Function InjectExplorerTAP

ExplorerTAP/api.cpp:18–97

}

HRESULT InjectExplorerTAP(HWND window, REFIID riid, LPVOID* ppv) try
{
	TaskbarAppearanceService::InstallProxyStub();

	DWORD pid = 0;
	const DWORD tid = GetWindowThreadProcessId(window, &pid);

	wil::unique_process_handle proc(OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid));
	if (!proc) [[unlikely]]
	{
		return HRESULT_FROM_WIN32(GetLastError());
	}

	if (!DetourFindRemotePayload(proc.get(), EXPLORER_PAYLOAD, nullptr))
	{
		proc.reset(OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, pid));
		if (!proc) [[unlikely]]
		{
			return HRESULT_FROM_WIN32(GetLastError());
		}

		static constexpr uint32_t content = 0xDEADBEEF;
		if (!DetourCopyPayloadToProcess(proc.get(), EXPLORER_PAYLOAD, &content, sizeof(content))) [[unlikely]]
		{
			return HRESULT_FROM_WIN32(GetLastError());
		}
	}

	{
		const auto event = TAPSite::GetReadyEvent();

		// InitializeXamlDiagnosticsEx pins the DLL forever in the target process - so we can discard the hook once it happens
		// this has the bonus effect that if InitializeXamlDiagnosticsEx fails, the DLL gets unloaded.
		wil::unique_hhook hook(SetWindowsHookEx(WH_CALLWNDPROC, CallWndProc, wil::GetModuleInstanceHandle(), tid));
		if (!hook)
		{
			return HRESULT_FROM_WIN32(GetLastError());
		}

		static constexpr DWORD READY_TIMEOUT =
#ifdef _DEBUG
			// do not timeout on debug builds, to allow debugging the DLL while it's loading in explorer
			INFINITE;
#else
			35000;
#endif

		if (!event.wait(READY_TIMEOUT)) [[unlikely]]
		{
			return HRESULT_FROM_WIN32(WAIT_TIMEOUT);
		}
	}

	winrt::com_ptr<IUnknown> service;
	HRESULT hr = GetActiveObject(CLSID_TaskbarAppearanceService, nullptr, service.put());
	if (FAILED(hr)) [[unlikely]]
	{
		return hr;