User:Hounsell/4033 DWM

UXDeskSB.exe

Main service that provides DWM / DCE functionality, and has also taken over responsibility for theming.

Initially checks to make sure it's not already running by attempting to create a mutex called "UXDeskSB:Mutex", fails if there's already another instance running since it will have created this mutex first.

Whole bunch of calls in its entry, but about half way through it calls a function which calls a function which reads and loads the "SB Servers". These do the bulk of the actual work for the service.

These are read from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Desktop in the SBServers value, this is a multi-line string. Each line takes the form of (libraryname),(exportname), this is an SB Server that will be called using LoadLibrary/GetProcAddress. In 4033, there's only one by default, that's desksrv,DesktopServerEntry.

desksrv.dll

This file is responsible for the bulk of the work. In earlier builds, it was split between dce.dll (DCE) and themesrv.dll (Theming service), now there's just desksrv.dll which combines both.

When the DesktopServerEntry is called by UXDeskSB.exe, it receives two arguments. One appears to be a status enum (1 for start, 2 for stop), and a function pointer to a callback.

On the start path, it first has some code which invokes the callback and stores the result in a global variable. It looks like this probably is information relating to the logged in user.

It then attempts to stop any already-running MIL server instance. Then it configures and starts a new instance.

A bit later it then calls a function to either get a handle to an existing thread, or create a new one, which handles the DWM side.

This thread starts off by making an eligibility check. First, it checks that the callback data received earlier exists, and if so, uses a handle to impersonate the logged in user for the next check. It first creates a path that's basically %WINDIR%\resources\themes\aero\aero.msstyles, and passes it out to UxTheme's ApplyTheme export. This name is a lie, it doesn't actually apply the theme. It checks for a theme property called "DemoCheck", and if it exists, treats it as a path and sees if it exists. The thread then reverts back to its original context (discarding the impersonation) and returns a result based on these checks.

A bit later, we then have a few functions that it calls. First, it attempts to create a MIL Device. If that succeeds, it then handles the Glass Frame parts in this order:

1. Frame Meshes
2. Extended Frame
3. Standard Frame
4. Frame Shadow
5. Frame Flag
6. Frame Buttons
7. Title text with background

Failure of any of these will skip past all later parts and not use the glass frame.