Windows 7 VAN.dll running on Windows 10 21H2

I thought the start button was implemented in explorer.exe (CPearl). Very interesting that it would break by swapping stobject.

Made a windhawk mod that hooks pnidui.dll's showminiflyout and makes it run win7 van instead, easiest way to do it in windhawk

// ==WindhawkMod==

// @id              win7-van-restore

// @name            Restore windows 7 network flyout

// @description     Hooks showminiflyout in pnidui.dll to call RunVANUI instead

// @version         0.1

// @author          wiktorwiktor12 for WH mod, joleman11 for original discovery

// @include         explorer.exe

// @compilerOptions -lcomdlg32

// ==/WindhawkMod==



#include <Windows.h>

#include <shellapi.h>

#include <stdio.h>

#include <windhawk_utils.h>



//public: void __cdecl CVanUI::HideVanUI(void)

inline void(__cdecl*HideVanUI)(void* _this);

inline HRESULT(*RunVANUI)(UINT param_1, int param_2, int param_3, int param_4, HANDLE param_5, int param_6);

inline __int64(__fastcall* ShowMiniFlyout_orig)(void* _this);



DWORD tickHid = 0;

const DWORD tickShowDelay = 250;



void HideVanUI_hook(void* _this)

{

   HideVanUI(_this);

   tickHid = GetTickCount();

}



__int64 __fastcall ShowMiniFlyout_hook(void* _this)

{

   UINT myMessage = RegisterWindowMessageW(L"Microsoft.VAN.Message");

   HWND v8 = FindWindowExW(0, 0, L"NativeHWNDHost", L"View Available Networks");

   if ( v8 )

   {

       if (GetTickCount() >= tickHid + tickShowDelay)

       {

           AllowSetForegroundWindow(0xFFFFFFFF);

           if ( PostMessageW(v8, myMessage, 0, 0) )

               return 0;

       }

       

   }



   if (GetTickCount() >= tickHid + tickShowDelay)

       RunVANUI(myMessage,5,0,0,(HANDLE)0x0,1);



   return 0;

}



const WindhawkUtils::SYMBOL_HOOK hooks[] = {

   {

       {

           L"private: long __cdecl CPniMainDlg::_ShowMiniFlyout(void)"

       },

       &ShowMiniFlyout_orig,

       ShowMiniFlyout_hook,

       false

   }

};



const WindhawkUtils::SYMBOL_HOOK hooks2[] = {

   {

       {

           L"public: void __cdecl CVanUI::HideVanUI(void)"

       },

       &HideVanUI,

       HideVanUI_hook,

       false

   }

};





// The mod is being initialized, load settings, hook functions, and do other

// initialization stuff if required.

BOOL Wh_ModInit()

{

   Wh_Log(L"Init");



   HMODULE pniduiModule = LoadLibrary(L"pnidui.dll");

   if (!pniduiModule)

   {

       Wh_Log(L"pniduiModule not found");

       return FALSE;

   }



   HMODULE vanModule = LoadLibrary(L"van.dll");

   if (!vanModule)

   {

       Wh_Log(L"vanModule not found");

       return FALSE;

   }



   RunVANUI = decltype(RunVANUI)(GetProcAddress(vanModule, "RunVANUI"));

   if (!RunVANUI)

   {

       Wh_Log(L"RunVANUI not found");

       return FALSE;

   }



   if ( !WindhawkUtils::HookSymbols(pniduiModule,hooks, ARRAYSIZE(hooks)) || !WindhawkUtils::HookSymbols(vanModule,hooks2, ARRAYSIZE(hooks2)) )

   {

       Wh_Log(L"Failed to hook one or more symbol functions");

       return FALSE;

   }



   return TRUE;

}



// The mod is being unloaded, free all allocated resources.

void Wh_ModUninit()

{

   Wh_Log(L"Uninit");

}

nvm, misinterpreted some things, it is just for the connecting animations

heres a little update on where i am, currently i replaced w10 xwizards.dll with w7 xwizards.dll, i used x64dbg to debug through the differences in execution on both a w7 machine and my w10 machine, i have found that there was a difference in HrGetWizardTypePluginCLSID in xwizards.dll,

 
this is HrGetWizardTypePluginCLSID, as you can see it accesses the registry, on windows 7, there are keys that are not in windows10, after importing them into the registry, i got the function to request the same reg keys as in windows 7, and then when i hit connect, the dialog did not pop up, but rather explorer itself crashed, some progress, going to now debug why it is crashing and fix it

i have gotten big progress, you can now connect to networks you have connected to before!

this dialog pops up and it connects

sadly, it only is working for networks you have connected to before, nothing happens when connecting to a new network

this was done by doing all the other stuff i've mentioned and replacing xwtpdui.dll with the one from windows 7, along with its mui, and editing the dui70.dll import to dui71.dll
i also replaced WLanConn.dll with the one from windows 7, however i don't think it is necessary for it
i suspect replacing xwtpdui.dll with the windows 7 one may break some things, so ideally it would be best to try and get it working by using a renamed one and replacing all appropriate references in the xwizard area of the registry to the custom one

xwtpdui.dll is being used i believe 

as you can see here, it is a type in the types in XWizards, not entirely sure what its purpose is but it is used as i can see it being loaded as a module in x64dbg

If you used a 7TSP pack please run this command in an elevated command prompt:
sfc /scanfile=%windir%\regedit.exe
For some reason 7TSP packs break 64 bit version of regedit hence forcing windows to use 32 bit version,making modifications to 64 bit keys not apply at all.

ah thanks for telling me, ye that would def be why