UI0Detect, WlS0WndH and a lie...

https://blogs.msdn.com/yvesdolc/archive/2009/09/11/ui0detect-wls0wndh-and-a-lie.aspx

 

In my prior to last entry, I took a shortcut: your Windows Service user interface can be seen on Windows Vista and still on Windows 7. But beware, it’s not by default, not without additional end user involvement and very likely to no longer be there under Windows 8!

It’s all about the Interactive Service Detection Windows Service (%SystemRoot%\System32\UI0Detect.exe) and theDLL injected in your service to detect if it displays anything in Session 0 (%SystemRoot%\System32\WlS0WndH.dll and %SystemRoot%\SysWOW64\WlS0WndH.dll)

Instead of trying to repeat the excellent work that Alex Ionescu did in his blog, let me highly advise you to take the time to read it. It’s a bit complex but very helpful to understand how this all works, even under Windows XP:

-          Inside Session 0 Isolation and the UI Detection Service - Part 1

-          Inside Session 0 Isolation and the UI Detection Service - Part 2

Let me finish by adding two things:

1.       This mechanism is very very likely not to be there any longer in Windows 8.
Please do upgrade your code.

2.       The CreateProcessAsUser() API might actually not be the best solution when you need more complex interface for your service. Both Services in Windows Vista and Impact of Session 0 Isolation on Services and Drivers in Windows Vista are being updated to reflect this. I’ll keep you updated.

¿Querían noticias? ¡Pues ahora, ya las tienen!