-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for 22449 & correct naming #1
base: develop
Are you sure you want to change the base?
Conversation
Thanks @NyaMisty |
@NyaMisty Good find! This is great, thanks for updating this |
Awesome, thanks.
BTW, I noticed mntone's pr/57 has an extra latest version 21359 not on the fork and I merged yours and that version on my own fork (also adding the missing names).
Simon
…On 18 September 2021 10:25:31 pm NyaMisty ***@***.***> wrote:
Document here comes:
For Interface Definition changing cases (i.e. Interface GUID & CLSID didn't change):
1. Retriving Interface Definition: Download and open the OleViewDotNet, and go to Registry -> Interface By Name, then lookup IVirtualDesktopManager and IVirtualDesktopManager, right click "View Proxy Definition"
2. Use IDA Pro to open twinui.pcshell.dll, find CVirtualDesktopManager, and then you'll find functions with [thunk] prefix, corresponds then with interface definition image <https://user-images.githubusercontent.com/5344431/133888619-f540bcfe-3980-459f-b0ed-6652cf60ff62.png>
For CLSID changing cases: (much harder, not for non-professional)
* Search whole System32 for Interface GUID's first part like "b2f925b9" using hex editor (note the little endian, you'll have to search "b9 25 f9 b2" in the editor), check them in IDA one by one
—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEPDJ6MQYRFPKV2CPWA7PXDUCSALNANCNFSM5EF4TKZA>.
Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
|
This mostly works, but it seems that |
@anaisbetts I checked that and it turns out the 21359 version was correct. So on my fork I have merged NyaMisty's 22449 version (since it has correct naming) with the 21359 interface. It works for me on 22463. |
Looks like the official Win 11 and Insider versions since don't have the IDs in the registry at all - does this mean we can't access via COM any more? I did a "go back" to the previous version I had (22463) to get the IDs saved and am about to go forward again to see if it works if we know them already instead of fetching from the registry - I imagine not since I guess the registry is what links that ID to the binaries. I suspect the new way to access this stuff is via Windows.Internal.Shell.Multitasking... I see some likely stuff in Interfaces By Name and Runtime Classes in OleViewDotNet. |
It does work with the ids from 22463 - they are in the registry but the interface names have been replaced by the ids so the function that searches by name fails. Ids are .. i'll be updating my fork in next few days |
@sliddington Which registry settings are missing? They seem to be there on upgraded Windows installs, but not on fresh Win11 installs |
All of them seemed to be there, just without their names. I made a build that worked for me (an upgraded install) but then didn't on the offical 22000 build. The master branch has recently been updated to apparently work for 22000. I haven't check it out yet. |
It appears that
|
Looks like some changes to IApplicationView as well
|
The ordering of IVirtualDesktop has changed. You have them all except your unknown's name is IsRemote and it was moved to the end:
|
So those are not the working interfaces either, but that new stuff is still interesting. Here are some updated interfaces that do work - Note the GUID changes as well
|
I'm pretty sure IVirtualDesktopNotification has two new members as I see them in the dll when I view in IDA. However, I still cannot get the notifications to work. Let me know if you guys figure it out.
|
I'm so dumb. I forgot to remove the monitor stuff from the notification interface. Thise object arrays are gone now. Here is the updated interface:
|
I took the liberty to match the interface to what I see in the DLL
|
This handy python script will mean we are never in this predicament again |
@mzomparelli Related to Grabacr07#76 |
Re: #1 (comment) |
Debug Interface Access, the dll is part of the 2005 C++ Redistributable. The method the python used is basically the same I did with IDA Free. I wish I would have found the script first. |
If you are interested you can check out my application for virtual desktops and hotkeys. One thing I really like is he DesktopView which is a replacement for TaskView. - https://zvirtualdesktop.com/ I really need to get started on a v2 that uses a more modern forms like WPF. |
Sounds like something I could use if it works with remote desktop. |
If anyone wants, I have the interfaces for Windows Server 2022. |
Which library are you using to support Windows 11 Insider? |
I think Win11 insider is the same as Win11 22H2 but I don't have insider to test. I'll work on setting up a VM to test it. |
Run WinVer and tell me what build you have |
22621.2215 |
that is not an insider build anymore, it's 22H2. You can use the interfaces I provided above for that build. zVirtualDesktop will work with your build. |
@Dexterously Try my fork: It's not working on Insider builds but does work with the latest official Win11. |
It would be fantastic if you could contribute them to: https://github.com/Slion/VirtualDesktop |
The problem I have is that it starting throwing this error today. I just assumed that it was no longer supported: I get these errors running this branch as of right now: https://github.com/Slion/VirtualDesktop |
I'm on 22621.2134 and it seems to be working there. Can you confirm yours is an insider build? Just did the August update. I'm now on 22621.2215 and it is indeed broken again. |
22621.2215 is not an insider build and the interface I posted in this thread work for it. I'm running 22H2 22621.2215 and I'm not running an insider build. I'm just on the normal user build. |
Let me get my crap together and I'll go check out your repo and see if I can add to it. |
Get more info on this. Which one is throwing the error? It only takes one of the interfaces to be wrong. |
Seems there might be something different between the 22621.2215 builds for insider versus non-insider. A build should be a build though, right? |
can someone send me the twinui.pcshell.dll from that insider build. If you can't attach here then send to [email protected] |
No need for that. I'm installing in Hyper-V. I'll test the other insider builds too. |
|
22621.2215 is no insider build. It's just 22H2 August 2023 update. |
I'll get more information today. However, I am NOT running an insider build. This just started yesterday. |
I've opened the following ticket to track progress on that 22621.2215 issue: |
Also, Grabacr07's repo haven't been active for over a year, and Windows 11 is moving blazing fast, would you like to maintain a new VirtualDesktop package, so that users can benefit from newest Windows virtual features.