> want to be fancy
> want to call NtRegisterClassExWOW
> want to call NtUserCreateWindowEx
> opens user32.dll
> opens win32u.dll
mfw
> want to call NtRegisterClassExWOW
> want to call NtUserCreateWindowEx
> opens user32.dll
> opens win32u.dll
mfw
February 26, 2025 at 11:01 PM
> want to be fancy
> want to call NtRegisterClassExWOW
> want to call NtUserCreateWindowEx
> opens user32.dll
> opens win32u.dll
mfw
> want to call NtRegisterClassExWOW
> want to call NtUserCreateWindowEx
> opens user32.dll
> opens win32u.dll
mfw
it never really occurred to me that Wine rules count disassembly as well, I wonder how far that could be brought. scrolled too far through a memory hex dump and saw a single byte from user32.dll and now I'm banned forever
April 12, 2025 at 10:09 PM
it never really occurred to me that Wine rules count disassembly as well, I wonder how far that could be brought. scrolled too far through a memory hex dump and saw a single byte from user32.dll and now I'm banned forever
Wine est disponible en version 11.11. Cette version apporte SymCrypt à la place de TomCrypt, plus d’infos USER32 en mémoire partagée, des fenêtres superposées dans Wayland, des améliorations VBScript et divers correctifs ⬇️
www.winehq.org/news/2026061...
www.winehq.org/news/2026061...
www.winehq.org
June 14, 2026 at 8:43 AM
Wine est disponible en version 11.11. Cette version apporte SymCrypt à la place de TomCrypt, plus d’infos USER32 en mémoire partagée, des fenêtres superposées dans Wayland, des améliorations VBScript et divers correctifs ⬇️
www.winehq.org/news/2026061...
www.winehq.org/news/2026061...
Walking through a PowerShell keylogger, which uses some inline C# to snag Win32 API functions from user32.dll, and funnels back keys and system info to a Tor onion address -- a nifty little challenge from LetsDefend (now part of Hack The Box 🔥) Video: youtu.be/bF72IEGzniU
November 25, 2025 at 3:32 PM
Walking through a PowerShell keylogger, which uses some inline C# to snag Win32 API functions from user32.dll, and funnels back keys and system info to a Tor onion address -- a nifty little challenge from LetsDefend (now part of Hack The Box 🔥) Video: youtu.be/bF72IEGzniU
Time to start posting on here - I tweeted this on Saturday & it got 500+ likes, ON A WEEKEND!!
PowerShell to find out when a computer was last shutdown cleanly and why. Example is from AVD auto shutdown
get-winevent -FilterHashtable @{ ProviderName = 'user32' ; id =1074 } -MaxEvents 1|ft -wrap
PowerShell to find out when a computer was last shutdown cleanly and why. Example is from AVD auto shutdown
get-winevent -FilterHashtable @{ ProviderName = 'user32' ; id =1074 } -MaxEvents 1|ft -wrap
October 22, 2024 at 1:22 PM
Time to start posting on here - I tweeted this on Saturday & it got 500+ likes, ON A WEEKEND!!
PowerShell to find out when a computer was last shutdown cleanly and why. Example is from AVD auto shutdown
get-winevent -FilterHashtable @{ ProviderName = 'user32' ; id =1074 } -MaxEvents 1|ft -wrap
PowerShell to find out when a computer was last shutdown cleanly and why. Example is from AVD auto shutdown
get-winevent -FilterHashtable @{ ProviderName = 'user32' ; id =1074 } -MaxEvents 1|ft -wrap
3/3 I've been struggling with Wine all night, but I keep getting the USER32.DLL error. But I'd rather learn to use Linux and Krita than go to Windows 11 full of spyware and AI nonsense
May 6, 2025 at 3:59 PM
3/3 I've been struggling with Wine all night, but I keep getting the USER32.DLL error. But I'd rather learn to use Linux and Krita than go to Windows 11 full of spyware and AI nonsense
🍷 Wine 11.11 introduces a bundled SymCrypt library, shared memory for USER32 window info, and layered windows in the Wayland driver. It also improves VBScript compatibility and resolves 25 bugs in various applications and games.
alternativeto.net/news/2026/6...
alternativeto.net/news/2026/6...
June 15, 2026 at 7:31 AM
🍷 Wine 11.11 introduces a bundled SymCrypt library, shared memory for USER32 window info, and layered windows in the Wayland driver. It also improves VBScript compatibility and resolves 25 bugs in various applications and games.
alternativeto.net/news/2026/6...
alternativeto.net/news/2026/6...
The shit I do for eyecandy man
![// This is TERRIBLE code, but LoadImage gives us a downscaled large icon which looks ugly
// on 96 DPI displays. If we load the 0th image from User32 directly, then we can get a
// proper 16x16 small icon for the default program icon, which looks crisp.
WCHAR szUser32Path[MAX_PATH] = {};
GetSystemDirectory(szUser32Path, MAX_PATH);
wcscat_s(szUser32Path, L"\\user32.dll");
wil::unique_hicon hIconDefault;
UINT uExtractIconResult = ExtractIconEx(szUser32Path, 0, nullptr, &hIconDefault, 1);
assert(1 == uExtractIconResult);](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:rklgpsjc3533artbu7imybg4/bafkreierpssxtyhbteattaxum7t4frbvfxgwfyw3afy4cifm3m25eyuuf4)
April 27, 2026 at 8:55 AM
The shit I do for eyecandy man
this is a classic! the first public signs of this system were included in winvos 22621:
HELLO!
The OS is booted to RunLevel 3 (CLIENTCORE).
Services are STARTED at this run level.
All OneCore compliant apps can run.
GUI apps (that depend on user32 and gdi only) can run.
..
'njoy.
HELLO!
The OS is booted to RunLevel 3 (CLIENTCORE).
Services are STARTED at this run level.
All OneCore compliant apps can run.
GUI apps (that depend on user32 and gdi only) can run.
..
'njoy.
May 2, 2025 at 7:26 PM
this is a classic! the first public signs of this system were included in winvos 22621:
HELLO!
The OS is booted to RunLevel 3 (CLIENTCORE).
Services are STARTED at this run level.
All OneCore compliant apps can run.
GUI apps (that depend on user32 and gdi only) can run.
..
'njoy.
HELLO!
The OS is booted to RunLevel 3 (CLIENTCORE).
Services are STARTED at this run level.
All OneCore compliant apps can run.
GUI apps (that depend on user32 and gdi only) can run.
..
'njoy.
I spent ages on trying to diagnose this, "perhaps something during init is changing the cursor?" was one thought.
The docs (learn.microsoft.com/en-us/window...) call this cursor IDC_APPSTARTING.
I first set a breakpoint on user32!SetCursor looking at every caller, and what was being passed to it.
The docs (learn.microsoft.com/en-us/window...) call this cursor IDC_APPSTARTING.
I first set a breakpoint on user32!SetCursor looking at every caller, and what was being passed to it.
About Cursors - Win32 apps
This topic discusses the standard cursors.
learn.microsoft.com
December 2, 2024 at 3:55 AM
I spent ages on trying to diagnose this, "perhaps something during init is changing the cursor?" was one thought.
The docs (learn.microsoft.com/en-us/window...) call this cursor IDC_APPSTARTING.
I first set a breakpoint on user32!SetCursor looking at every caller, and what was being passed to it.
The docs (learn.microsoft.com/en-us/window...) call this cursor IDC_APPSTARTING.
I first set a breakpoint on user32!SetCursor looking at every caller, and what was being passed to it.
Poor Windows UI developers, not surprising people tend to build browser-based UI apps this days. Back in the days of user32 it was quite easy and fun to build native Windows GUIs.
Source: raphlinus.github.io/rust/gui/202...
Source: raphlinus.github.io/rust/gui/202...
June 23, 2025 at 8:32 AM
Poor Windows UI developers, not surprising people tend to build browser-based UI apps this days. Back in the days of user32 it was quite easy and fun to build native Windows GUIs.
Source: raphlinus.github.io/rust/gui/202...
Source: raphlinus.github.io/rust/gui/202...
completely. It works, and it gets me an icon that looks better, but I just feel it's a little hacky.
From what I've looked into, though, it seems I might be able to do this with learn.microsoft.com/en-us/window... and avoid hardcoding a path to user32.
From what I've looked into, though, it seems I might be able to do this with learn.microsoft.com/en-us/window... and avoid hardcoding a path to user32.
April 28, 2026 at 5:53 AM
completely. It works, and it gets me an icon that looks better, but I just feel it's a little hacky.
From what I've looked into, though, it seems I might be able to do this with learn.microsoft.com/en-us/window... and avoid hardcoding a path to user32.
From what I've looked into, though, it seems I might be able to do this with learn.microsoft.com/en-us/window... and avoid hardcoding a path to user32.
this is how it feels today
Windows 11's user32.dll as raw audio and video (binary waterfall)
YouTube video by nario
youtu.be
July 2, 2026 at 10:09 AM
this is how it feels today
There was apparently an update to user32.dll recently in #Win11 and you can no longer forward the wm_input message to a different process because you will get an invalid handle error if you try to read from it. I have no idea if that was intentional but it broke things. #Windows #Pinvoke
January 23, 2025 at 9:57 PM
Any of y'all handy with reverse-engineering the Win32 API? I'm trying to suss out what calls are happening in SystemSettings.exe within 'Accessibility > Mouse pointer and touch' when the mouse pointer style changes
I know a call to User32.dll,SystemParametersInfoA() is made, but not which params...
I know a call to User32.dll,SystemParametersInfoA() is made, but not which params...
August 10, 2024 at 3:02 AM
Any of y'all handy with reverse-engineering the Win32 API? I'm trying to suss out what calls are happening in SystemSettings.exe within 'Accessibility > Mouse pointer and touch' when the mouse pointer style changes
I know a call to User32.dll,SystemParametersInfoA() is made, but not which params...
I know a call to User32.dll,SystemParametersInfoA() is made, but not which params...
clang-cl /DWINVER=0x0400 /D_WIN32_WINNT=0x0400 -m32 -Wno-nonportable-include-path /IC:\MSVC6\VC98\Include hello.c -fuse-ld=lld-link /link /SAFESEH:NO /SUBSYSTEM:WINDOWS,4.0 /LIBPATH:C:\MSVC6\VC98\Lib user32.lib kernel32.lib msvcrt.lib
January 10, 2026 at 7:59 PM
clang-cl /DWINVER=0x0400 /D_WIN32_WINNT=0x0400 -m32 -Wno-nonportable-include-path /IC:\MSVC6\VC98\Include hello.c -fuse-ld=lld-link /link /SAFESEH:NO /SUBSYSTEM:WINDOWS,4.0 /LIBPATH:C:\MSVC6\VC98\Lib user32.lib kernel32.lib msvcrt.lib
I've never understood why Task Manager destroys and recreates its window when you toggle Always On Top. This is unnecessary, just call user32.dll:SetWindowPos(…, HWND_TOPMOST) and don't destroy anything. MS even preserved this behavior when they rewrote the Win8–10 one for Win11 using WinUI2.
August 5, 2026 at 11:30 PM
I've never understood why Task Manager destroys and recreates its window when you toggle Always On Top. This is unnecessary, just call user32.dll:SetWindowPos(…, HWND_TOPMOST) and don't destroy anything. MS even preserved this behavior when they rewrote the Win8–10 one for Win11 using WinUI2.
This code is retrieving the default program icon from Windows, which is supposed to be a standard icon that any program can access. This is also, and always has been, and probably always will be, the first icon in the user32.dll library from the OS.
April 28, 2026 at 5:53 AM
This code is retrieving the default program icon from Windows, which is supposed to be a standard icon that any program can access. This is also, and always has been, and probably always will be, the first icon in the user32.dll library from the OS.
The problem with that API is that it only takes a path to an icon library DLL and a resource offset, which technically isn't the right way to do this. While this icon can be accessed as the 0th (or "-100") resource ID from user32.dll, the standard icon identifier IDI_APPLICATION is something else...
April 28, 2026 at 5:53 AM
The problem with that API is that it only takes a path to an icon library DLL and a resource offset, which technically isn't the right way to do this. While this icon can be accessed as the 0th (or "-100") resource ID from user32.dll, the standard icon identifier IDI_APPLICATION is something else...
Nice lib, concise with a very smart design!
I’m a Registry kinda guy for Windows apps, though. I will likely take some of your ideas and make a lib! Maybe even put it out on GitHub.
I have a nice WinUtils lib too for Native Window Operations (the low level stuff in user32.all like SendMessage).
I’m a Registry kinda guy for Windows apps, though. I will likely take some of your ideas and make a lib! Maybe even put it out on GitHub.
I have a nice WinUtils lib too for Native Window Operations (the low level stuff in user32.all like SendMessage).
April 17, 2025 at 5:51 PM
Nice lib, concise with a very smart design!
I’m a Registry kinda guy for Windows apps, though. I will likely take some of your ideas and make a lib! Maybe even put it out on GitHub.
I have a nice WinUtils lib too for Native Window Operations (the low level stuff in user32.all like SendMessage).
I’m a Registry kinda guy for Windows apps, though. I will likely take some of your ideas and make a lib! Maybe even put it out on GitHub.
I have a nice WinUtils lib too for Native Window Operations (the low level stuff in user32.all like SendMessage).