Add a simple option to use start11 menu

[gailium119]

When researching on Stardock Start11 I found that opening the start11 menu is quite easy:

1. write the code like this: HMODULE hm = LoadLibraryW(L"start10_64.dll"); void* hook = GetProcAddress(hm,"Hook"); HHOOK hk = SetWindowsHookExW(5, (HOOKPROC)hook, hm, 0);
2. drop start10_64.dll and default.spak to C:\windows.
3. enjoy the start11 menu.
4. Release.zip

[valinet]

Can you explain how it works? You execute that snippet every time? If so, it's not right. I mean, set the hook every time you open it...? And why should EP load Start11 in explorer.exe, can't Start11 load itself somehow? I don't get it, when Start11 is installed, it doesn't open when you press the Start button or the Windows key by default? That's why you have to go though all of this trouble, or why? With other Start menus, they hook explorer.exe and make themselves open when the user presses Start.

Please clarify this a whole lot more, especially seems you keep pushing for inclusion in EP. Also, I am pretty sure I have no license to redistribute Start11's files. But besides that, I still, after all this time, do not understand what the problem with that is...

[gailium119]

Just add it as an option when starting explorer,or i'll do it myself,but if so I will not get updates of ExplorerPatcher
As for the code, I got it by decompiling start11_64.exe;
the snippet needed to be executed everytime explorer.exe restarts;
Although we don't have a license,I think studying how Start11 works gives a way do draw the start menu in explorerpatcher itself,giving the UI more chances to customize.

[valinet]

Okay, so they set up a hook when Explorer starts, and in there probably present themselves when you invoke Start. I still don’t understand why this doesn’t work standalone. I keep asking this, you ignore it: does pressing Start when using the Windows 10 taskbar from EP not trigger it…?

Regarding loading it into EP, I had this talk before regarding SAB, I won’t integrate such functionality in the upstream because it probably is against their license agreement. Maintaining a fork with this patch is always an option and seems easy to do with this patch.

Or we could have some generic solution. Like EP loading some “ep_extra.dll” library if available, and in “ep_extra.dll” users throw in their addon code and stuff they want to do, like what you showed above, for example; that’s fine, but I won’t integrate that directly in the source.

[gailium119]

Answering your question:
Although EP is completely compatible with start11,there are a few bugs when installing both:
everytime EP restarts explorer.exe ,the hook of start11 loses ,I have.to restart the hook manually;
If i add something to EP it will be lost once EP updates itself.
So i suggest that EP should enable modding,sort of like this:
HMODULE modDLL=LoadLibraryW("epextra.dll"); if(modDLL!=NULL) //do something

[valinet]

1. It's not lost, you just have to reply the patch and compile your own version. It's standard practice in a lot of open source projects, it's still way better than not having access to the source at all.
2. Thanks for proposing the same thing I proposed above as well. Yeah, I will think about it.
3. Basically you say Start11 is poorly coded... it shouldn't stop working just because explorer.exe restarts, it should get reinjected and carry on with its business...

[gailium119]

1. How can I apply the patch automatically once EP updates?
2. Start11 use a service to rehook once explorer.exe restarts, but it consumes too much memory and is very inefficient.

[valinet]

@gailium119 Okay, so the latest pre-relase version (.6) adds a mechanism for chainloading some other module, where you can put whatever code you'd like. A compiled pre-release will be available as soon as it gets built; please test that and tell me how it works. The module has to be called ep_extra.dll, it has to export a function called ep_extra_EntryPoint and has to be placed in C:\Windows. An example module is the following:

#include <Windows.h>
#include <stdio.h>

HMODULE hModule = 0;

__declspec(dllexport) ep_extra_EntryPoint()
{
    WCHAR wszExePath[MAX_PATH], wszModulePath[MAX_PATH];
    GetModuleFileNameW(GetModuleHandleW(NULL), wszExePath, MAX_PATH);
    GetModuleFileNameW(hModule, wszModulePath, MAX_PATH);
    wprintf(L"Hello world from ep_extra (%p - \"%s\") in \"%s\"!\n", hModule, wszModulePath, wszExePath);
}

BOOL WINAPI DllMain(
    _In_ HINSTANCE hinstDLL,
    _In_ DWORD     fdwReason,
    _In_ LPVOID    lpvReserved
)
{
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        DisableThreadLibraryCalls(hinstDLL);
        hModule = hinstDLL;
        break;
    case DLL_THREAD_ATTACH:
        break;
    case DLL_THREAD_DETACH:
        break;
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

It produces this output at runtime:

...
[Extra] Found library: 00007FFE98900000.
[Extra] Running entry point...
Hello world from ep_extra (00007FFE98900000 - "C:\WINDOWS\ep_extra.dll") in "C:\WINDOWS\explorer.exe"!
[Extra] Finished running entry point.
...

The module is loaded after the main initialization for EP finishes, before control is returned to wWinMain in explorer.exe. The entry point is run on the same thread, so please refrain from doing any lengthy processing; instead, use CreateThread to spawn a new thread where you do any longer tasks you might need to do. Please refrain from putting you code in DllMain, use a DllMain similar to the one provided in the example. The call to ep_extra's entry point is NOT made from DllMain, so you can safely call or use any function you'd like. Needless to say, be careful with what you are doing, and refrain from reporting any bugs while using this, test without to be absolutely sure this does not interfere in any way.

Also, beware that this gets to run only in the main explorer.exe process, the one that creates the shell and the taskbar etc. It will not run in any helper or additional explorer.exe process (like the ones creating when launching Control Panel for instance). So, this run is basically tied to explorer.exe creating the shell interface, which is something that should work in your use case.

While we test this, the functionality is subject to change, so the ABI may break between versions, if we/I determine any major architectural, design or security flaws in it. Once we stabilize on some version, it will be carried forward, so updates to EP should mean no need for updating your ep_extra library.

Thanks

[gailium119]

Thanks a lot.In my opinion, the ep_extra.dll should contain such functions:
void BeforeExplorerstart(); void AfterExplorerstart() void StartLoop()
And when EP starts it loads BeforeExplorerstart fuction and starts Explorer.exe and loads AfterExplorerstart function; and it creates a thread to execute the loop function.

[valinet]

Maybe before and after, although not really necessary, since what would you do anyway? Before means before I set up the IAT patches, after is after I set them and start a couple of threads. Like, if such granularity is needed anyway, than probably the scope is to patch EP, not explorer, but since the source is available, why go through the hassle. Also, regarding the loop, what if someone just wants to set another IAT patch or something easy, for example, do they need a loop? Not really. ep_extra should have flexibility in what it can do so it caters to most scenarios like yours. I will think about it, though.

Anyway, so I presume the update worked for you, right?

[valinet]

Also, can you check if setting up this registry entry and having your program start with this from which you can hook Explorer and do whatever you need to do is enough? I’d rather you do that then this program to provide that ep_extra mechanism.

https://www.geoffchappell.com/notes/windows/shell/explorer/taskman.htm

[plofhaan]

This command sets auditing for the 'Process Creation' subcategory to enabled:
auditpol /set /subcategory:{0cce922b-69ae-11d9-bed3-505054503030} /success:enable
Next, I can go in Task Scheduler and create a new task with a trigger that uses a custom Event Filter:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[band(Keywords,9007199254740992) and (EventID=4688)]] and *[EventData[Data[@Name='NewProcessName'] and (Data='C:\Windows\explorer.exe')]] and *[EventData[Data[@Name='ParentProcessName'] and (Data='C:\Windows\System32\rundll32.exe')]]</Select>
  </Query>
</QueryList>

So when EP restarts Explorer the task will be run. You just need to add an Action in it so that it will run your program or script.

[valinet]

Yeah, this could be a solution as well, instead of letting external code run in explorer via the mechanism proposed above. Although, it’s not that hard to run code in explorer either, there are shell extensions all over the place. The approach above is obviously more complicated, it requires enabling that auditing, in theory, the way it stands now, could trigger for anything that restarts EP from rundll32, which is not necessarily bad, yet not great either, since it misses other processes doing this; also, not reliable if I were to switch back to restarting explorer using Restart Manager. It’s also racy, although probably not really a problem here and one could attach as a debugger, which pauses the execution of explorer, but also may impede setting up some hooks… not to mention, even ep_extra may be too much, like, explorer calls the executable defined in the Taskman registry key early when it starts, so that may also be enough… idk, there are many ways, each with pros and cons.

[plofhaan]

Maybe you could add an option that, when set to enabled, it causes ExplorerPatcher to, each time when ExplorerPatcher restarts the Explorer process, run a command (with optional parameter string) that the user can specify in the registry settings of ExplorerPatcher. This option will be silently ignored by ExplorerPatcher if ExplorerPatcher could not find this registry setting.