
Copy Markdown
Contributor

Changelog

If this pull request updates an existing mod, describe the changes below:

  • Some settings that can be considered outside the scope of translucent effects are removed due to my limited free time to maintain these features, fortunately the Windhawk community has provided some separate mods for those listed below.

  • Settings removed:

    • Border color setting - replacement: Window Border Customizer by Lockframe.
    • Titlebar color - replacement: Auto Custom Title Bar Colors by Louis047.
    • Window Corner Type - replacement: Custom Window Corner Radius by m417z.
    • Titlebar text color.
    • Rainbow effect - Very high performance overhead, e.g. 30% usage on a modern midrange GPU.
    • Extend effects into entire window - Will be enabled by default when a translucent effect is selected.
    • Immersive darkmode title bar - Will be enabled by default when the system is in dark mode.
  • Added compatibility with Windows 11 File Explorer Styler.

  • System color improvements without the need to apply the SetSysColors API - Global setting "New system colors". Related topic: [Translucent Window] Dark/black background artifacts even for excluded apps (e.g. Office) #2010

  • Processes launching from given subdirectories can be ruled/excluded as a whole in the mod settings.

  • Numerous improvements and additions to theme customization.

    • Fixed chevron arrow scaling in treeview.
    • Improved buttons pill (e.g. treeview, tabs)
    • Fixed properties window background coloring without the need to restart explorer.
    • Adjusted the size of the custom scrollbar close to the original.
    • Recolored black text in dark mode (e.g. syslinks, address bar dropdown text, context menu icons)
    • Alpha blended more UI elements (e.g. treeview separator, highlighted text accent background)
    • Removed dark gray bottom part in explorer dialogs in dark mode (e.g. Open/Save dialogs)
    • Removed Windows brand logo background in dialogs (e.g. winver.exe)
    • Improved text composition performance.

Mod authorship

If this pull request introduces a new mod, please complete the section below.

This mod was created by:

    • The submitter, without AI assistance
    • The submitter, with AI assistance
    • Claude
    • ChatGPT
    • Gemini
    • Another AI (please specify):
    • Other (please specify):

Please select the options that best apply. Your selection does not affect the acceptance criteria, but it helps reviewers understand the context of the code and provide relevant feedback.

* Some settings that can be considered outside the scope of translucent effects are removed due to my limited free time to maintain these features, and fortunately the Windhawk community has provided some separate tweaks for those listed below.
* Settings removed:
	- Border color setting - replacement: [Window Border Customizer](https://windhawk.net/mods/window-border-customizer) by [Lockframe](https://github.com/Lockframe).
	- Title bar color - replacement: [Auto Custom Title Bar Colors](https://windhawk.net/mods/auto-custom-titlebar-colors) by [Louis047](https://github.com/Louis047).
	- Window Corner Type - replacement: [Custom Window Corner Radius](https://windhawk.net/mods/custom-corner-radius) by [m417z](https://github.com/m417z).
	- Titlebar text color. 
	- Rainbow effect - Very high performance overhead, e.g. 30% usage on a modern midrange GPU.
	- Extend effects into entire window - Will be enabled by default when a translucent effect is selected.
	- Immersive darkmode title bar - Will be enabled by default when the system is in dark mode.

* Added compatibility with [Windows 11 File Explorer Styler](https://windhawk.net/mods/windows-11-file-explorer-styler).
* Big improvements of system colors without the need of applying SetSysColors - "New system color" global setting.
* Processes starting from given subdirectories can be controlled as a whole in the mod settings.
* Major improvements to system colors without the need to apply the global setting SetSysColors - "New system color".
* Processes launched from given subdirectories can be ruled as a whole inside mod's settings.

* Numerous improvements and additions to theme customization.
	- Fixed chevron arrow scaling in treeview.
	- Improved buttons pill (e.g. treeview, tabs)
	- Fixed properties window background coloring without the need to restart explorer.
	- Adjusted the size of the custom scrollbar close to the original.
	- Recolored black text in dark mode (e.g. syslinks, address bar dropdown text, context menu icons)
	- Alpha blended more UI elements (e.g. treeview separator, highlighted text accent background)
	- Removed dark gray bottom part in explorer dialogs in dark mode (e.g. Open/Save dialogs)
	- Removed Windows brand logo background in dialogs (e.g. winver.exe)
	- Improved text composition performance.
@m417z

m417z commented Jul 18, 2026

Copy link
Copy Markdown
Member

Thanks. Please fix the CI errors regarding SYMBOL_HOOK variable names, and see the review below.

Submission review

Note: This review was done by Claude, and then refined manually. Due to the amount of submissions, doing a fully manual review for each pull request is no longer feasible. Thank you for understanding.

Please address the following issues. The items in the collapsed sections are optional, so it's your call whether to address them.


1. Hooked_CNscTree_DrawDivider: the Fallback guard clauses never actually bail out. The return inside the Fallback lambda only returns from the lambda, not from the hook, so every Fallback(...) call runs the original divider draw and then falls through and also runs the custom D2D draw (L5949–L5972):

if (!IsWindow(hwndTreeView) || !IsWindowClass(hwndTreeView, L"SysTreeView32"))
    Fallback(L"Not valid TreeView window");   // calls orig, then CONTINUES

...
if (!SendMessageW(hwndTreeView, TVM_GETITEMRECT, 0, (LPARAM)&treeItemRect))
    Fallback();                                // calls orig, then CONTINUES
if (!g_d2dFactory)
    Fallback();                                // calls orig, then CONTINUES
if (!g_themeCache.navigationdivider[0])
    if (!g_themeCache.CacheNavigationDivider(hdc))
        Fallback();                            // calls orig, then CONTINUES

// ...runs anyway with a possibly-invalid handle / zeroed rect / null cache
DrawNineGridStretch(hdc, g_themeCache.navigationdivider[0], &lineRc, 1, 1, 0, 0);

Consequences on the failure paths: the original is drawn and the custom divider is drawn on top (double draw); when the tree-view handle can't be resolved, TVM_GETITEMRECT is still sent to a possibly-invalid or wrong-class window; and DrawNineGridStretch is still called with a zeroed treeItemRect / a nullptr cache DC. Fix: make each guard actually return — since both the lambda and the hook are void, return Fallback(...); works:

if (!IsWindow(hwndTreeView) || !IsWindowClass(hwndTreeView, L"SysTreeView32"))
    return Fallback(L"Not valid TreeView window");
...
if (!SendMessageW(hwndTreeView, TVM_GETITEMRECT, 0, (LPARAM)&treeItemRect))
    return Fallback();
if (!g_d2dFactory)
    return Fallback();
if (!g_themeCache.navigationdivider[0] && !g_themeCache.CacheNavigationDivider(hdc))
    return Fallback();

2. HookedGetSysColorBrush indexes the brush cache out of bounds for COLOR_MENUBAR. The two caches are sized COLOR_MENUBAR (= 30, valid indices 0–29) (L230–L231), but the hook indexes them directly by nIndex with no bounds check (L1277). COLOR_MENUBAR (30) is a valid argument to GetSysColorBrush, and the mod's own HookedFillRect explicitly forwards indices up to 30 (if (pseudoSystemBrush <= 30) ... GetSysColorBrush((INT)pseudoSystemBrush), L6100–L6106), so cacheArray[30] is an out-of-bounds read/write into the adjacent global. Since these hooks are installed process-wide, this is a real (if low-frequency) corruption path. Size the arrays COLOR_MENUBAR + 1 (and/or guard nIndex):

std::array<HBRUSH, COLOR_MENUBAR + 1> g_themeCachedCustomSysColorBrushes {nullptr};
std::array<HBRUSH, COLOR_MENUBAR + 1> g_themeCachedDefaultSysColorBrushes {nullptr};

3. g_themeCache is shared across threads with no synchronization on the draw path (pre-existing, but relevant here). Each Explorer window runs on its own thread, and the DrawTheme* hooks lazily populate g_themeCache from those threads (if (!g_themeCache.x[i]) g_themeCache.CacheX(...)) with no lock. Meanwhile HookedDefWindowProcW calls g_themeCache.ClearCache() on ImmersiveColorSet (L5096) under g_ThemeChangeLock — but that lock only serializes ClearCache against itself, not against the drawing threads. A theme change concurrent with another thread mid-draw can DeleteDC/DeleteObject a cache entry that thread is still using (DrawNineGridStretch(hdc, g_themeCache.x[i], ...)), i.e. a cross-thread use-after-free, plus a benign lazy-init race (leaked DC) when two threads populate the same slot. It's a narrow window and pre-existing, but since the cache was reworked in this PR it's worth guarding — e.g. take a shared/exclusive SRWLOCK around both cache access and ClearCache, or snapshot the DC under the lock before drawing.

Optional improvements

Minor polish — none of this affects users, so it's your call.

  • Wh_ModUninit can null-deref g_d2dFactory. if (g_settings.FillBg) g_d2dFactory->Release(); (L6470–L6471) runs even if D2D1CreateFactory failed in InitDirect2D (factory stays nullptr). Guard it: if (g_d2dFactory) g_d2dFactory->Release();.

  • Duplicate dead return res; at the end of HookedExtTextOutW (L982–L984) — the second one is unreachable.

  • SetCurrentTheme has two no-op/leak lines (L1154–L1163): if (g_hThemeSysMetrics != nullptr) g_hThemeSysMetrics = nullptr; drops a live HTHEME without CloseThemeData (a leak if it were ever non-null on entry), and if (!g_hThemeSysMetrics) CloseThemeData(g_hThemeSysMetrics); calls CloseThemeData(nullptr). Both can just be removed.

  • Possible double hook-install for a ruled-program config. When a process matches a rule with ThemeBackground = TRUE and SysColors = FALSE while the system colors are already black, the g_DefaultSysColors branch in LoadWindowProcessRules installs GetSysColor/GetSysColorBrush/FillRect/User32Hooks (L6373–L6378), and then CustomRenderingHooks (run because FillBg is set) installs the same set again (L6231–L6236). That means HookSymbols(user32, ...) gets called twice for the same module (re-resolves the cache — the thing the docs warn against) plus a second SetFunctionHook on each of the three functions. Worth gating so each is installed at most once.

Functionality notes

Non-critical observations about the feature itself.

  • The ExtTextOutW/DrawTheme* compositing path does a full BeginBufferedPaint + per-pixel alpha pass on essentially every text draw in every hooked process — an inherent cost of the alpha-blended-text feature with no obvious cheaper alternative, so just noting it as an FYI rather than an action item.

Comment thread mods/translucent-windows.wh.cpp Outdated
#include <d2d1.h>
#include <wrl.h>
#include <ShellScalingApi.h>

#define RECTWIDTH(lprc) ((lprc)->right - (lprc)->left)
#define RECTHEIGHT(lprc) ((lprc)->bottom - (lprc)->top)

#define WM_CTLCOLOR 0x19

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI it's defined in windowsx.h.

@m417z

m417z commented Jul 21, 2026

Copy link
Copy Markdown
Member

Submission review

Looks good. See remaining items below.


1. HookedGetSysColorBrush reads/writes out of bounds for COLOR_SCROLLBAR (index 0). The cache is indexed cacheArray[nIndex - 1] (lines 1269, 1276), but GetSysColorBrush is legitimately called with nIndex == COLOR_SCROLLBAR, and COLOR_SCROLLBAR == 0cacheArray[-1]. That's an out-of-bounds read on the fast path and, on the slow path, an out-of-bounds write (refSysBrush = CreateSolidBrush(...)) into the global that precedes the array. It's reachable whenever the hook-based custom colors are active (the default, !SetSystemColors), and COLOR_SCROLLBAR is one of the colors you customize (it's SysColorElements[0], painted black). Since the two brush arrays and g_SysColorsLock are declared adjacently, this corrupts neighboring state.

Simplest robust fix — size the arrays to cover index 0 and drop the -1:

std::array<HBRUSH, COLOR_MENUBAR + 1> g_themeCachedCustomSysColorBrushes {nullptr};
std::array<HBRUSH, COLOR_MENUBAR + 1> g_themeCachedDefaultSysColorBrushes {nullptr};
...
HBRUSH WINAPI HookedGetSysColorBrush(INT nIndex)
{
    if (nIndex < 0 || nIndex > COLOR_MENUBAR)   // out-of-range → let the original handle it
        return GetSysColorBrush_orig(nIndex);
    auto& cacheArray = g_DefaultSysColors ? g_themeCachedDefaultSysColorBrushes : g_themeCachedCustomSysColorBrushes;
    HBRUSH cachedBrush = cacheArray[nIndex];   // no -1
    ...

2. User32Hooks can run HookSymbols(user32) twice. When a process matches a rule that disables SysColors while the global setting enables it (the "reset to default system colors" branch, lines 6385–6390), User32Hooks(FALSE) runs there, and then CustomRenderingHooks calls User32Hooks(g_settings.SetSystemColors) again (line 6240) if that process has custom rendering on. Two HookSymbols calls for the same module re-resolve/invalidate the symbol cache; the GetSysColor/GetSysColorBrush/FillRect SetFunctionHooks are also registered twice (6387–6390 and 6242–6244). Consolidate so user32 resolves once per load.

Optional improvements

Minor polish — none of this affects users, so it's your call.

  • InTaskManagerProcess() recomputes the process name on every text draw. It's called inside Hooked_SHThemeDrawText (line 5744), and each call does GetModuleFileNameW + LCMapStringEx. The process identity is invariant, so compute it once (e.g. a g_isTaskMgr global set in LoadSettings) instead of per draw.

  • InWindhawkProcess() (line 604) is defined but never called — dead code.

  • static UINT ENABLE = 1; (line 187) could be static constexpr UINT ENABLE = 1; to match the neighboring constants.

@Undisputed00x
Undisputed00x marked this pull request as draft July 21, 2026 09:26
@Undisputed00x
Undisputed00x marked this pull request as ready for review July 21, 2026 15:45
@Ice-x-Fire

Copy link
Copy Markdown
Screenshot 2026-07-21 205629

So i was testing this version, and this is the issue i came across. The properties dialog background is white.

@Undisputed00x

Copy link
Copy Markdown
Contributor Author

So i was testing this version, and this is the issue i came across. The properties dialog background is white.

Restart explorer or the system and see if the problem persists; it doesn't happen to me.

@Ice-x-Fire

Copy link
Copy Markdown

Restart explorer or the system and see if the problem persists; it doesn't happen to me.

I restarted explorer after disabling all other mods, the behaviour remains the same.
I also tried a system restart, still the same issue.
I did not have this issue on 1.7.4, but its there on 1.8.0

i am on 26200.8894 (arm64)

@Undisputed00x

Copy link
Copy Markdown
Contributor Author

Restart explorer or the system and see if the problem persists; it doesn't happen to me.

I restarted explorer after disabling all other mods, the behaviour remains the same. I also tried a system restart, still the same issue. I did not have this issue on 1.7.4, but its there on 1.8.0

i am on 26200.8894 (arm64)

Symbol hooks are being used in this version, and your problem is likely due to the ARM architecture.
Paste the mod's debug message here.

@Ice-x-Fire

Copy link
Copy Markdown

Restart explorer or the system and see if the problem persists; it doesn't happen to me.

I restarted explorer after disabling all other mods, the behaviour remains the same. I also tried a system restart, still the same issue. I did not have this issue on 1.7.4, but its there on 1.8.0
i am on 26200.8894 (arm64)

Symbol hooks are being used in this version, and your problem is likely due to the ARM architecture. Paste the mod's debug message here.

log.txt

Here you go

@m417z

m417z commented Jul 21, 2026

Copy link
Copy Markdown
Member

Here are my logs from a native Notepad:

Details

DbgViewMini v1.0.4
Listening for OutputDebugString messages...
16:57:25.173 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::LoadedMod
16:57:25.182 11896 Notepad.exe  [WH] [LoadedMod::LoadedMod]: Windows 10.0.26100 (26100.8655)
16:57:25.182 11896 Notepad.exe  [WH] [LoadedMod::LoadedMod]: Windhawk v2.0-alpha.1 ARM64
16:57:25.182 11896 Notepad.exe  [WH] [LoadedMod::LoadedMod]: Mod id: local@translucent-windows
16:57:25.182 11896 Notepad.exe  [WH] [LoadedMod::LoadedMod]: Mod version: 1.8.0
16:57:25.245 11896 Notepad.exe  [WH] [LoadedMod::LoadedMod]: Mod base address: 00007FFA53220000
16:57:25.249 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::LoadedMod
16:57:25.313 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::Initialize
16:57:25.333 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetIntSetting
16:57:25.334 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueName: RenderingMod.AccentColorControls
16:57:25.335 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueNameFormatted: RenderingMod.AccentColorControls
16:57:25.335 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: value: 1
16:57:25.335 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetIntSetting
16:57:25.335 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetIntSetting
16:57:25.336 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueName: RenderingMod.ThemeBackground
16:57:25.336 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueNameFormatted: RenderingMod.ThemeBackground
16:57:25.338 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: value: 1
16:57:25.338 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetIntSetting
16:57:25.338 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetIntSetting
16:57:25.339 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueName: RenderingMod.Syscolors
16:57:25.339 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueNameFormatted: RenderingMod.Syscolors
16:57:25.340 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: value: 0
16:57:25.340 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetIntSetting
16:57:25.340 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetStringSetting
16:57:25.340 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueName: BackgroundEffects.type
16:57:25.340 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueNameFormatted: BackgroundEffects.type
16:57:25.342 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: value: acrylicblur
16:57:25.342 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetStringSetting
16:57:25.342 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetStringSetting
16:57:25.342 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueName: BackgroundEffects.AccentBlurBehind
16:57:25.342 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueNameFormatted: BackgroundEffects.AccentBlurBehind
16:57:25.342 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: value: 3A232323
16:57:25.342 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetStringSetting
16:57:25.342 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FreeStringSetting
16:57:25.343 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FreeStringSetting
16:57:25.343 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetIntSetting
16:57:25.343 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueName: FlyoutsEffects
16:57:25.343 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: valueNameFormatted: FlyoutsEffects
16:57:25.344 11896 Notepad.exe  [WH] [LoadedMod::GetIntSetting]: value: 1
16:57:25.344 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetIntSetting
16:57:25.344 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetStringSetting
16:57:25.344 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueName: RuledPrograms[%d].target
16:57:25.345 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueNameFormatted: RuledPrograms[0].target
16:57:25.345 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: value: mspaint.exe
16:57:25.345 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetStringSetting
16:57:25.345 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FreeStringSetting
16:57:25.347 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FreeStringSetting
16:57:25.347 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::GetStringSetting
16:57:25.347 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueName: RuledPrograms[%d].target
16:57:25.347 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: valueNameFormatted: RuledPrograms[1].target
16:57:25.348 11896 Notepad.exe  [WH] [LoadedMod::GetStringSetting]: value: 
16:57:25.348 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::GetStringSetting
16:57:25.348 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FreeStringSetting
16:57:25.348 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FreeStringSetting
16:57:25.350 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::HookSymbols
16:57:25.350 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Module: 00007FFA57710000
16:57:25.350 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Path: C:\Windows\SYSTEM32\dui70.dll
16:57:25.350 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Version: 10.0.26100.8521
16:57:25.352 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from local cache
16:57:25.354 11896 Notepad.exe  [WH] [LoadedMod::HookSymbolsGetOnlineCache]: Skipping online symbol cache
16:57:25.354 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from online cache
16:57:25.355 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindFirstSymbol4
16:57:25.355 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Module: 00007FFA57710000
16:57:25.355 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Path: C:\Windows\SYSTEM32\dui70.dll
16:57:25.355 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Version: 10.0.26100.8521
16:57:25.363 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  BYINDEX: 0x1          C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols*https://msdl.microsoft.com/download/symbols          DUI70.pdb          CD88075F7287D68C66E7954B532EDB541
16:57:25.365 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\DUI70.pdb - path not found
16:57:25.365 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\DUI70.pd_ - path not found
16:57:25.366 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\file.ptr - path not found
16:57:25.393 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/index2.txt
16:57:25.595 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C0194
16:57:25.595 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/DUI70.pdb/CD88075F7287D68C66E7954B532EDB541/DUI70.pdb
16:57:25.895 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C00C8
16:57:25.895 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\DUI70.pdb - path not found
16:57:25.896 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\DUI70.pd_ - path not found
16:57:25.896 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\file.ptr - path not found
16:57:25.897 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  DUI70.pdb from https://msdl.microsoft.com/download/symbols: 3862528 bytes -
16:57:25.898 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:25.899 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:26.177 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: copied
16:57:26.187 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  PATH: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\DUI70.pdb
16:57:26.188 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  RESULT: 0x00000000
16:57:26.189 11896 Notepad.exe  [WH] [`anonymous-namespace'::DiaLoadCallback::NotifyOpenPDB]: Opened pdb file C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\DUI70.pdb\CD88075F7287D68C66E7954B532EDB541\DUI70.pdb: success (00000000)
16:57:26.193 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindFirstSymbol4
16:57:26.255 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFA57745590: public: void __cdecl DirectUI::Element::PaintBackground(struct HDC__ *,class DirectUI::Value *,struct tagRECT const &,struct tagRECT const &,struct tagRECT const &,struct tagRECT const &)
16:57:26.255 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::ApplyPendingHooks]: Applying hooks
16:57:26.255 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:26.258 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFA57745590
16:57:26.261 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53223690
16:57:26.263 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:26.266 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindCloseSymbol
16:57:26.268 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindCloseSymbol
16:57:26.268 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::HookSymbols
16:57:26.269 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:26.269 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC734F6D0
16:57:26.269 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53235EB0
16:57:26.271 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:26.272 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:26.272 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55F280
16:57:26.272 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53223C28
16:57:26.272 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:26.272 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:26.273 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55B770
16:57:26.274 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532305B8
16:57:26.274 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:26.275 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:26.275 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55BBE0
16:57:26.275 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532318A8
16:57:26.277 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:26.277 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:26.277 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD586680
16:57:26.278 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53232610
16:57:26.279 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:26.282 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::HookSymbols
16:57:26.282 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Module: 00007FFA826E0000
16:57:26.283 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Path: C:\Windows\SYSTEM32\ExplorerFrame.dll
16:57:26.283 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Version: 10.0.26100.8655
16:57:26.300 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from local cache
16:57:26.301 11896 Notepad.exe  [WH] [LoadedMod::HookSymbolsGetOnlineCache]: Skipping online symbol cache
16:57:26.302 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from online cache
16:57:26.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindFirstSymbol4
16:57:26.306 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Module: 00007FFA826E0000
16:57:26.306 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Path: C:\Windows\SYSTEM32\ExplorerFrame.dll
16:57:26.307 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Version: 10.0.26100.8655
16:57:26.312 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  BYINDEX: 0x1          C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols*https://msdl.microsoft.com/download/symbols          ExplorerFrame.pdb          C564E98E7D41579EA01DD03ECF7DD1DF1
16:57:26.313 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\ExplorerFrame.pdb - path not found
16:57:26.313 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\ExplorerFrame.pd_ - path not found
16:57:26.314 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\file.ptr - path not found
16:57:26.314 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/index2.txt
16:57:26.329 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C0194
16:57:26.330 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/ExplorerFrame.pdb/C564E98E7D41579EA01DD03ECF7DD1DF1/ExplorerFrame.pdb
16:57:26.621 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C00C8
16:57:26.621 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\ExplorerFrame.pdb - path not found
16:57:26.621 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\ExplorerFrame.pd_ - path not found
16:57:26.622 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\file.ptr - path not found
16:57:26.624 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  ExplorerFrame.pdb from https://msdl.microsoft.com/download/symbols: 9457664 bytes -
16:57:26.624 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:26.625 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:27.027 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: copied
16:57:27.037 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  PATH: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\ExplorerFrame.pdb
16:57:27.041 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  RESULT: 0x00000000
16:57:27.043 11896 Notepad.exe  [WH] [`anonymous-namespace'::DiaLoadCallback::NotifyOpenPDB]: Opened pdb file C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\ExplorerFrame.pdb\C564E98E7D41579EA01DD03ECF7DD1DF1\ExplorerFrame.pdb: success (00000000)
16:57:27.046 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindFirstSymbol4
16:57:27.274 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFA8270F188: private: void __cdecl CNscTree::DrawDivider(struct HDC__ *,struct _TREEITEM *)
16:57:27.274 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::ApplyPendingHooks]: Applying hooks
16:57:27.275 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:27.275 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFA8270F188
16:57:27.275 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532350CC
16:57:27.275 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:27.276 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindCloseSymbol
16:57:27.278 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindCloseSymbol
16:57:27.279 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::HookSymbols
16:57:27.279 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::HookSymbols
16:57:27.280 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Module: 00007FFAACEF0000
16:57:27.280 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Path: C:\Windows\WinSxS\arm64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.8521_none_3e08b6bae33404f7\COMCTL32.dll
16:57:27.280 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Version: 6.10.26100.8521
16:57:27.296 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from local cache
16:57:27.297 11896 Notepad.exe  [WH] [LoadedMod::HookSymbolsGetOnlineCache]: Skipping online symbol cache
16:57:27.298 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from online cache
16:57:27.298 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindFirstSymbol4
16:57:27.298 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Module: 00007FFAACEF0000
16:57:27.298 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Path: C:\Windows\WinSxS\arm64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.26100.8521_none_3e08b6bae33404f7\COMCTL32.dll
16:57:27.299 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Version: 6.10.26100.8521
16:57:27.302 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  BYINDEX: 0x1          C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols*https://msdl.microsoft.com/download/symbols          comctl32.pdb          15CF63DDD6BF5A7338A92FFF1416D0EA1
16:57:27.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\comctl32.pdb - path not found
16:57:27.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\comctl32.pd_ - path not found
16:57:27.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\file.ptr - path not found
16:57:27.304 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/index2.txt
16:57:27.314 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C0194
16:57:27.314 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/comctl32.pdb/15CF63DDD6BF5A7338A92FFF1416D0EA1/comctl32.pdb
16:57:27.572 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C00C8
16:57:27.573 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\comctl32.pdb - path not found
16:57:27.573 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\comctl32.pd_ - path not found
16:57:27.573 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\file.ptr - path not found
16:57:27.575 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  comctl32.pdb from https://msdl.microsoft.com/download/symbols: 4042752 bytes -
16:57:27.576 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:27.577 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:27.870 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: copied
16:57:27.879 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  PATH: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\comctl32.pdb
16:57:27.880 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  RESULT: 0x00000000
16:57:27.880 11896 Notepad.exe  [WH] [`anonymous-namespace'::DiaLoadCallback::NotifyOpenPDB]: Opened pdb file C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\comctl32.pdb\15CF63DDD6BF5A7338A92FFF1416D0EA1\comctl32.pdb: success (00000000)
16:57:27.885 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindFirstSymbol4
16:57:27.967 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFAACF9DBF0: void __cdecl ComboEx_OnDrawItem(struct COMBOEX *,struct tagDRAWITEMSTRUCT *)
16:57:27.981 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFAAD0A3D68: SHThemeDrawText
16:57:28.034 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]: Unresolved symbol
16:57:28.035 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]:     SHThemeFillTextRect
16:57:28.035 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]: Unresolved symbol
16:57:28.036 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]:     FillRectClr
16:57:28.036 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]: Unresolved symbol
16:57:28.037 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]:     struct HBRUSH__ * __cdecl ListBox_GetBrush(struct tagLBIV *,struct HBRUSH__ * *)
16:57:28.037 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindCloseSymbol
16:57:28.040 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindCloseSymbol
16:57:28.043 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::HookSymbols
16:57:28.043 11896 Notepad.exe  [WH] [local@translucent-windows] [5881:Comctl32Hooks]: Failed to hook one or more symbol functions in comctl32.dll
16:57:28.044 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::HookSymbols
16:57:28.044 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Module: 00007FFA98770000
16:57:28.045 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Path: C:\Windows\SYSTEM32\winbrand.dll
16:57:28.045 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Version: 10.0.26100.8521
16:57:28.057 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from local cache
16:57:28.058 11896 Notepad.exe  [WH] [LoadedMod::HookSymbolsGetOnlineCache]: Skipping online symbol cache
16:57:28.058 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from online cache
16:57:28.058 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindFirstSymbol4
16:57:28.059 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Module: 00007FFA98770000
16:57:28.059 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Path: C:\Windows\SYSTEM32\winbrand.dll
16:57:28.059 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Version: 10.0.26100.8521
16:57:28.062 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  BYINDEX: 0x1          C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols*https://msdl.microsoft.com/download/symbols          winbrand.pdb          06369EE18E31A33BED7BDAFB00044F6B1
16:57:28.062 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\winbrand.pdb - path not found
16:57:28.063 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\winbrand.pd_ - path not found
16:57:28.063 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\file.ptr - path not found
16:57:28.064 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/index2.txt
16:57:28.073 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C0194
16:57:28.074 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/winbrand.pdb/06369EE18E31A33BED7BDAFB00044F6B1/winbrand.pdb
16:57:28.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C00C8
16:57:28.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\winbrand.pdb - path not found
16:57:28.303 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\winbrand.pd_ - path not found
16:57:28.304 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\file.ptr - path not found
16:57:28.305 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  winbrand.pdb from https://msdl.microsoft.com/download/symbols: 479232 bytes -
16:57:28.306 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:28.306 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:28.438 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: copied
16:57:28.451 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  PATH: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\winbrand.pdb
16:57:28.452 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  RESULT: 0x00000000
16:57:28.452 11896 Notepad.exe  [WH] [`anonymous-namespace'::DiaLoadCallback::NotifyOpenPDB]: Opened pdb file C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\winbrand.pdb\06369EE18E31A33BED7BDAFB00044F6B1\winbrand.pdb: success (00000000)
16:57:28.453 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindFirstSymbol4
16:57:28.456 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFA9877EF80: BrandingLoadImage
16:57:28.457 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::ApplyPendingHooks]: Applying hooks
16:57:28.457 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:28.457 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFA9877EF80
16:57:28.458 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532355F4
16:57:28.458 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:28.459 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindCloseSymbol
16:57:28.461 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindCloseSymbol
16:57:28.467 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::HookSymbols
16:57:28.470 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::HookSymbols
16:57:28.477 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Module: 00007FFAC4B90000
16:57:28.479 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Path: C:\Windows\System32\USER32.dll
16:57:28.479 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Version: 10.0.26100.8521
16:57:28.491 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from local cache
16:57:28.491 11896 Notepad.exe  [WH] [LoadedMod::HookSymbolsGetOnlineCache]: Skipping online symbol cache
16:57:28.494 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from online cache
16:57:28.494 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindFirstSymbol4
16:57:28.495 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Module: 00007FFAC4B90000
16:57:28.495 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Path: C:\Windows\System32\USER32.dll
16:57:28.495 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Version: 10.0.26100.8521
16:57:28.498 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  BYINDEX: 0x1          C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols*https://msdl.microsoft.com/download/symbols          user32.pdb          516397E53AD71143232902644C20D2721
16:57:28.499 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\user32.pdb - path not found
16:57:28.500 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\user32.pd_ - path not found
16:57:28.500 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\file.ptr - path not found
16:57:28.500 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/index2.txt
16:57:28.522 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C0194
16:57:28.522 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/user32.pdb/516397E53AD71143232902644C20D2721/user32.pdb
16:57:28.801 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C00C8
16:57:28.801 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\user32.pdb - path not found
16:57:28.801 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\user32.pd_ - path not found
16:57:28.802 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\file.ptr - path not found
16:57:28.803 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  user32.pdb from https://msdl.microsoft.com/download/symbols: 2052096 bytes -
16:57:28.805 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:28.806 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:29.033 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: copied
16:57:29.047 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  PATH: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\user32.pdb
16:57:29.048 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  RESULT: 0x00000000
16:57:29.049 11896 Notepad.exe  [WH] [`anonymous-namespace'::DiaLoadCallback::NotifyOpenPDB]: Opened pdb file C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\user32.pdb\516397E53AD71143232902644C20D2721\user32.pdb: success (00000000)
16:57:29.052 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindFirstSymbol4
16:57:29.062 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFAC4B9C1C0: __int64 __cdecl RealDefWindowProcWorker(struct tagWND *,unsigned int,unsigned __int64,__int64,unsigned long)
16:57:29.063 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFAC4C154E0: void __cdecl RenderTooltip(struct HWND__ *,struct HDC__ *,struct TooltipInfo *)
16:57:29.063 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFAC4BAB980: __int64 __cdecl MB_DlgProc(struct HWND__ *,unsigned int,unsigned __int64,__int64)
16:57:29.081 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFAC4C013A8: void __cdecl DrawCommandRectangle(struct HWND__ *)
16:57:29.081 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::ApplyPendingHooks]: Applying hooks
16:57:29.082 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.082 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4B9C1C0
16:57:29.082 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53233EE0
16:57:29.082 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.082 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.083 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4C154E0
16:57:29.083 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA5323411C
16:57:29.083 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.083 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.084 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4BAB980
16:57:29.084 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53233FC0
16:57:29.084 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.084 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.085 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4C013A8
16:57:29.085 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53233FEC
16:57:29.085 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.086 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindCloseSymbol
16:57:29.087 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindCloseSymbol
16:57:29.087 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::HookSymbols
16:57:29.088 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.088 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4BC91F0
16:57:29.088 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53235784
16:57:29.088 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.088 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.089 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4BC2380
16:57:29.089 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532238E0
16:57:29.089 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.089 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.090 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4BAE270
16:57:29.090 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53223AD4
16:57:29.090 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.090 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.091 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD540010
16:57:29.091 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53222FF0
16:57:29.091 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.091 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.092 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC4BA42C0
16:57:29.092 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53223118
16:57:29.093 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.093 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.094 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC3A56450
16:57:29.094 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53222A2C
16:57:29.094 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.095 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.095 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55C420
16:57:29.096 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532235D4
16:57:29.096 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.096 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.096 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55C620
16:57:29.097 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532233FC
16:57:29.097 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.097 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::HookSymbols
16:57:29.097 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Module: 00007FFABD530000
16:57:29.098 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Path: C:\Windows\SYSTEM32\UxTheme.dll
16:57:29.099 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::CalculateHookSymbolsInitialParams]: Version: 10.0.26100.8521
16:57:29.113 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from local cache
16:57:29.115 11896 Notepad.exe  [WH] [LoadedMod::HookSymbolsGetOnlineCache]: Skipping online symbol cache
16:57:29.115 11896 Notepad.exe  [WH] [LoadedMod::HookSymbols]: Couldn't resolve all symbols from online cache
16:57:29.115 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindFirstSymbol4
16:57:29.115 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Module: 00007FFABD530000
16:57:29.116 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Path: C:\Windows\SYSTEM32\UxTheme.dll
16:57:29.116 11896 Notepad.exe  [WH] [LoadedMod::FindFirstSymbol4]: Version: 10.0.26100.8521
16:57:29.121 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  BYINDEX: 0x1          C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols*https://msdl.microsoft.com/download/symbols          uxtheme.pdb          8C938ADEFE872134D251D6F4EF6817DE1
16:57:29.122 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\uxtheme.pdb - path not found
16:57:29.123 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\uxtheme.pd_ - path not found
16:57:29.123 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\file.ptr - path not found
16:57:29.124 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/index2.txt
16:57:29.173 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C0194
16:57:29.174 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HTTPGET: /download/symbols/uxtheme.pdb/8C938ADEFE872134D251D6F4EF6817DE1/uxtheme.pdb
16:57:29.460 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  HttpQueryInfo: 800C00C8
16:57:29.468 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\uxtheme.pdb - path not found
16:57:29.475 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\uxtheme.pd_ - path not found
16:57:29.487 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  UNC: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\file.ptr - path not found
16:57:29.495 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  uxtheme.pdb from https://msdl.microsoft.com/download/symbols: 1626112 bytes -
16:57:29.499 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:29.502 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: 0 percent
16:57:29.644 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: copied
16:57:29.696 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  PATH: C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\uxtheme.pdb
16:57:29.697 11896 Notepad.exe  [WH] [`anonymous-namespace'::LogSymbolServerEvent]: SYMSRV:  RESULT: 0x00000000
16:57:29.707 11896 Notepad.exe  [WH] [`anonymous-namespace'::DiaLoadCallback::NotifyOpenPDB]: Opened pdb file C:\Users\Island\Downloads\Windhawk-2.0-alpha.1\AppData\Engine\Symbols\uxtheme.pdb\8C938ADEFE872134D251D6F4EF6817DE1\uxtheme.pdb: success (00000000)
16:57:29.724 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindFirstSymbol4
16:57:29.785 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFABD55A4E0: protected: static __int64 __cdecl CThemeMenu::MenuKeyboardMsgProc(int,unsigned __int64,__int64)
16:57:29.796 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::OnSymbolResolved]: To be hooked 00007FFABD54F770: long __cdecl _GetBrushesForPart(void *,int,int,struct HBITMAP__ * *,struct HBRUSH__ * *)
16:57:29.799 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]: Unresolved symbol
16:57:29.799 11896 Notepad.exe  [WH] [`anonymous-namespace'::HookSymbolsSession::MarkUnresolvedSymbolsAsMissing::<lambda_1>::operator ()]:     void __cdecl _BorderRect(struct HDC__ *,unsigned long,struct tagRECT const *,int,int)
16:57:29.800 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FindCloseSymbol
16:57:29.801 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FindCloseSymbol
16:57:29.803 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::HookSymbols
16:57:29.803 11896 Notepad.exe  [WH] [local@translucent-windows] [5309:UxThemeHooks]: Failed to hook one or more symbol functions in uxtheme.dll
16:57:29.803 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.803 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55FA80
16:57:29.804 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532327C0
16:57:29.804 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.804 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.804 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD587DC0
16:57:29.805 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532330C0
16:57:29.805 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.805 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.805 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD55F640
16:57:29.805 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53232B04
16:57:29.806 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.806 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.806 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD994290
16:57:29.806 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA53222580
16:57:29.806 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.807 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.807 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFABD994710
16:57:29.807 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA532226BC
16:57:29.807 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.808 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::FreeStringSetting
16:57:29.808 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::FreeStringSetting
16:57:29.809 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::SetFunctionHook
16:57:29.809 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Target: 00007FFAC2CD96F0
16:57:29.809 11896 Notepad.exe  [WH] [LoadedMod::SetFunctionHook]: Hook: 00007FFA5322271C
16:57:29.809 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::SetFunctionHook
16:57:29.809 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::Initialize
16:57:29.832 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::ModDebugLoggingScope]: >>> Entering LoadedMod::AfterInit
16:57:29.846 11896 Notepad.exe  [WH] [`anonymous-namespace'::ModDebugLoggingScope::~ModDebugLoggingScope]: <<< Exiting LoadedMod::AfterInit

The unresolved symbols:

SHThemeFillTextRect
FillRectClr
struct HBRUSH__ * __cdecl ListBox_GetBrush(struct tagLBIV *,struct HBRUSH__ * *)
void __cdecl _BorderRect(struct HDC__ *,unsigned long,struct tagRECT const *,int,int)

Other architectures on ARM64 may have other symbols, and it can be messy. After you fix this, I can test x86 and x64 on ARM64. Let me know.

@m417z

m417z commented Jul 21, 2026

Copy link
Copy Markdown
Member

Below is another review round with new findings which seem to be worth addressing. Regarding 1, it's worth testing the mod with 32-bit apps. Also let me know if you need help reversing to verify that any of the calling conventions match.

Submission review


  1. 32-bit calling convention mismatch in the new symbol hooks. Several of the new hook pointers are declared __fastcall, but their own 32-bit symbol strings declare __stdcall (or carry stdcall decoration): _BorderRect_orig, RealDefWindowProcWorker_orig, RenderTooltip_orig, SetDarkThemeColors_orig, SHThemeDrawText_orig (_SHThemeDrawText@56), FillRectClr_orig (_FillRectClr@12), and BrandingLoadImage_orig (_BrandingLoadImage@24). On x64 this is harmless (__fastcall is the standard convention there), but on 32-bit processes — which this mod targets, since there's no @architecture restriction and @include * injects into WOW64 apps — a __fastcall call into a __stdcall target passes the first two arguments in registers the callee reads from the stack, corrupting arguments and unbalancing the stack. RealDefWindowProcWorker in particular is hit constantly by every 32-bit GUI app once "New system colors" paths are active. The file already defines the STDCALL macro and uses it correctly for the other hooks (MB_DlgProc_orig, DrawCommandRectangle_orig, _GetBrushesForPart_orig, ListBox_GetBrush_orig, etc.) — please use it for these as well, and verify the feature on a 32-bit process.

  2. Per-paint ID2D1DCRenderTarget leak. PaintListBox (line 2720), PaintDropDownArrow (line 2768) and the new PaintToolbarSplitDropDown (line 4293) use a raw ID2D1DCRenderTarget* that is never Released — CreateBoundD2DRenderTarget transfers ownership via renderTarget.Detach(). Every listbox fill, combobox arrow, and toolbar dropdown paint leaks a COM render target, so memory grows without bound during normal use. Every other Paint* function in the file correctly uses Microsoft::WRL::ComPtr — please switch these three to the same pattern. (The first two predate this PR, but it's worth fixing them while you're here.)

  3. Dangling brush handles in the system-color brush cache after a theme change. In HookedDefWindowProcW (line 5091), the ImmersiveColorSet handler deletes the brushes in g_themeCachedCustomSysColorBrushes but iterates by value and never resets the array entries, so the cache keeps dangling HBRUSH values. HookedGetSysColorBrush revalidates entries with GetObjectType, but that isn't reliable: GDI handle values are recycled, so a deleted handle can later refer to a different live brush owned by other code — GetObjectType then reports OBJ_BRUSH and the mod serves a foreign, wrong-colored brush indefinitely (and keeps serving it after its real owner deletes it). The deletion also races with concurrent readers, since it runs under g_ThemeChangeLock while the cache is guarded by g_SysColorsLock. Fix: take g_SysColorsLock, iterate by reference, DeleteObject and null each entry:

    AcquireSRWLockExclusive(&g_SysColorsLock);
    for (HBRUSH& brush : g_themeCachedCustomSysColorBrushes) {
        if (brush) { DeleteObject(brush); brush = nullptr; }
    }
    ReleaseSRWLockExclusive(&g_SysColorsLock);

    With the entries properly nulled, the GetObjectType validity probes in HookedGetSysColorBrush can be dropped entirely.

  4. LoadWindowProcessRules applies every matching rule and can install hooks twice. The loop has no break after a match, so when several rules match the same process (e.g. a bare name rule plus a directory rule — the settings explicitly encourage directory rules), each matching rule overwrites the previous one's settings, and once g_DefaultSysColors latches TRUE, the if (g_DefaultSysColors) block runs again on the next match: Wh_SetFunctionHook is called a second time on GetSysColor/GetSysColorBrush/FillRect, and User32Hooks calls WindhawkUtils::HookSymbols on user32.dll a second time — repeated HookSymbols calls for the same module invalidate the symbol cache and force re-resolution, on top of the duplicate hook attempts. Suggest: scan the rules, remember the first (or last — but document the precedence) matching rule's values, break, and install hooks exactly once after the loop.

  5. CacheCommandlinkButton and CacheDragDrop return FALSE on success. Both end with return FALSE; after a successful EndDraw() (lines 2463 and 4498), so the first paint of a command link / drag-drop image reports failure and falls back to the default theme rendering even though the cache was populated (subsequent paints use it). They should return TRUE; like every other Cache* function. (The command-link one predates this PR; still a one-line fix.)

Optional improvements

Minor polish — none of this affects users in practice, so it's your call.

  • Settings key case mismatch: the block declares SysColors, but both reads use Wh_GetIntSetting(L"RenderingMod.Syscolors") (lines 6362 and 6403). This currently works only because registry value lookups are case-insensitive — please use the exact declared name so it doesn't depend on that.
  • tl_bpGuard is never referenced (line 852). A thread_local with a dynamic initializer is only initialized on first odr-use, and an unreferenced one may be discarded entirely — so BufferedPaintInit likely never runs. BeginBufferedPaint works without it (Init is a caching optimization), but as written the guard is a no-op. Either touch it in the paint path (e.g. (void)tl_bpGuard; at the top of HookedExtTextOutW) or remove it.
  • Dead code / unused deps: g_DpiChangeLock (line 202) is never used; ClearSysColorsRegKey is only referenced from a commented-out call; -lcomctl32 appears to be unneeded now that the subclassing code is gone (BeginBufferedPaint/BufferedPaintInit live in uxtheme).
  • RevertSysColors broadcast storm on unload: ColorizeSysColors guards against redundant SetSysColors calls (COLOR_WINDOW == RGB(0,0,0) check), but RevertSysColors has no symmetric guard, so on mod disable every injected process calls SetSysColors (each triggering a system-wide WM_SYSCOLORCHANGE redraw). A symmetric "already reverted" check would reduce the flicker.
  • Deleting handed-out brushes at unload: apps are allowed to cache GetSysColorBrush results forever (real system brushes are permanent), so deleting the custom brushes in Wh_ModUninit leaves dangling handles in any process that cached them, causing paint glitches after unload. Consider intentionally leaking the ≤62 brushes on unload instead — bounded and safer.
  • Theme cache races: the g_themeCache HDC arrays are filled from any painting thread with no synchronization, and ClearCache() on a theme change can delete an HDC another thread is currently blitting from. GDI fails gracefully on stale handles so the impact is a transient wrong paint on theme change only, but a lock (or per-entry std::atomic<HDC> exchange) would make it sound.
  • RestoreWindowCustomizations calls SetWindowCompositionAttribute without the null check that EnableBlurBehind has.

Functionality notes

Non-critical observations about the feature behavior itself.

  • Per-monitor DPI: g_Dpi is captured once at load from the primary monitor and never refreshed (the TODO at line 191 acknowledges this). Cached part bitmaps are sized for that DPI, so on mixed-DPI setups secondary-monitor controls render scaled, and a runtime scaling change leaves stale caches (nothing invalidates them on WM_DPICHANGED/WM_SETTINGCHANGE). Fine as a known limitation, but worth a FAQ line.
  • HookedExtTextOutW flag handling: the ETO_GLYPH_INDEX branch uses exact equality (options == ETO_GLYPH_INDEX), so combinations like ETO_GLYPH_INDEX | ETO_CLIPPED fall into the generic branch, which measures the glyph-index buffer with GetTextExtentPoint32W (treating indices as characters) and computes a wrong composition rect. Consider testing the flag with options & ETO_GLYPH_INDEX instead.
  • Hooked_CNscTree_DrawDivider hardcoded offsets: the __this offsets (50 on x64, 61 on x86, noted "as of 26200.8737") are build-specific. The IsWindow/class-name guards and the original-function fallback make this fail safe on layout changes, which is good — just be aware it will quietly regress to the default divider on future builds.
    Manual note: Can WindowFromDC work here perhaps?
  • HookedRenderTooltip resizes the tooltip window with SetWindowPos from inside the render routine; it's guarded against repeated growth, but moving the window during paint can cause a visible one-frame jump when the tooltip first appears.
  • Theme-change detection relies on apps passing WM_SETTINGCHANGE to DefWindowProcW — processes that handle it themselves (or use the ANSI DefWindowProcA) will keep stale cached colors until repaint/restart. Probably acceptable, just noting the coverage gap.

@Undisputed00x

Undisputed00x commented Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Here are my logs from a native Notepad:
Details

The unresolved symbols:

SHThemeFillTextRect
FillRectClr
struct HBRUSH__ * __cdecl ListBox_GetBrush(struct tagLBIV *,struct HBRUSH__ * *)
void __cdecl _BorderRect(struct HDC__ *,unsigned long,struct tagRECT const *,int,int)

Other architectures on ARM64 may have other symbols, and it can be messy. After you fix this, I can test x86 and x64 on ARM64. Let me know.

@m417z Changing the calling convention from __fastcall to the below one causes 32-bit programs to crash.

#ifdef _WIN64
#define STDCALL  __cdecl
#define SSTDCALL L"__cdecl"
#else
#define STDCALL  __stdcall
#define SSTDCALL L"__stdcall"
#endif

@m417z

m417z commented Jul 22, 2026

Copy link
Copy Markdown
Member

After doing a more comprehensive check, I believe only these functions need adjustment:

  • ListBox_GetBrush: should be __fastcall instead of __stdcall
  • ComboEx_OnDrawItem: should be __fastcall instead of __stdcall
  • DrawCommandRectangle: should be __fastcall instead of __stdcall
  • RealDefWindowProcWorker: should be __fastcall with 6 params instead of 5 params - an additional argument 4 that's missing in x64. So if that's correct, the signature should be ifdef'd to get an extra argument only in 32-bit.

I looked at the assembly, but didn't test the actual mod.

@m417z

m417z commented Jul 25, 2026

Copy link
Copy Markdown
Member

Looks like the only things that's left is ARM64 support. Let me know if you need help with that.

@Undisputed00x

Copy link
Copy Markdown
Contributor Author

Looks like the only things that's left is ARM64 support. Let me know if you need help with that.

@m417z Thanks! Unfortunately, I cannot run tests on ARM, so any help would be appreciated.

@m417z

m417z commented Jul 25, 2026

Copy link
Copy Markdown
Member

I did some testing, and the results are not great.

  1. The 4 symbols mentioned here are inlined in ARM64, and seems like there's no easy workaround.
  2. For x64 processes, all 7 WindhawkUtils::HookSymbols calls fail because these dlls are compiled as ARM64EC, and Windhawk doesn't support it.

32-bit processes seem to work fine.

As a best-effort solution, you can:

  • Mark the 4 symbols as optional, always or guarded with #ifdef _M_ARM64, and make sure there are no critical consequences such as crashes when they aren't hooked.
  • See what happens if all 7 WindhawkUtils::HookSymbols calls fail to make sure it's handled gracefully with no crashes.
  • Optionally, document that ARM64 support it partial.

@Undisputed00x

Copy link
Copy Markdown
Contributor Author

The 4 symbols mentioned here are inlined in ARM64, and seems like there's no easy workaround.

The symbols are found in the V6 comctl32.dll which is placed inside C:\Windows\WinSxS, not the comctl32.dll from C:\Windows\System32.

For x64 processes, all 7 WindhawkUtils::HookSymbols calls fail because these dlls are compiled as ARM64EC, and Windhawk doesn't support it.

If this happens, these symbols fail to hook entirely. This makes the modification only partially supported by default on ARM64.
Documentation in mod's readme alone would be enough, right? If a symbol hook failure occurs, it aborts like it does below in the example.

Code example

VOID Comctl32Hooks()
{
    WindhawkUtils::SYMBOL_HOOK comctl32_dll_hooks[] =
    {        
        {
            {
                #ifdef _WIN64
                    L"SHThemeDrawText"
                #else
                    L"_SHThemeDrawText@56"
                #endif
            },
            &SHThemeDrawText_orig,
            Hooked_SHThemeDrawText,
            FALSE
        },
        // SHThemeFillTextRect is 64-bit only
        // 32-bit version is implemented inside SHThemeDrawText
        #ifdef _WIN64
        {
            {
                L"SHThemeFillTextRect"
            },
            &SHThemeFillTextRect_orig,
            HookedSHThemeFillTextRect,
            FALSE
        },
        #endif
        {
            {
                #ifdef _WIN64
                    L"FillRectClr"
                #else
                    L"_FillRectClr@12"
                #endif
            },
            &FillRectClr_orig,
            HookedFillRectClr,
            FALSE
        },
        {
            {
                #ifdef _WIN64
                    L"struct HBRUSH__ * __cdecl ListBox_GetBrush(struct tagLBIV *,struct HBRUSH__ * *)"
                #else
                    L"struct HBRUSH__ * __stdcall ListBox_GetBrush(struct tagLBIV *,struct HBRUSH__ * *)"
                #endif
            },
            &ListBox_GetBrush_orig,
            HookedListBox_GetBrush,
            FALSE
        },
        {
            {
                #ifdef _WIN64
                    L"void __cdecl ComboEx_OnDrawItem(struct COMBOEX *,struct tagDRAWITEMSTRUCT *)"
                #else
                    L"void __stdcall ComboEx_OnDrawItem(struct COMBOEX *,struct tagDRAWITEMSTRUCT *)"
                #endif
            },
            &ComboEx_OnDrawItem_orig,
            HookedComboEx_OnDrawItem,
            FALSE
        },           
    };

    HMODULE hComCtl32 = LoadComCtlModule();
    if (!hComCtl32) {
        Wh_Log(L"Failed to load comctl32.dll");
        return;
    }

    if (!WindhawkUtils::HookSymbols(hComCtl32, comctl32_dll_hooks, ARRAYSIZE(comctl32_dll_hooks))) {
        Wh_Log(L"Failed to hook one or more symbol functions in comctl32.dll");
        return;
    }
}

@m417z

m417z commented Jul 26, 2026

Copy link
Copy Markdown
Member

The symbols are found in the V6 comctl32.dll which is placed inside C:\Windows\WinSxS, not the comctl32.dll from C:\Windows\System32.

The dll inside C:\Windows\WinSxS is the 32-bit dll, so it's not loaded by ARM64 programs. Perhaps I misunderstood what you meant.

Documentation in mod's readme alone would be enough, right? If a symbol hook failure occurs, it aborts like it does below in the example.

Yes. Just need to make sure to avoid things such as calling via original function pointers without checking for null.

@Undisputed00x

Copy link
Copy Markdown
Contributor Author

Just need to make sure to avoid things such as calling via original function pointers without checking for null.

Like this ?

code example

// Intercept the windows branding logo image (e.g winver, shutdown dialog, regedit etc.)
// Winver loads the bitmap using LoadAboutBitmaps() routine, shutdown dialog using LoadBrandingBitmap().
HANDLE (STDCALL *BrandingLoadImage_orig)(LPCWSTR, UINT, UINT, INT, INT, UINT);
HANDLE STDCALL HookedBrandingLoadImage(LPCWSTR pszBrand, UINT uID, UINT type, INT cx, INT cy, UINT  fuLoad)
{   
    // Guard against calling via a null original function pointer
    if (!BrandingLoadImage_orig)
        return NULL;
         
    HANDLE hImage = BrandingLoadImage_orig(pszBrand, uID, type, cx, cy, fuLoad);

    // The image resource is fetched from basebrd.dll resource image 121.
    if (!wcscmp(pszBrand, L"Basebrd") && uID == 121)
        RecolorBrandingLogoBackground(reinterpret_cast<HBITMAP>(hImage));
    return hImage;
}

VOID WinbrandHooks()
{
    WindhawkUtils::SYMBOL_HOOK winbrand_dll_hooks[] =
    {
        {
            {
                #ifdef _WIN64
                    L"BrandingLoadImage"
                #else
                    L"_BrandingLoadImage@24"
                #endif
            },
            &BrandingLoadImage_orig,
            HookedBrandingLoadImage,
            FALSE
        },
    };

    HMODULE hWinbrand = LoadLibraryEx(L"winbrand.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32);
    if (!hWinbrand ) {
        Wh_Log(L"Failed to load winbrand.dll");
        return;
    }

    if (!WindhawkUtils::HookSymbols(hWinbrand , winbrand_dll_hooks, ARRAYSIZE(winbrand_dll_hooks))) {
        Wh_Log(L"Failed to hook one or more symbol functions in winbrand.dll");
        return;
    }
}

@m417z

m417z commented Jul 26, 2026

Copy link
Copy Markdown
Member

That's not necessary, BrandingLoadImage_orig will always be non-null if HookedBrandingLoadImage is called. I was referring to the case of calling BrandingLoadImage_orig (or another orig function) outside of a hook. I didn't check whether it actually happens in the mod, maybe not.

@Undisputed00x

Undisputed00x commented Jul 26, 2026

Copy link
Copy Markdown
Contributor Author

That's not necessary, BrandingLoadImage_orig will always be non-null if HookedBrandingLoadImage is called. I was referring to the case of calling BrandingLoadImage_orig (or another orig function) outside of a hook. I didn't check whether it actually happens in the mod, maybe not.

There is no case of this. Thanks for the help!

@m417z

m417z commented Jul 26, 2026

Copy link
Copy Markdown
Member

What about this?

  • Mark the 4 symbols as optional, always or guarded with #ifdef _M_ARM64, and make sure there are no critical consequences such as crashes when they aren't hooked.

Or do you prefer the whole WindhawkUtils::HookSymbols call to fail in these cases?

Comment thread mods/translucent-windows.wh.cpp Outdated
@m417z m417z closed this Jul 26, 2026
@m417z m417z reopened this Jul 26, 2026
@m417z
m417z merged commit 1095890 into ramensoftware:main Jul 26, 2026
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants