valinet’s gists

valinet / deploy.ps1

Created January 13, 2021 23:30

Windows 10 audit mode deployment script

	##########
	# Win10 Initial Setup Script
	# Author: Disassembler <disassembler@dasm.cz>
	# Version: 1.4, 2016-01-16
	##########

	# Ask for elevated permissions if required
	If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
	Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
	Exit

valinet / StartupOnce.bat

Created January 13, 2021 23:32

Windows 10 deployment script that runs once for each newly created user account.

	echo Y\|del %appdata%\microsoft\windows\recent\automaticdestinations\*
	rem Start Firefox
	"C:\Program Files\Mozilla Firefox\firefox.exe"
	rem Uninstall Photos
	powershell -command "Get-AppxPackage Microsoft.Windows.Photos \| Remove-AppxPackage"
	rem Set region to Romania, regional format to Romania, add Romanian keyboard
	powershell -command Set-Culture -CultureInfo ro-RO
	powershell -command Set-WinHomeLocation -GeoId 0xc8
	powershell -command "$langs = Get-WinUserLanguageList; $langs.Add(\"ro-RO\"); Set-WinUserLanguageList $langs -Force"
	powershell -command "Set-TimeZone -Id \"GTB Standard Time\" -PassThru"

valinet / unattend.xml

Created January 13, 2021 23:33

Custom Windows 10 unattend.xml for Sysprep.

	<?xml version="1.0" encoding="utf-8"?>
	<unattend xmlns="urn:schemas-microsoft-com:unattend">
	<settings pass="windowsPE">
	<component name="Microsoft-Windows-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
	<UserData>
	<AcceptEula>true</AcceptEula>
	</UserData>
	</component>
	</settings>
	<settings pass="oobeSystem">

valinet / WinCenterTitle.xml

Created January 13, 2021 23:35

	<?xml version="1.0" encoding="UTF-16"?>
	<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
	<RegistrationInfo>
	<Date>2020-12-31T19:52:44.3288116</Date>
	<Author>DESKTOP-JIAP5UR\Administrator</Author>
	<Description>Center the text in windows' title bars.</Description>
	<URI>\WinCenterTitle</URI>
	</RegistrationInfo>
	<Triggers>
	<LogonTrigger>

valinet / toggle_clock_flyout.c

Last active October 12, 2023 01:31

An example showing an interesting technique necessary to toggle the clock flyout in the Windows 10 taskbar on the monitor containing the mouse

valinet / DumpStringTable.cpp

Last active December 18, 2024 08:54

DumpStringTable

	#include <Windows.h>
	#include <iostream>
	#include <io.h>
	#include <fcntl.h>

	BOOL EnumresLang(HMODULE hModule, LPCWSTR lpType, LPCWSTR lpName, WORD wLanguage, LONG_PTR lParam)
	{
	if (lpType == RT_STRING)
	{
	const HRSRC res = FindResourceEx(hModule, lpType, lpName, wLanguage);

valinet / toast2.c

Last active June 10, 2026 18:35

Send a toast notification in Windows 10/11 using plain C including COM activator

	#include <initguid.h>
	#include <Windows.h>
	#include <roapi.h>
	#include <Windows.ui.notifications.h>
	#include <notificationactivationcallback.h>
	#include <tchar.h>
	#include <stdio.h>
	#pragma comment(lib, "runtimeobject.lib")

	DWORD dwMainThreadId = 0;

valinet / WhSignalDrv.c

Created June 22, 2024 17:02

Exmple of DLL and driver that signal Windhawk to scan for new processes

	// Example of a driver that helps Windhawk
	// inject processes created by inaccessible processes early on
	// ==========================================================================
	// Valentin-Gabriel Radu, valentin.radu@valinet.ro
	//
	// Upstream issue:
	// https://github.com/ramensoftware/windhawk/issues/197
	//
	#include <ntifs.h>
	#define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1)

valinet / uaskmgr.c

Last active May 25, 2026 15:39

Task Manager Image File Execution Options Launcher

	// cl /nologo uaskmgr.c advapi32.lib kernel32.lib user32.lib /O1 /GS- /Gs9999999 /GF /kernel /link /ENTRY:main /NODEFAULTLIB /SUBSYSTEM:windows /NOCOFFGRPINFO /ALIGN:16 /MERGE:.rdata=.text /MERGE:.pdata=.text /OUT:uaskmgr.exe

	#include <Windows.h>

	int main() {
	char map = 0;

	PROCESS_INFORMATION pi;
	STARTUPINFOW si;
	for (int i = 0; i < sizeof(si); i = i + 2)

valinet / local_spawn.c

Last active May 17, 2026 15:40

Launch processes from SSH into the logged in user session

	// cl /nologo main.c kernel32.lib user32.lib advapi32.lib wtsapi32.lib userenv.lib /O1 /GS- /Gs9999999 /GF /kernel /link /ENTRY:main /NODEFAULTLIB /SUBSYSTEM:windows /NOCOFFGRPINFO /ALIGN:16 /MERGE:.rdata=.text /MERGE:.pdata=.text /OUT:local_spawn.exe

	#include <Windows.h>
	#include <strsafe.h>
	#include <TlHelp32.h>
	#include <wtsapi32.h>
	#include <UserEnv.h>
	#include <Lmcons.h>
	#ifndef _DEBUG
	#pragma comment(linker, "/NODEFAULTLIB")

	/*
	* Example showing an interesting technique necessary to toggle the clock flyout
	* in the Windows 10 taskbar on the monitor containing the mouse
	*
	* Copyright (C) 2006-2021 VALINET Solutions SRL. All rights reserved.
	* License: GPLv2
	*/

	#include <Windows.h>
	#include <TlHelp32.h>

Valentin Radu valinet