{"id":24244491,"url":"https://github.com/0xda568/uwd-oss","last_synced_at":"2025-03-04T15:44:40.424Z","repository":{"id":202461762,"uuid":"707424050","full_name":"0xda568/uwd-oss","owner":"0xda568","description":"DLL that hooks the ExtTextOutW API and hides the testsigning mode watermark","archived":false,"fork":false,"pushed_at":"2024-09-12T21:05:56.000Z","size":1632,"stargazers_count":28,"open_issues_count":3,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-14T22:52:46.533Z","etag":null,"topics":["detour","hooking","injeciton","ring-3","trampoline","watermark","windwos"],"latest_commit_sha":null,"homepage":"","language":"AutoHotkey","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xda568.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-10-19T21:45:05.000Z","updated_at":"2025-01-11T19:24:24.000Z","dependencies_parsed_at":null,"dependency_job_id":"8f401315-58e4-45a2-9d73-f23b4389f69c","html_url":"https://github.com/0xda568/uwd-oss","commit_stats":null,"previous_names":["0xda568/uwd-oss"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xda568%2Fuwd-oss","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xda568%2Fuwd-oss/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xda568%2Fuwd-oss/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xda568%2Fuwd-oss/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xda568","download_url":"https://codeload.github.com/0xda568/uwd-oss/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241876602,"owners_count":20035396,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["detour","hooking","injeciton","ring-3","trampoline","watermark","windwos"],"created_at":"2025-01-14T22:52:56.900Z","updated_at":"2025-03-04T15:44:40.401Z","avatar_url":"https://github.com/0xda568.png","language":"AutoHotkey","funding_links":[],"categories":[],"sub_categories":[],"readme":"# uwd-oss\n\nOpen source alternative to the Universal Watermark Remover.\n\n# Introduction\n\nThis is a sequel to my [Universal Watermark Remover reverse engineering writeup](https://github.com/0xda568/Universal-Watermark-Disabler-Reverse-Engineering). I analyzed the closed source-software and developed my own open source version of it, which you can find here.\n\nAfter I posted my reverse engineering article, the original developerof the universal watermark remover (@pr701) published the [original software source code](https://github.com/pr701/universal-watermark-disabler)\n\n# How does it work?\n\nThis oss implementation of the Universal Watermark Remover uses an IAT hook now.\n\nThe original software utilizes [COM-hijacking](https://www.ired.team/offensive-security/persistence/t1122-com-hijacking) and [DLL-Proxying](https://www.ired.team/offensive-security/persistence/dll-proxying-for-persistence) to inject a DLL into the explorer and to persist on the system. The DLL, then hooks [ExtTextOutW](https://learn.microsoft.com/en-us/windows/win32/api/wingdi/nf-wingdi-exttextouta) to suppress the display of the testsigning watermark.\n\nFor a deeper dive (especially for beginners), take a look at my reverse-engineering writeup.\n\n# Structure\n\n`uwd-oss/` - Contains the source of the DLL that hooks the display function\n\n`Installer\\ GUI/` - Source code of the installer GUI created by @DartVanya\n\n`old/` - This is an old stage of the project, which is very buggy on some Windows versions and tried to implement the DLL proxy exactly like the original uwd.\n\n# GUI installer on AutoHotkey\n\nAlso open source, written on AHK v1.1\n\n## Installation / Removal\n\nDownload compiled standalone installer for your OS from the releases. The EXE is packed with UPX.\n\n### Installation\n\nRun (accept UAC prompt if needed), click Install. Watermark should be gone.\n\n### Removal\n\nRun (accept UAC prompt if needed), click Uninstall.\n\n*****\n\n## Features\n\n- No need to restart Explorer or logoff.\n  - changes are applied immediately by inject/uninject dll into/from Explorer process and force redraw of the desktop\n- Script acquire TrustedInstaller privileges when making changes to the registry\n- Support both x64 and x86 (note: compiled x86 version cannot run on 64-bit OS)\n\n*****\n\n![installer_window](assets/installer_window.png)\n\n# Compability\n\nTested on Windows 11 23H2, removes Test Mode and Safe Mode watermarks.\\\nTo run installer script from source, clone repo and run UWD-OSS.ahk from admin IDE or from \"Run with UI Access\" menu (AutoHotkey v1.1 should be installed).\n\n# Credit\n\nMany thanks to @DartVanya for the GUI and for the improvements!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xda568%2Fuwd-oss","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xda568%2Fuwd-oss","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xda568%2Fuwd-oss/lists"}