Skip to content

CMDT - Run as TrustedInstaller - Release 03.08.2026

Latest
Latest

Choose a tag to compare

View all tags
@wesmar wesmar released this 03 Aug 14:19
latest
b0ac48a

🔐 PASSWORD: github.com

Extract downloaded release with password: github.com

📦 ARCHIVE CONTENTS (cmdt.7z — 30.61 KiB (31346 bytes))

cmdt-latest/
│
├── cmdt_x64.exe       ⭐ 64-bit binary (<40 KB)  — AMD64 / x64         [37.50 KiB (38400 bytes)]
├── cmdt_x86.exe       ⭐ 32-bit binary (<30 KB)  — IA-32 / x86         [29.50 KiB (30208 bytes)]
└── cmdt_arm64.exe     ⭐ 64-bit binary (ARM64)   — AArch64 / ARM64     [35.50 KiB (36352 bytes)]

All three binaries are functionally identical. Pick the one that matches your system: cmdt_x64.exe is the default on modern x86-64 Windows; cmdt_arm64.exe is native on ARM64 Windows (Surface Pro X, Snapdragon-based devices, ARM64 VMs); cmdt_x86.exe matters on legacy 32-bit systems or when launching from inside a 32-bit cmd (WOW64).

🔗 DOWNLOAD LINKS

File Size Description
cmdt.7z 30.61 KiB (31346 bytes) Main archive (x64 + x86 + ARM64) — password: github.com

🚀 QUICK INSTALLATION

Manual:

  1. Download cmdt.7z, extract with password github.com.
  2. Copy the binary for your architecture anywhere — C:\Windows\System32 is a natural location so it's reachable from every shell:
    • x86-64 Windows → cmdt_x64.exe
    • ARM64 Windows → cmdt_arm64.exe
    • Legacy 32-bit → cmdt_x86.exe
  3. Run elevated: cmdt -cli cmd for a TrustedInstaller prompt, or just cmdt for the GUI.
  4. Optional: cmdt -install registers right-click "Run as TrustedInstaller" / "Open CMD as TrustedInstaller" entries in Explorer.

CMDT requires Administrator rights. If launched non-elevated it self-elevates via ShellExecuteExW("runas"), forwarding every argument to the elevated copy. No manual "Run as Administrator" needed.

✅ WHAT'S NEW — 03.08.2026

[03.08.2026] ARM64 (AArch64) native binary added

cmdt_arm64.exe is now included in the release archive. This is a third native assembly binary, hand-written in A64 (AArch64) instructions — not a recompile or cross-target of the x64 sources. It runs natively on ARM64 Windows (Surface Pro X, Snapdragon-based devices, ARM64 VMs) and carries the same complete feature set as the x64 and x86 builds: GUI mode with Shift+Minimize tray, dark mode, Mica backdrop, PerMonitorV2 DPI scaling, CLI mode with the full stdout/stderr temp-file relay, Explorer context menu integration, Sticky Keys IFEO hook, Defender exclusion management via WMI, 34-entry privilege enablement table, 30-second token cache, .lnk resolution, drag-and-drop with UIPI bypass, and UAC self-elevation.

Release size: cmdt_arm64.exe is 35.50 KiB (36352 bytes).

[18.07.2026] Version 1.0.0.7 — Shift+Minimize tray, stable theme restore, console-subsystem CLI

Shift+Minimize now hides CMDT in the notification area. A normal minimize remains a normal taskbar minimize; holding Shift while clicking Minimize adds the tray icon and hides the main window. Double-click restores it, while the right-click menu provides Restore and Exit. Tray state lives in a dedicated tray.asm module on both architectures. It also handles TaskbarCreated and allows that registered message through UIPI, so the elevated process can republish its icon after Explorer restarts.

Theme restore behavior is stable in both system modes. The x64 theme refresh now treats a successful AppsUseLightTheme read as authoritative in both directions instead of latching a previous dark state. The light path has a real stock background brush and the dark path continues to paint through WM_ERASEBKGND, preventing the mixed light-controls/black-client window previously exposed after minimize/restore. Re-entrant WM_THEMECHANGED notifications remain repaint-only behind the existing theme-application guard.

Both executables now use /subsystem:console. cmd.exe therefore waits for -cli synchronously and prints its next prompt only after CMDT exits. A no-argument Explorer launch hides a newly-created, process-private console in place after checking GetConsoleProcessList; a console shared with an existing terminal is never hidden. The previous detach-and-relaunch workaround and prompt-nudge code are gone.

CLI relay correctness was tightened. stdout and stderr travel through separate temporary files (-outfile / -errfile), relay-mode stdin is an inheritable NUL handle, and the launched command's real exit code propagates to CMDT and the calling script.

The GUI now follows the system app theme across DWM chrome and client controls. Runtime-resolved UxTheme ordinal 135 uses value 1 (AllowDark), rather than 2 (ForceDark), so native popup menus do not remain dark after switching Windows to light mode. The classic top-level menu strip remains USER32-rendered; an owner-draw experiment was disabled after it caused re-entrant messages and an x64 hang.

The former window.asm tapeworm is split into six responsibility-based includes on both architectures: lifecycle/DPI, theme, commands, dispatch, events, and MRU. MASM still assembles each architecture's GUI as one translation unit, while the independent tray lifecycle is linked from the new standalone tray.asm module.

Release sizes: x64 is 37.50 KiB (38400 bytes) (limit <40 KiB); x86 is 29.50 KiB (30208 bytes) (limit <30 KiB). Build and release scripts now report logical file length as exact bytes plus two-decimal KiB rather than rounded filesystem-block output.

[13.07.2026] PerMonitorV2 DPI scaling actually implemented, double-UAC-prompt regression fixed, build script fixed for newer VS, version 1.0.0.2

The GUI actually scales on PerMonitorV2-aware displays now. The manifest declared dpiAwareness=PerMonitorV2 since early builds, but nothing in the code scaled to match it — every control coordinate was a raw 96-DPI pixel constant. On a scaled display the window and its controls rendered tiny, with text and buttons cramped or clipped. Fixed: GetDpiForSystem/GetDpiForWindow scale every design coordinate at window creation, WM_CREATE, and WM_SIZE; the main window's total size is computed from the desired client area via AdjustWindowRectExForDpi instead of a guessed pixel constant, so caption/menu/border overhead is correct regardless of Windows theme or DPI. Verified via terminal launches at several DPI scales, elevated and non-elevated.

Fixed a second-UAC-prompt regression introduced by the previous -cli relay fix. The 12.07.2026 fix routed already-elevated -cli calls through the same relay function used by the non-admin path — but that function shells out via ShellExecuteExW("runas"), and re-elevating an already-elevated process that way can still pop a second consent dialog. Caught during testing and replaced with a dedicated AdminRelayLaunch that captures output entirely in-process (local temp file + direct token duplication via RunAsTrustedInstaller), never calling ShellExecuteExW. Zero prompts past the shell's own elevation, verified with redirect/pipe/console, elevated and non-elevated.

build.ps1 fixed for newer Visual Studio releases. vswhere -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 stopped matching on a newer VS release even with the C++ toolchain installed, and the VC\Auxiliary\Build\Microsoft.VCToolsVersion.default.txt marker file it read the toolchain version from was renamed. The script now lists every VS-Installer-registered product newest-first and picks the first one where VC\Tools\MSVC\<version>\bin\Hostx64\x64\ml64.exe actually exists, instead of depending on either.

File version bumped to 1.0.0.2.

[12.07.2026] History made opt-in, `-cli` output relay fixed for already-elevated shells, versioning starts

Command history is now off by default (issue #2). No registry key exists until you explicitly turn it on. A new File → Enable History checkbox reflects whether HKCU\Software\cmdt exists — checking it just flips a flag (the key is still created lazily by the next command); unchecking it calls RegDeleteTreeW immediately, wiping it on the spot. cmdt -history-clear does the same from the CLI. While disabled, no registry read or write happens at all.

cmdt -cli <cmd> > out.txt now works from an already-elevated shell, not just a non-admin one (issue #1). Root cause: CreateProcessWithTokenW doesn't reliably hand the spawned child usable inherited std handles — an admin cmd.exe running cmdt -cli net session > out.txt used to get an empty file. The first fix routed every -cli invocation through the non-admin relay unconditionally, admin or not; see the 13.07.2026 entry above for the follow-up that removed the resulting double-UAC-prompt regression. Verified with redirect, pipe, and confirmed the spawned process genuinely carries the TrustedInstaller token (whoami → nt authority\system).

Relay-mode hStdInput fixed from NULL to an inheritable NUL-device handle — some console-aware targets refused to start with a null stdin handle under CREATE_NO_WINDOW.

File version bumped to 1.0.0.1. Every earlier build shipped FileVersion/ProductVersion frozen at 1.0.0.0. Fixed going forward.

Known limitation, not fixed: if the -cli command is itself cmd.exe with its own embedded redirection (cmd /c foo > file), cmd.exe refuses under the relay's CREATE_NO_WINDOW context. Pre-existing, not a regression, tracked separately.

[17.05.2026] Interactive-shell guard + x86 console handling synced with x64

cmdt -cli cmd / powershell / pwsh from a non-admin shell now works. The temp-file relay was incompatible with interactive shells — CREATE_NO_WINDOW + captured stdout meant the child had no console, no stdin, no prompt redraw, and the parent's WaitForSingleObject blocked the caller. NonAdminRelayLaunch now detects exactly cmdt -cli <shell> (argc == 3, argv[2] matches cmd / cmd.exe / powershell / powershell.exe / pwsh / pwsh.exe) and declines the relay. The caller falls through to plain UAC self-elevation, which spawns a real visible console for the TI shell. Anything with extra arguments (cmd /c dir, powershell -Command …) still uses the relay so output keeps streaming back.

x86 console handling brought in line with x64. The 16.05.2026 AttachConsole + NudgeConsolePrompt work landed on x64 only. cmdt_x86.exe -cli net session with no redirect previously produced no output — cmdt_x86.exe is /subsystem:windows, so cmd.exe doesn't wire up the console handle, GetStdHandle(STD_OUTPUT_HANDLE) returned NULL, and WriteFile silently dropped the relay output. start in x86 main.asm now does the same early AttachConsole(ATTACH_PARENT_PROCESS) guarded by GetFileType (attach for NULL / INVALID / FILE_TYPE_CHAR, leave alone for FILE_TYPE_DISK / FILE_TYPE_PIPE so redirects keep their inherited handles). NudgeConsolePrompt was extracted from ShowUsageAndExit into its own proc in help.asm and is now called from x86 relay.asm before DeleteFileW — the cursor no longer sits idle one line above the new prompt after relay output.

End-to-end coverage on both architectures: cmdt -cli cmd (interactive shell → plain UAC), cmdt -cli cmd /c dir (relay), cmdt -cli net session (relay → stream to console), cmdt -cli net session > out.txt (relay → file), cmdt -cli net session | findstr X (relay → pipe).

[16.05.2026] Modular split for both architectures + redirect/help fixes + MRU policy change

Both source trees split into focused modules. x64 was split first (15.05.2026); x86 was migrated to the same shape on 16.05.2026 so both trees mirror each other. The old ~90 KB main.asm on each side is now cli.asm, help.asm, relay.asm, install.asm, strutil.asm, process.asm, token.asm, window.asm, and a slim main.asm. Compiled binary sizes are unchanged — every byte that used to be in main.asm is still in the final image, just in a different translation unit.

Non-admin cmdt -cli <cmd> >> out.txt now works. A temp-file relay in relay.asm bridges the UAC handle-inheritance gap: the non-admin parent creates a temp file, passes its path as -outfile <path> to the elevated child, waits for the child to finish writing to it, then streams the file to its own STD_OUTPUT_HANDLE (which cmd.exe wired up for the redirect). Two bugs surfaced while implementing this — SHELLEXECUTEINFOW.hProcess was being read at the wrong offset on x64 (+96 instead of +104), and AttachConsole was silently overwriting inherited redirect handles with CONOUT$. Both are fixed.

cmdt -help (and all six other spellings) works in every shell. The help check now runs before IsUserAnAdmin() so the usage banner reaches the original console / redirect target without going through UAC. The output API is selected by GetFileType — WriteConsoleW for a real console, WriteFile for a file or pipe. After writing to a console, a fake VK_RETURN is posted to stdin so cmd.exe redraws its prompt instead of leaving the cursor idle.

MRU dropdown no longer pre-selects the last command at startup. CB_SETCURSEL 0 → CB_SETCURSEL -1 + SetWindowTextW("") on both LoadMRU and SaveMRU. History still works (click the dropdown arrow), but the edit field starts empty so the user doesn't accidentally re-run the previous command.

[Older releases] Initial public release
  • Dual-mode binary: GUI and CLI from the same executable, switched by the presence/absence of arguments
  • UAC self-elevation via ShellExecuteExW("runas") with full argument forwarding
  • Explorer context menu entries (Directory background, Directory, exefile, lnkfile) registered by cmdt -install
  • Sticky-Keys IFEO hook for login-screen TrustedInstaller rescue console (cmdt -shift)
  • Defender process exclusions for the hook target managed automatically (WMI on x64, PowerShell on x86)
  • 34-entry privilege table requested against the duplicated service token
  • Token caching with 30-second TTL
  • MRU history (last 5 commands) persisted in HKCU\Software\cmdt
  • .lnk shortcut resolution via IShellLinkW + IPersistFile COM interfaces
  • Drag-and-drop with UIPI bypass for WM_DROPFILES / WM_COPYGLOBALDATA
  • PerMonitorV2 DPI awareness via application manifest
  • Dark mode + Mica backdrop via DwmSetWindowAttribute
  • Zero CRT dependency — all string ops hand-written in strutil.asm

📋 USAGE QUICK REFERENCE

Switch Effect
cmdt Launch the GUI (no arguments)
cmdt -cli <command> Run <command> as TrustedInstaller, inheriting the parent console
cmdt -cli -new <command> Same, but in a brand-new console window
cmdt -install / -uninstall Add / remove Explorer right-click entries
cmdt -shift / -unshift Install / remove the Sticky-Keys IFEO hook
cmdt -help / -h / --help / -? / /? / /h / /help Print the usage banner (works without elevation and with >file)

📞 CONTACT & SUPPORT

⚖️ LEGAL DISCLAIMER

For educational and authorized system administration / recovery purposes only.
The TrustedInstaller service token grants access to sensitive Windows resources. Misuse can render the operating system unbootable.
Unauthorized access to computer systems is illegal.
The author assumes no liability for misuse.

Release Date: 03.08.2026
© WESMAR 2026

Assets 3
Loading