Twinui Log

[Marieta Reeks]

Errorsrelated to twinui.dll can arise for a few different different reasons. For instance, a faulty application, twinui.dll has been deleted or misplaced, corrupted by malicious software present on your PC or a damaged Windows registry.

In the vast majority of cases, the solution is to properly reinstall twinui.dll on your PC, to the Windows system folder. Alternatively, some programs, notably PC games, require that the DLL file is placed in the game/application installation folder.

Do you have information that we do not?

Did our advice help or did we miss something?

Our Forum is where you can get help from both qualified tech specialists and the community at large. Sign up, post your questions, and get updates straight to your inbox.

Some users have encountered the application while working at the computer TWINUI, especially when opening various links and files. It is actually a core component of the Windows shell that has been available since Windows 8. Typically, TWINUI stands for Tablet Windows user interface. It is by no means a virus or malware. Basically, it is a library system that basically handles opening files and links for other programs.

However, in certain cases, users begin to think that TWINUI is some kind of virus. So, when you open a PDF file in your browsers, you can see the name TWINUI. Another option is the appearance of a Windows 10, 11 user interface error when all defaults for the program have been reset to display TWINUI as a means to open files. If this happens, you should back up your data or use a registry repair tool. However, there is no doubt that this is a system component and not a virus application.

To access TWINUI, click on Start and open the Run Console. Next, type regedit and press Enter, then locate the twinui.dll library and check all its components. You will see that all of the function names in the library refer to the Tablet Windows user interface or the Windows Touch UI. This, in turn, is a sign of the duality of Windows desktop mode and tablet mode.

DiskInternals Partition Recovery recovers all possible files and this application belongs to a professional one, so the reputation here is impeccable. Since the check is performed on each disk partition separately, you do not have to worry about the recovery results.

The disk imaging feature is also useful in this situation. It is free and you will receive a disk image that you can activate at any time. As a result, you can get a system with all your configurations and data on another device. A reliable and understandable Recovery Wizard (built into the program) will guide you through all the details and stages of recovery.

Step 5. Save, for this you just need to purchase a license without leaving your home and select a location to save the recovered folders and files. It is best to keep your information in a safe place to prevent overwriting of data and to keep your system secure.

As you are probably aware, Windows 11 has recently launched, and with it, a new radical design change. To keep it short, there are a couple of utilities that let you restore the old Windows 10 UI, one of which being ExplorerPatcher (there is also StartAllBack, for example).

One problem that was still unsolved was how to restore the functionality of the Windows 10 network, battery and language switcher flyouts in the taskbar. While volume and clock work well, and the language switcher is the one from Windows 11 at least, the network and battery ones just do not launch properly. So, what gives?

The desktop seems to set s_networkUXMode to 0. The lock screen sets that to 7 (also, it cannot be launched in desktop mode, it crashes for some other reason which needs to be investigated as well). There are also other interesting modes: the Windows 10 OOBE screen is 4, which looks quite funny when enabled instead of the regular one:

Exploiting the library search order by placing our custom library in the same folder as the target executable, with the name and exports of a well known library. ExplorerPatcher already does that by masqueraiding as dxgi.dll (DirectX Graphics Infrastructure) for explorer.exe and StartMenuExperienceHost.exe.

Looking on the list of imports from dxgi.dll for ShellExperienceHost.exe, similar to explorer.exe, it only calls DXGIDeclareAdapterRemovalSupport very early in the execution stage, so that is a viable option and candidate for our entry point.

So, considering the above, I will go with the first option. For ExplorerPatcher, this is advantageous as this is basically the same infrastructure as for the 2 other executables that are hooked (explorer.exe and StartMenuExperienceHost.exe), so it keeps the implementation rather tidy.

The disadvantage is that this is global, affects the entire executable address space, plus the symbol addresses change with each version compiled, so those have to be updated for every new Windows build somehow (ExplorerPatcher uses a combination of downloading the symbols for your current build from Microsoft and extracting the info from there, and hardcoding the addresses for some known file releases). This is used in ExplorerPatcher for the Win+X menu build function from twinui.pcshell.dll, the context menu owner draw functions still from there and for hooking some function calls in StartMenuExperienceHost.exe; this is usually a last resort method.

Pattern matching. This is the classic of the classics. Basically, you try to determine as generic of a strategy as possible to identify some bytes in your target function that is likely to work on future versions and that is unique to your function. If you are smart, you can pull it off, if you are lucky, it also resists more than one build.

On builds 22000.318 and 22000.346, first pattern yields 2 results, while adding the last one yields only the result we are interested in. Additionally, I patch only if I find a single match, as otherwise it is likely the file actually changed drastically.

So what next? From the way I toggle the Windows 11 WiFi list, I already have code that opens something that is a Windows.UI.Core.CoreWindow and waits for it to close. The principle would be simple here: when the network or battery flyout is invoked, kill ShellExperienceHost.exe if running, somehow signal the instance that will open that we want it to run in legacy mode, wait for the flyout to be dismissed by the user (using the infrastructure from above), and then kill ShellExperienceHost.exe again so that Windows 11 things still open normally.

After the flyout is dismissed, we make sure to delete the key, and then terminate ShellExperienceHost.exe, so that the new instance that will be launched eventually loads normally, in Windows 11 mode.

The dwID is what contains a HKL combined with a language ID. Its an entire theory that is kind of well explained here that you understand in one evening, you make use of it and then you quickly forget as its too damaging for the human brain to remember such over engineered complications:

For this, I instead obted to hack it away, by observing that edx is never changed beside that xor edx, edx. So, I just have to neuter that, and then set it myself and immediatly return from my CoCreateInstance hook. Like this:

3a8082e126