A code should run only once per session with admin rights

[Anixx]

Is there a way for a mod to have some code to be executed only at start of WindHawk, with admin rights? There is no need to inject it in every process.

[m417z]

Windhawk wasn't designed for this, a better solution would be to just write a program and set it to run at startup. But it can be done. You can try something like this:

// ==WindhawkMod==
// @id              run-code-in-windhawk-service
// @version         0.1
// @author          You
// @include         windhawk.exe
// ==/WindhawkMod==

#include <stdio.h>

BOOL Wh_ModInit() {
    Wh_Log(L"Init " WH_MOD_ID L" version " WH_MOD_VERSION);

    int argc;
    PWSTR* argv = CommandLineToArgvW(GetCommandLine(), &argc);
    bool isService = argv && argc >= 2 && wcscmp(argv[1], L"-service") == 0;
    if (argv) {
        LocalFree(argv);
    }

    if (!isService) {
        // Not in the service, unload mod.
        return FALSE;
    }

    // Run some code.
    FILE* fp;
    if (fopen_s(&fp, R"(C:\Windows\hello.txt)", "w") == 0) {
        char message[] = "Hello world";
        Wh_Log(L"Writing \"%S\"", message);
        fwrite(message, sizeof(message) - 1, 1, fp);
        fclose(fp);
    }

    // Unload mod.
    return FALSE;
}

The code will run in the context of the Windhawk service. Note that any instability or crash will affect the Windhawk service, so use with care.

[Anixx]

Thank you very much, this is very interesting! Just in case, don't you know how to realize in a WindHawk mode the following C# code?

    private static void SetSectionSecurity(string sddl)
      {
          using (NtObject ntObject = NtObject.OpenWithType("Section",
              $@"\Sessions\{Process.GetCurrentProcess().SessionId}\Windows\ThemeSection",
              null, GenericAccessRights.WriteDac))
              ntObject.SetSecurityDescriptor(new SecurityDescriptor(sddl), SecurityInformation.Dacl);
      }

I tried to ask ChatGPT and GPT-4 to translate it to C++, but it did not work. I think, there should be also some header, which name I do not know.

[m417z]

It's not going to be the same amount of code in C++, but here's some code I found which may help:
https://github.com/gix/PresentationTheme.Aero/blob/2c582016ffb9c6e74e65a18a42adf5c1a1f1e3d3/Source/UxThemeEx/Sections.cpp

And these functions: ConvertStringSecurityDescriptorToSecurityDescriptor, SetKernelObjectSecurity.

[Anixx]

@m417z is it possible that you will add other languages as well in the future? I think, writing smething like this in, say, VB.NET would be a lot easier (the same as in C# technically but a bit more comfortable). C++ is just too complicated.

[m417z]

Maybe in the future. For now, if you have a way to write dlls in VB.NET, C#, or any other language, you can play with it and just load your custom dlls from C++ mods. Maybe it will make it easier for you to achieve what you need. You won't be able to submit such mods to Windhawk, but it can be an interesting experiment.