Windows 8.1 build 9354 (winmain)

6.3.9354.0.winmain.130301-1710

Build of Windows 8.1
OS family	Windows NT
Version number	6.3
Build number	9354
Build revision	0
Architecture	ARM32 (ARMv7)
Build lab	winmain
Compiled on	2013-03-01
Expiration date
Timebomb	2014-01-15 (+320 days)
SKUs
RT (CoreARM)
About dialog

Windows 8.1 build 9354 (winmain) is an internal development build of Windows 8.1, which was found on a formerly Microsoft-owned Samsung Ativ Tab prototype (part number WGPV3).

A photograph of the original device that ran this build was first posted onto a Reddit community on 17 January 2024. The original WIM images for this build were first uploaded onto the Internet Archive in 19 January 2024, followed by a full dump of the prototype's eMMC storage block data in the days that followed. Compared to the base WIM images, the eMMC dump also includes internal tools such as debuggers, test suites and other development tools.

The build includes a large array of user interface reworks, as well as incremental quality-of-life changes to existing operating system functionality.

New features and changes

Windows Setup

Out-of-box experience

Minor visual changes to the out-of-box experience have been introduced compared to the previous build. Most notably, the color picker used within the Personalization page has been updated to bear a new palette design, and localization changes to computer name validation have been added.

User interface

This build introduces several new major design reworks across the existing Windows user interface, as well as incremental quality-of-life improvements:

Applications

It is now possible to snap Metro UI applications to sizes below those instituted by the minimum Windows 8 system requirements (which require a 1366×768 pixel display resolution).

New branding for Internet Explorer 11 has been added to the web browser.

Start screen

It is now possible to directly change the current Start screen background and switch to previously-used accent colors via the Personalization submenu, included as part of the Settings charm - because of this change, the associated tab for start screen personalization has been completely removed from the PC settings application. Installed applications listed within the Start screen's application list can now be sorted by name or by their installation date. Early work for a reworked Search user interface has been implemented, although it does not function and its pinned application tile does not display anything.

Various quality-of-life changes to the way pinned applications work have also been added: pinned application tiles can now be resized down to a very small scale, the applications layout can now be directly changed through the addition of a new "Customize" option in the start screen context menu, replacing the previous "All Apps" button featured in older builds, and support for synchronizing layouts to an existing Microsoft account has been added.

Charms bar

A new interface design for the Devices charm has been added, offering three distinct menu options for playing content on remote devices, sending documents to printers and extending displays to multiple monitors.

Control Panel/PC settings

Additional design changes have been introduced within the reworked PC settings application design; notably, a non-functional search box has been added and the user's accent color is now properly respected. A subset of new pages have also been implemented, although much of them are either placeholders for up and coming features (such as SkyDrive integration and device configuration), are largely unfinished or do not function at all; an option to switch to the older design iteration from Windows 8 is also included, but there is no visual way to switch back to the newer user interface. The new UI can be switched back to by merging the below registry value:

[HKEY_CURRENT_USER\Control Panel]
XamlAppModel=dword:00000001

An option for toggling on the lock screen slideshow (dubbed a "picture frame") is now included as part of the PC settings application, with the additional option of selecting a folder containing the user's desired lock screen images, and the associated Control Panel applet for the Windows Experience Index (WEI) is no longer present due to the addition of software-based Desktop Window Manager rasterization, first introduced as part of Windows 8 build 7880.

File Explorer

User directories (Documents, Pictures, Videos, Music) are now present in the Computer system folder.

Bugs and quirks

User interface

File Explorer

The File Explorer shell may crash during a system shutdown.

Start screen

• The sorting drop-down menu in the start screen applications list may disappear after performing a search.
• The full applications list may persist within the Start screen if the user drags the screen to anywhere below its heading, in turn causing groups from both the Start screen pinned applications layout and the full applications list to overlap with each other.
• The start screen may not initialize properly after a logon, instead displaying a blank screen. It can be worked around by manually invoking it through the Windows/super key or via the Charms bar.

Charms bar

The settings charm has different colors on the tiles.

PC settings

• The search box does not work in this build.

Miscellaneous

• Desktop Window Manager window transition animations do not fade in/out correctly.
• USB input devices may cease to function if the host machine undergoes an extended sleep period. The only way to resolve this is by removing and re-inserting the affected devices.
• Metro applications in the Microsoft internal release do not function by default due to a time-related issue that prevents them from installing properly, which is discussed later in the article. They must therefore be re-registered within an appropriate time period in order to function properly. To re-register the affected applications, change the date and time to some point in 2013 and invoke the below command in an elevated PowerShell window:

  Get-AppxPackage -AllUsers | foreach {Add-AppxPackage -Register "$($_.InstallLocation)\AppxManifest.xml" -DisableDevelopmentMode}
  

Findings in Microsoft internal release

Summary

The eMMC dump for the Microsoft internal release of this build, sourced from a Samsung Ativ Tab prototype unit owned by Microsoft's UT division, includes a series of various internal development tools, of which primarily relate to hardware and driver development, as well as those related to the Windows on ARM self-hosting program. The disk image itself is mostly unmodified from its original installed state, save for some version information present in the WULogs directory, leftover event logs and two photographs of an otherwise-unidentified Microsoft employee concealing their face with a MacBook located within the test user account's Pictures directory. The included test user account in the disk image dump lacks a password.

The main operating system partition is marked as "encrypted" by BitLocker Drive Encryption, although the actual contents of the NTFS partition are not encrypted - the associated partition's encryption VMK is likely stored in a plaintext format. The original installation and WinRE images are present in the device's two recovery partitions, formatted under the NTFS partition layout.

Internal logs related to the creation of WinPE images for this build reveal the official codename for the Ativ Tab, internally referred to as Wild Ginger (named after a widespread family of ginger plants).

By default, the system is configured to automatically run the Performance Trace Collection Tool on each logon/system startup, despite user-defined startup applications being disabled on ARMv7-based releases of Microsoft Windows.

Firmware-level real-time clock issues

Due to a real-time clock bug present within the device's UEFI system firmware, the installed build suffers from a number of time-related issues:

• the included set of inbox AppX applications in the build (including system applications such as the Windows Store, PC settings, Windows Photos and the Metro File Picker UI) failed to register properly during installation, preventing them from launching
• system product policies were improperly applied due to the operating system being installed far past its intended code signing validity period (in turn preventing the Software Protection Platform service from applying the Kernel-ExpirationDate value, responsible for defining the timebomb's expiration date), and;
• various files and directories in the disk image bear completely randomized file creation and modification dates - for instance, the system's initial installation date is defined as 16 July 2078, whereas certain items have date ranges between the year 1970 through 2111, and the system's date and time as of when the image was captured was set to 24 September 2056.

Based on Command Prompt logs found within the disk root and leftover application cache data for the built-in Bing News application, the operating system was first installed onto the prototype unit on 4 March 2013 at 3:49 PM (PT), and appears to have been last booted on 7 March 2013, nearly a week after this build was compiled.

Intent

The build itself appears to have been installed solely to debug a DRIVER_IRQL_NOT_LESS_OR_EQUAL bugcheck related to a near-field proximity driver, as well as to diagnose a hardware/software-level issue related to taking photographs with the Ativ Tab's camera and other issues related to specific USB 3.0/xHCI hardware. This is evidenced by the lack of a domain association towards Microsoft's internal corporate network, a missing self-host enrollment and the presence of the two aforementioned photographs, and Event Tracing for Windows logs relating to bugchecks for said proximity driver and trace files for xHCI debugging.

Windows on ARM Self-Host Program

The internal release notably includes a tool that allows Microsoft employees to enroll test devices into the Windows 8 Selfhost on WOA Program, referred to as the Selfhost Opt-in Tool - a predecessor to the mySelfhost program introduced in later development phases of Windows 8.1. Device enrollment requires employees to identify themselves by listing their username and associated domain in the corporate network and have a device meet a set of conditions to ensure full compliance with the program. Enrolling into the self-host program also enables access to an internal version of the Windows Feedback Tool, allowing employees to submit bug reports to a database hosted on a Team Foundation Server instance.

A separate utility called the Selfhost Verification UI is also included, acting as a litmus test for if a development device is eligible for self-hosting; employees may export logs related to their self-hosting eligibility status and send them to a support address on Microsoft's e-mail network, where they would then be instructed to utilize a potential resolution for full program compliance.

An AppX package for the Self-Host Scenario Manager (from Windows 8 build 8437.0 (fbl_dev_dp8), albeit mislabeled as an application package targeting a "Developer Preview 6" release) is also included as part of the disk image dump, but is not installed by default. Installing the application depends on the presence of a Windows Store developer license, which is present in the disk's contents. The Scenario Manager relies upon the presence a valid Windows Live ID, the authentication servers of which no longer exist as they were decommissioned as part of Windows 8.1's end-of-life servicing plan, which spanned between January through November 2023.

Gallery

Self-host enrollment tools

• 

  Windows on ARM Selfhost Opt-in Tool

• 

  Ditto, enrollment process

• 

  Selfhost Verification UI

• 

  Ditto, log spew

Internal Feedback Tool

• 

  Bug report type

• 

  Bug report information entry

• 

  Detail confirmation

IDW and Windows SDK build tools

A full set of internal developer workstation (IDW) tools and Windows SDK build tools are included as part of the image, in a similar fashion to Windows 8 builds 7927 (fbl_srv_wdacxml), 7955 (fbl_srv_wdacxml) and server build 8064 (fbl_srv_msp_std). Some of the IDW tools include (but are not limited to) the following:

• A complimentary Windows Store developer license (set to expire on 1 April 2013) and a tool to install it; located at \Tools\idw\WinStore
• The Data Set Management (DSM) Explorer, located as \Tools\idw\DSMExplorer.exe - shows internal metadata for existing devices as displayed in the Devices and Printers Control Panel sub-page. Metadata also used by Windows Update to deliver updates to specific hardware and software
• A self-contained version of the Internet Explorer web browser (Microsoft HTML Pad/Forms3 Trident) that makes use of the MSHTML rendering engine; located as \Tools\idw\mshtmpad.exe
• Tooling for running applications inside of an AppContainer (aka LowBox); located as \Tools\idw\LaunchLowBox.exe
• A disk editing tool; located as \Tools\idw\diskedit.exe

Development tools

Performance Trace Collection Tool

The image dump includes a variety of tools used to address issues on specific system functionality. These development tools primarily pertain to hardware and software diagnostics, but additionally include a series of test suites and tracing utilities, along with special tooling for Secure Boot debug policies.

The below tools are included as part of the image dump:

• ARMv7 ports of portions of the existing Sysinternals suite, dated May 2011 and June 2012 - featuring applications such as NotMyFault, Process Explorer and RAMMap
• Windows Store General Helper Tool/AppxDiag, used to collect and package information about potential installation issues with existing Windows Store/AppX applications and publish them onto an internal Microsoft share
• Connected Standby Tests/NetDiag - records information about the current power states of existing networking hardware
• Performance Trace Collection Tool - general Event Tracing for Windows suite that covers a range of potential issues, such as interface usability problems or hardware/driver functionality
• BitLocker EoW Performance Logger - records information about BitLocker Drive Encryption events, as well as general device information, and automatically publishes information to an internal Microsoft self-hosting share containing BitLocker diagnostics data
• Plug and Play Device Explorer (PnPExplorer) - displays verbose information about new and existing hardware device nodes, driver-related group policies, driver installation and event logs, Sysprep information, as well as in-box and OEM-supplied drivers present in the Windows side-by-side component store and existing DSM device metadata
• Print spooler tracing tools
• Secure Boot Debug Policy Applicator (version 6.2.8432.0 (winmain.120611-1243)) - used to enable Test Mode and allow unsigned application code to run on applicable WoA development kits through the use of a firmware-level code signing policy, appended onto the EFI firmware variables
• Windows Media Foundation DLNA Issue Tracing (version 6.2.8322.0 (fbl_multimedia_media.120413-1717)) - used to debug issues pertaining to Windows Media Player streaming functionality
• Mouse without Borders - allows a user to control up to four existing devices using a single keyboard/mouse combination
• Sensor and Audiovisual Debugging Kit (version 6.2.8514.0 (win8_rtm.120711-1900) - contains a set of tools related to diagnosing software-level issues with built-in sensor and audiovisual hardware, such as the KS Studio (used to assist in the implementation of software-level audio streaming filters)
  

  Kernel Stream (KS) Studio from Windows 8 build 8514
• HID Digitizer Information Tool (version 6.2.8417.0 (fbl_core1_soc.120520-1700)) - records packet data for touch inputs passed onto the hardware digitizer
• Office 2013 SQM Session Uploader (version 15.0.4401.1000)

Two separate internal releases of Debugging Tools for Windows (from Windows builds 6.2.8312.0 (fbl_esc_end_rel(oobla).120402-1213) and 6.2.9255.0 (fbl_esc_end_rel(oobla).121017-1159)) are also present in the provided disk image dump, the latter of which is directly pre-installed onto the disk root in the form of a self-contained folder dump.

Drivers and firmware images

The dump includes a set of device drivers and hardware abstraction layers for the Qualcomm Snapdragon S3 (APQ8060) SoC, along with debug images for the Ativ Tab system firmware (which includes the real-time clock bug) and firmware for the ST Microelectronics STM32f103 sensor, dated February 2013 and located within the woadrivers directory at the root of the disk. In addition, firmware update packages for both the Nvidia Icera modem driver (revision 3.00_9.2) and the Sierra Wireless AirPrime MC7700 modem (version 03.05.12.04; targeting AT&T mobile carriers) are included as part of the dump - these are located within the taef directory, also found at the disk root.

Gallery

Windows Setup

Out-of-box experience

• 

  Language and region settings

• 

  Product key prompt

• 

  End-user license agreement

• 

  Onboarding animation

• 

  Personalization

• 

  Wireless network setup

• 

  Privacy settings

• 

  Ditto, advanced settings

• 
• 
• 

  User account credentials

• 

  Finalization

Interface

• 

  Boot screen

Desktop UI

• 

  File Explorer

• 

  Internet Explorer 11

Metro UI

• 

  Start screen

• 

  Ditto, applications list

• 

  Ditto, personalization

• 

  Settings charm

• 

  Application snapping

Applications

• 

  Alarms

• 

  Calculator

• 

  Sound Recorder

• 

  Movie Moments

• 

  Ditto, edit mode

• 

  Ditto, video export

• 

  PC settings

• 

  Ditto, network subpage

Microsoft internal release

• 

  Desktop

• 

  PerfTrace

• 

  Ditto, autosave

• 

  Ditto, about dialog

• 

  Hardware Certification Kit/Tracing Tools installation client

• 

  Connected Standby Tests (NetDiag)

• 

  Plug and Play Explorer

• 

  WinDbg (from build 9255)

Photographs taken prior to publication

Interface

• 

  Desktop

• 

  Watermark

• 

  Deployment Image Servicing and Management tool

• 

  Ditto.

Miscellaneous

• 

  Ativ Tab prototype unit, back side