Microsoft Longhorn Theme Format & Aero

Discuss Windows Vista/Server 2008 to Windows 10.
Post Reply
Lucas Brooks
FTP Access
Posts: 763
Joined: Sat Oct 20, 2018 11:37 am
Contact:

Microsoft Longhorn Theme Format & Aero

Post by Lucas Brooks »

Microsoft Longhorn Theme Format & Aero

I did a bit of research on Longhorn's theme format, and figured out some things perhaps never fully documented before. I wrote a .msstyles decompiler, that can turn compiled packthem v4 themes into .INIs and resources (like Windows XP themes).

Theme Format

Overview
The theme format (.msstyles) changed fundamentally compared to Windows XP, even with the earliest leaked build of Microsoft Longhorn. The underlying principles of the theme format, however remained the same. A theme can have multiple sizes and color schemes defined, and the theme engine will load your desired size/color scheme.

The biggest difference between the two is Microsoft Longhorn themes are mostly binary, whereas Windows XP themes are largely plaintext. I guess Microsoft moved to a binary format for performance improvements and to prevent unauthorized modifications/decompilation.

In Windows XP, the information about a theme (name, author, date, blah blah blah), sizes and color schemes are defined in themes.ini. In Longhorn, they are mostly in a VARIANT called RMAP. VARIANT is the binary representation of INI. The size and color scheme names are in a plain binary image named VMAP (Variant Map). The actual theme files are stored as VARIANTs and they are named as SIZE + COLOR SCHEME.

VARIANT files are headerless, and can be broken into individual sections. Each section is equivalent to a line in an INI file, and contains name, type, class ID, part ID, and state ID. The class ID will be used by the theme engine to work out which class that section belongs to, and class names are stored in a binary image named CMAP (Class Map). The part ID will be compared against the values defined in STBL to work out the part (like checkbox, background) that section belongs to. Finally, the state ID will again be used to work out the state (like normal, hovered or pressed) each section represents. Class ID will always be interpreted as something, and the rest can be zero. It looks a bit like this:

Code: Select all

[class.part(state)]
name = value
There are a few basic types defined in STBL (like int, bool, font, etc.), each with a different size (some are variable). Finally, the theme resources such as bitmaps and streams are referred by the VARIANTs as IDs, instead of names like in Windows XP. I believe the theme compiler automatically assigns resource IDs upon the compilation of a theme file.


Theme Decompilation/Porting to Windows XP
Most Longhorn themes were ported to Windows XP by replacing Luna's resources with ones from Longhorn themes. Since I now have a working theme decompiler, a better way to port those themes is to decompile them back to INIs and recompile with the leaked Windows XP packthem app. This way you can get perfect results without the need of Longhorn's uxtheme.dll. Of course, the Windows UI changed a lot, and later themes like Slate, Jade or Aero will have to be adapted to work on Windows XP. Early versions of Plex can be recompiled easily, and works perfectly on Windows XP:

Image

Download


Jade does not look as good as 3683's Plex:

Image

Image


Post-reset's Aero:

Image



Interesting Things

UseComposition
Noticed a bool called UseComposition under [globals] in Jade, and is set to FALSE. Change it to TRUE and DWM will be automatically turned on when you apply the theme. It will also automatically enable DWM upon boot. For that PDC demo build, pretty sure this is how DWM was automatically enabled upon logging in.

DemoCheck
When I decompiled the code responsible for Preview Pane Aurora, I found that it actually performs 2 checks to make sure people outside of Microsoft cannot enable it. The first one is the theme name, which must be Aero. The second one is very interesting, it passes as long as you are not using the actual private Lab06 Aero theme - the case for everyone basically, and this is why we can actually enable the Aurora.

The second check is performed by a function in uxtheme.dll called ApplyTheme. That function is also known as ThemepDemoCheck internally. It checks for the existence and accessibility of a file defined by the DemoCheck property under [documentation]. That file is normally located on Microsoft's network share, so nobody outside of Microsoft can access it. This means if the Aero theme .msstyles somehow leaks to the public, it will not give you APPA - in fact, it won't even be treated as a valid theme so you cannot even apply it.

As mentioned earlier, the only theme with that DemoCheck string is the private Aero theme, and this is why you can enable APPA using an edited Jade theme. ThemepDemoCheck is performed every time a theme selected, and the theme will not apply if it fails. Microsoft of course didn't want public themes like Slate, Jade and Luna to not work, so they made the check fail only if the theme contains the DemoCheck documentation property, and it as a path name isn't accessible/does not exist. This means it will pass for all public themes, and APPA will render as long as there is a valid BAML defined under [PreviewPane.Aurora].

If you somehow have a copy of the private Aero theme, you will see the following error upon selecting it:

Image

Microsoft wouldn't be Microsoft if they didn't leave a backdoor. To bypass it, you can simply create the REG_DWORD HKLM\Software\Microsoft\Windows\CurrentVersion\ThemeManager\DemoCheckOverride and set it to 64222 (0xFADE).

Desktop Aurora

For M7 builds, in STBL01 you can see the following three lines:

Code: Select all

1,DESKTOPBACKGROUND
1,DESKTOPBACKGROUNDPARTS,,ENUMDEF,ENUMDEF
1,AURORA,DESKTOPBACKGROUNDPARTS,ENUMVAL,1,0
This means it is possible for a theme to have a section heading named [DesktopBackground.Aurora]. If the BAMLSTREAM under [PreviewPane.Aurora] gives Preview Pane Aurora, it is logical to conclude that Desktop Aurora can also be enabled. What comes under that heading is unknown, but there is the possibility that Desktop Aurora was never fully implemented, as it wasn't showcased in any demo builds.

Aero Theme

I don't believe anyone patched Jade to utilize UseComposition yet, so I made an Aero theme (for 4074) that enables DWM upon boot, and is capable of drawing Glass frames without the need of desksrv.dll resources. Of course, to make it as close to the actual private Aero theme as possible, I've also added DemoCheck to [documentation], which means it will throw that access denied error. Make sure you add the registry entry before applying it. Download here.

Image






-----
I am having a headache so I'll write up whatever else I researched later. Meanwhile, some screenshots of a theme-related project I worked on:
Image

Image

BetaLH
User avatar
FTP Access
Posts: 49
Joined: Fri Mar 18, 2011 4:50 pm
Location: Japan

Re: Microsoft Longhorn Theme Format & Aero

Post by BetaLH »

This is very interesting stuff!
Spec: Intel Core i7 870(2.93GHz 4C8T), 16GB(1333MHz DDR3), NVIDIA GeForce GTX 570(GDDR5 1.2GB,732MHz), 1.5TB(WD15EARS x2),120GB(HGST)
OS: Windows7 Home Premium 64Bit SP1
Image

dixieLH
User avatar
Posts: 178
Joined: Mon Apr 12, 2021 8:59 pm

Re: Microsoft Longhorn Theme Format & Aero

Post by dixieLH »

it won't even be treated as a valid theme so you cannot even apply it
i get this error on 4042 lab06 build for plex skin, which was weird to me
then again i had to upgrade from 4029 so who knows what was broken during process :P

Googulator
FTP Access
Posts: 82
Joined: Thu Oct 12, 2017 3:46 pm

Re: Microsoft Longhorn Theme Format & Aero

Post by Googulator »

By any chance, doesn't [DesktopBackground.Aurora] contain the resources for Aero Stars? If so, it should be possible to patch in the actual Desktop Aurora resource and get true Desktop Aurora using MILDesktop.

Lucas Brooks
FTP Access
Posts: 763
Joined: Sat Oct 20, 2018 11:37 am
Contact:

Re: Microsoft Longhorn Theme Format & Aero

Post by Lucas Brooks »

That section isn't referenced anywhere. I believe the check for Aero Stars is in System.Windows.Explorer as native code, or somewhere in MILRender. I gave Desktop Aurora multiple attempts, but I cannot get a .NET window to draw behind desktop icons.

Here is the best result I got so far: https://cdn.discordapp.com/attachments/ ... /video.mp4

Googulator
FTP Access
Posts: 82
Joined: Thu Oct 12, 2017 3:46 pm

Re: Microsoft Longhorn Theme Format & Aero

Post by Googulator »

Aero Stars also doesn't draw behind desktop icons; it simply causes icons to not show at all. Actually drawing icons on top of Aero Stars / Desktop Aurora was AFAIK never implemented.

Lucas Brooks
FTP Access
Posts: 763
Joined: Sat Oct 20, 2018 11:37 am
Contact:

Re: Microsoft Longhorn Theme Format & Aero

Post by Lucas Brooks »

Is there a message that you can send the shell or something to create a WorkerW to be able to draw behind desktop icons like in modern versions of Windows? I tried setting pretty much every window desktop-related as parent. I believe some third party programs can set videos as desktop background in Windows XP, not sure if the same code works in Longhorn.

Funny how Desktop Aurora (designed for Longhorn) is very easy to achieve on Windows 10, compared to Longhorn itself.

By the way, Googulator, do you still have the two XAML files you recreated for 4093? I can't really work out what exactly is required for DWM to work, apart from the basic structure of the XAMLs.

Googulator
FTP Access
Posts: 82
Joined: Thu Oct 12, 2017 3:46 pm

Re: Microsoft Longhorn Theme Format & Aero

Post by Googulator »

I'll have to spin up my Longhorn test machine to get them. The good news is that I again have that machine in my possession; but don't expect the XAMLs to work wonders - I never actually got DWM to draw windows or anything, it's just a plain XAML that gets drawn *instead of* the desktop.

Post Reply