[Beta 探究] 预重置 Longhorn 的 Aero 主题

I guess you’ve all tested Longhorn build 4074 and its DWM before… if not, then this is a good opportunity for you to learn about the beautiful Aero theme. I’ll keep this post short by not documenting the entire Longhorn theme format here.

You may have seen various articles online about how to turn the Jade theme into Aero, but this one is different.

If you watched the video of that PDC 2003 demo before, then I am sure you’ve noticed that DWM was automatically turned on upon user logon… but how? It is not something you get by simply renaming jade.msstyles to aero.msstyles. After reverse engineering the theme format and some theme-related code, I figured out that theme files can actually be used to automatically enable DWM. Under the globals section of the Jade theme, there is a BOOL called UsesComposition, which happens to be FALSE. If UsesComposition is set to TRUE, then it’ll signal the theme manager to turn DWM on whenever the theme is applied. Since themes are applied during startup, DWM will be automatically enabled for themes with UsesComposition set to TRUE.

DWM Enabled at Startup

Another feature of the private Aero theme is the Animated Preview Pane Aurora (APPA). It is rendered using a BAML file defined under the PreviewPane.Aurora section of the Aero theme. It is actually in the Jade theme, but the BAML file is in an older format. We simply need to replace it with a BAML file in the newest format and then APPA will render correctly.

Animated Preview Pane Aurora

What you’ll see next with the jade.msstyles to aero.msstyles trick is obviously the green DWM window frame. There were two Aero themes, a public one called Jade and a private one called Glass. The difference is obvious, while both gemstones (if you consider glass as one) are translucent, jade is green and glass is clear. Needless to say, renaming a file isn’t going to get you Glass resources. We know that the private Aero theme had glassy-looking resources, but sadly they are currently unleaked. Luckily we do have Longhorn build 5048’s Aero Glass resources, which can be photoshopped to match those from the private pre-reset Aero theme. Once we replace those Jade resources with Glass ones, we will see the window frames being truncated:

Truncated Explorer Frame
Truncated Window Frame

Why? Because the size of each STREAM resource in the .msstyles file is hard coded in those VARIANT resources, and since Jade resources are generally smaller than Glass resources, the loader will only load and render the first portion of those Glass resources. This is why when you install a custom Aero theme, you’ll see almost entirely transparent window frames. Once we change those hard coded sizes to the sizes of our Glass resources, all window frames and other resources will render fine just like in the screenshots below:

Fully Rendered Explorer Frame
Fully Rendered Window Frame

After changing UsesComposition, replacing Jade resources with Glass ones and changing those hard coded sizes, we now have a theme that is very close to Microsoft’s private Aero theme. Although Microsoft kept the Aero theme super secret, they still feared possible leakages (despite what they did to protect it, the theme still leaked to people outside of Microsoft), so they came up with a way of disallowing people outside of Microsoft to use the theme. They implemented something called the DemoCheck that checks for the presence of a file on Microsoft’s network share. The concept is simple – if the file is found, then the person is someone working at Microsoft since they can access Microsoft’s network shares, else the person isn’t someone from Microsoft and shouldn’t be allowed to use the Aero theme. The path of that file is a string called DemoCheck under the theme documentation section. This is the error you will see if you attempt to apply the private Aero theme without access to Microsoft’s network share:

Error Message Indicating DemoCheck Failure

To make our reconstruction of the Aero theme as close to Microsoft’s private Aero theme as possible, we need to add the DemoCheck string to the theme documentation. Then we have a problem, how are we going to use the theme then? Well, they left a backdoor called DemoCheckOverride thinking that nobody would ever find out. All you have to do is browse to HKLM\Software\Microsoft\Windows\CurrentVersion\ThemeManager, create a Registry DWORD called DemoCheckOverride and set its value to 0xFADE (or 64222 in decimal).

Now we have a fully reconstructed Aero theme, but some other Aero features are still missing, namely the Aero Clock Sidebar tile, Aero/Jade Preview Pane gradients and the Aero Shell Folder icons. The resources for those features are all available in the WinHEC build (actually all builds since 4066), but the code for loading them got ifdefed out. Luckily Microsoft.Windows.WCPClient.dll can be patched to load those Aero resources, just like the one from that private demo build.

Slate-looking Clock Tile
Slate-looking Icon and Background Gradient
Aero-looking Clock Tile
Aero-looking Icon and Background Gradient

Desktop Aurora is a bit harder to fix, because it was compiled using an outdated XAML that contained runtime errors and Microsoft intentionally distorted it. It can be fixed by replacing the BAML inside Microsoft.Windows.WCPClient.dll with a working one, but unfortunately Microsoft either didn’t implement code for rendering it or they removed the code completely. I’ve written an app that renders the Desktop Aurora effects on top of the desktop background just like how Aero Stars are rendered, and here is a quick demo of it:

Download

Instead of providing a file here and there, I made a ‘feature pack’ or a ‘demo pack’ for the WinHEC build (4074). It is called RealAero and will be updated on a regular basis. You may download the latest version below:

Please make sure you browse to HKLM\Software\Microsoft\Windows\CurrentVersion\ThemeManager, create a Registry DWORD called DemoCheckOverride and set its value to 0xFADE (or 64222 in decimal). If you don’t then don’t come crying to me when you get the access denied error.

For Desktop Aurora, you need to download this program and double click to start it. It will work only if you have the above pack installed.

Needless to say, RealAero isn’t only for build 4074, other builds will be supported eventually. I am currently working on brining the Aero theme to M6 builds such as build 4039. Here are some pictures: