Superbar ENABLED In Windows 7 Build 6801

Yes, that’s right folks. The one and only Rafael Rivera has figured out how to enable the new taskbar in Windows 7 build 6801.  The taskbar was there the whole time, but protected by some rather interesting checks that I find quite entertaining.

  1. Must be a member of an allowed domain
    • wingroup.windeploy.ntdev.microsoft.com
    • ntdev.corp.microsoft.com
    • redmond.corp.microsoft.com
  2. Must not be an employee with a disallowed username prefix
    • a- (temporary employees)
    • v- (contractors/vendors)

So to break it down, you have to be on the Windows team in REDMOND and NOT a contract employee.  So most of the people who moderate over the Beta newsgroups would not have the new taskbar by default.  Bypassing it was suprisingly easy.  Anyway to read the full set of instructions, head over to Raf’s blog.

View: Rafael’s Blog Post

EDIT: Here is a copy of Rafael’s post as it seems his Blog is down at the moment:

During PDC ‘08, I was passed a note indicating that I should dig deeper into the bits to discover the snazzy new Taskbar. Upon cursory analysis, I found no evidence of such and dismissed the idea as completely bogus.

I got home and starting doing some research on a potentially new feature called Aero Shake when I stumbled upon an elaborate set of checks tied to various shell-related components, including the new Taskbar. To use these, what I call “protected features”, you must meet the following criteria:

  1. Must be a member of an allowed domain
    • wingroup.windeploy.ntdev.microsoft.com
    • ntdev.corp.microsoft.com
    • redmond.corp.microsoft.com
  2. Must not be an employee with a disallowed username prefix
    • a- (temporary employees)
    • v- (contractors/vendors)

Protected Feature Flowchart (click for full)

As checking against this criteria is potentially expensive, in terms of CPU cycles, the result of the check is cached for the duration of Explorer’s lifetime (per protected feature). The cached value is stored within a variable, space of which is allocated in the image’s initialized data section (.data).

Explorer does not initialize these variables at start and checks for a cached result for before performing any checks. I exploited this behavior by setting the initialized value in the image itself to 1 vice 0 to bypass all twelve checks.

Why not use a hook to intercept GetComputerNameExW / GetUserNameW?

I thought about building a hook to inject into the Explorer process upon start, but I grew concerned that legitimate code in Explorer that uses those functions to perform various legitimate tasks would malfunction. And I was lazy.

Can I has too? Plz?

Simply download a copy of a tool I whipped up for either x86 or x64 (untested thus far), drop it into your Windows\ directory and execute the following commands as an Administrator in a command prompt window:

  • takeown /f %windir%\explorer.exe
  • cacls %windir%\explorer.exe /E /G MyUserName:F (replacing MyUserName with your username)
  • taskkill /im explorer.exe /f
  • start unlockProtectedFeatures.exe

After changing the protected feature lock state, you can re-launch the shell by clicking the Launch button.


Screenshot of PDC ‘08 build with new Taskbar

Why did Microsoft do this?

I’m not sure why these features went into the main (winmain) builds wrapped with such protection. What are your thoughts?

Posted by: Chris123NT

Published on: November 2nd, 2008 at 7:41 PM

Posted in Windows 7

«
»

41 Responses to 'Superbar ENABLED In Windows 7 Build 6801'

Subscribe to comments with RSS or TrackBack to 'Superbar ENABLED In Windows 7 Build 6801'.

  1. November 2, 2008 at 8:19 pm

    FireRx:

    You the Man!

    that was very helpful. I will save that to my Windows 7 stuff folder or future beta builds. Thanks again!

  2. November 2, 2008 at 8:49 pm

    Retell:

    64bit Confirmed working, just make sure to run cd.. before running the commands. The original location upon CMD launch is c:\windows\system32, these commands need to be run from the windows folder.

  3. November 2, 2008 at 9:11 pm

    ExpliciTSainT:

    Looks like the websites down, is the file posted anywhere else?

  4. November 2, 2008 at 9:13 pm

    Not quite dead yet:

    HOLY HELL!

  5. November 2, 2008 at 9:37 pm

    me:

    thanks! I suspected it to be in the beta build, thinking back to the early vista beta days enabling the sidebar and gadgets and what not, looks like Microsoft caught on to these tricks and to make future beta versions of windows to be harder to crack by implimenting such rediculous security checks.

  6. November 2, 2008 at 9:45 pm

    me:

    BTW, you may need to set UAC to prompt for user action to run CMD with higher priveleges or you will get an error on running the first command.

  7. November 2, 2008 at 9:50 pm

    NoctheniK:

    Ok… so the sites are down can anyone post their username? Thanks

  8. November 2, 2008 at 9:54 pm

    NoctheniK:

    Ok wait, what am I talking about?
    takeown /f %windir%\explorer.exe
    cacls %windir%\explorer.exe /E /G MyUserName:F (replacing MyUserName with your username)
    taskkill /im explorer.exe /f
    start unlockProtectedFeatures.exe

    MyUserName means my username on the computer right? :P

  9. November 2, 2008 at 10:59 pm

    Chris123NT:

    Not quite dead yet: sup canuck? :P

  10. November 2, 2008 at 11:00 pm

    Chris123NT:

    NoctheniK: yes, it’s your username on the machine

  11. November 2, 2008 at 11:05 pm

    omega_man:

    Excellent work, and many thanks.

  12. November 3, 2008 at 12:06 am

    Superbar is available in Windows 7 Build 6801 at GeekSmack News:

    [...] Rafael and Chris123NT « Windows Mobile 6.5, Ad to Your Road [...]

  13. November 3, 2008 at 12:41 am

    NoctheniK:

    lol im not a noob :P but i sure sounded like one xD
    thanks!

  14. November 3, 2008 at 12:45 am

    Justin Holt:

    I just want to say that I am blown away by this discovery. If you find out any other unlockables in the pdc beta do tell.

  15. November 3, 2008 at 12:59 am

    me:

    what’s aero shake? lol let me guess, it’s Beryl’s and compiz’s wobbly windows.

  16. November 3, 2008 at 1:53 am

    JL:

    after i run unlockProtectedFeatures.exe and choose unlock Protected, nothing happen, i don’t have the new task bar =(

  17. November 3, 2008 at 3:00 am

    Chris123NT:

    No, Aero shake is something different, it lets you shake a window rapidly and the others will minimize, shake it again and they will come back.

  18. November 3, 2008 at 3:14 am

    Enabling Superbar in Windows 7 Build 6801:

    [...] 6801. The taskbar was there the whole time, but protected by some rather interesting checks that I find quite [...]

  19. November 3, 2008 at 4:52 am

    vajlent:

    I can’t make it work…?

  20. November 3, 2008 at 10:06 am

    Chris123NT:

    vajlent, make sure you’re running command prompt as an admin and that you’re executing all commands from C:\Windows.

    So your first command should be cd %windir%

  21. November 3, 2008 at 12:00 pm

    NoctheniK:

    ME: What Aero Shake does is allows you to shake your application windows furiously, to quickly minimize all other windows, at the same time experiencing a seizure in your hand. Watch the video here…
    http://www.istartedsomething.com/20081103/shake-up-your-windows-7-with-aero-shake/

  22. November 3, 2008 at 1:38 pm

    Dan:

    It gives me an error – unlockProtectedFeatures.exe has stopped working.

  23. November 3, 2008 at 2:13 pm

    Chris123NT:

    Dan, are you running the command from C:\Windows?

    Type cd %windir%
    then type the start unlockProtectedFeatures.exe

  24. November 3, 2008 at 2:22 pm

    Jash Sayani:

    Wow!! Trying it out now….

  25. November 3, 2008 at 2:33 pm

    Jash Sayani:

    http://i34.tinypic.com/s3cxtt.png

    Any Suggestions…?

  26. November 3, 2008 at 2:42 pm

    Chris123NT:

    Jash, are you running x86 or x64? That one is interesting, haven’t seen that happen with this patch yet.

  27. November 3, 2008 at 6:52 pm

    Nero:

    Jash Sayani try reinstalling Windows 7.

  28. November 3, 2008 at 7:37 pm

    MafiaLord91:

    I am having the same issue as Jash. I have a feeling that it has something to do with the second command.

  29. November 3, 2008 at 7:42 pm

    Chris123NT:

    did you guys do the second command correctly? Did it say it was successful?

  30. November 3, 2008 at 8:05 pm

    MafiaLord91:

    No it was not successful. I found a program that worked. It may be a problem with a space in the username. http://www.withinwindows.com/2008/11/02/flashy-windows-7-bits-protected-by-elaborate-scheme-workaround/ last few posts.

  31. November 6, 2008 at 8:11 am

    Jeremydd:

    WOW Thanks so much i thought it is only for 69xx build of windows 7 THE SUPERBAR thanks u very much WOW NICE BAR im very excited whoooooooooooooooo

  32. November 7, 2008 at 2:57 pm

    TexasDude:

    I’ve tried this several times with no success.. I’m getting the error Jash Sayani was having. here’s what I’m doing..
    Powershell -> runas Administrator, ran the takeown command with result “Success”, ran cacls command with result “Processed File”, taskkill ran fine, cd’d into %windir%, ran unlockprotectedfeatures.exe and- Windows Dialogue Box appears instantly with unlockedprotectedfeatures has stopped working. Not sure whats up.

  33. November 7, 2008 at 3:28 pm

    TexasDude:

    Ok, I did find a way around the problem. I ran all the steps down to the part where you run the “unlock” exe, and I made a copy of Explorer that resides in %windir% to a usb flash drive. I then run the unlock exe from the flash drive and let it patch the copied version of explorer. So now i can choose between the old or new explorer anytime i want. Just thought I’d share since I figured out another way.

  34. November 7, 2008 at 3:35 pm

    Texas:

    One last question, Does anyone know how to remove the Desktop Branding.. I ran these two guys:
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4]
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3]
    and it took my Desktop Branding from: [Windows 7 For Testing Purposes Only. Build 6801] to [Windows 7 Evaluation Copy. Build 6801].

    Just wanted to see if someone knew how.

  35. November 8, 2008 at 9:45 am

    enthusiast:

    How can I get the right computer name with a period (.) if periods aren’t allowed in the computer name?
    Sorry if that’s a way too dumb question, but really, I can’t get the cmd running as an Administrator
    with those allowed domains :S

  36. November 9, 2008 at 6:59 pm

    MafiaLord91:

    I have found out a reason why some might not be able to get this hack to work. I have a username with a space and it wasn’t working so I decided to try a username without spaces and the hack worked. I then deleted to new account and the new UI still works. So if you have a username with spaces then make a new Administrator account and apply the hack that way.

  37. November 11, 2008 at 8:12 pm

    TexasDude:

    Hey guys, been busy messing around with windows 7 and really enjoy the new stuff.. I did find a way to remove the desktop branding.. here’s some instructions and a simple download someone else came up with to get rid of that. be sure to read it all so you don’t leave stuff out.

    http://www.doeswhat.com/tutorialwhat/unlocking-special-features-and-taskbar-removing-30-day-trial-and-watermark-on-windows-7-build-6801/

    I also took a different approach to running the new explorer. I made a Explorer folder at %systemdrive%\Explorer, i then copied the moded one to that location. After that, I made a batch file that I suck in the Startup folder. The best part is being able to switch back at anytime by running a similar batch file to revert back to the original.

    Thanks guys for uncovering this stuff!

  38. November 11, 2008 at 11:48 pm

    Looking for the new Superbar in build 6801? « Tim Brazers Blog 8^):

    [...] Build 6933 has the Superbar in all its glory.  Build 6801 has it too.  It’s a pre-beta beta Superbar. [...]

  39. November 12, 2008 at 4:18 pm

    Kipsate:

    Didn’t worked for me, it says: cannot find unlockProtectedFeatures.exe!

  40. November 12, 2008 at 4:29 pm

    Chris123NT:

    That’s because you need to download it kip. The links are in the post.

  41. November 29, 2008 at 11:20 pm

    Nathanael:

    Thanks a bunch for the hack. It must just be me, or the program is as easy as it looks. I’m running the 32bit (x86) version of Windows 7 Build 6801. I downloaded the x86 link above of the ‘tool’ that was “whipped up.” I had trouble extracting it under Windows, so I used the Tugzip program to extract it and it extracted fine. I extracted the file to My Documents. Since it is an executable file, I opened it and it was very easy to install, and it took no more than 10 secs. It told me I had to reboot and viola! Once I logged in the new task bar was there. It’s a bit clunky, and huge, but right-click on the taskbar, choose ‘Properties’ and you can shrink the size of the icons on the taskbar thus shrinking the size of the taskbar. It works beautiful and hope this helps others.
    P.S. My comp specs if anyone cares or needs to know: HP Pavilion DV5-1159SE.

Leave a Reply