Restore Explorer "Exploring" Mode 1.4.0

[aubymori]

Changelog

• Introduce Vista tree initial state behavior
• Fix bug where setting "Explorer icon mode" to the Vista option didn't work

[m417z]

Submission review

Note: This review was done by Claude, and then refined manually. Due to the amount of submissions, doing a fully manual review for each pull request is no longer feasible. Thank you for understanding.

Please address the following issues. The items in the collapsed sections are optional, so it's your call whether to address them.

---

Most of the concerns are in the one new block — the TVM_VISTA branch added to CMemPropStore_Write_hook (restore-explorer-exploring-mode.wh.cpp:374-402). The icon-mode else fix and the settings-to-code wiring for the new dropdown look correct.

• The Vista mode writes a persistent registry value, which breaks reversibility. The new branch opens HKCU\...\Explorer\Modules\GlobalSettings\Sizer, reads PageSpaceControlSizer, flips lpData[4] = 1, and writes it back. That's a persistent change to a system-owned value — it isn't undone when the mod is disabled, so the tree stays "sticky-expanded" afterward until Explorer next overwrites it. A core Windhawk principle is that a mod's effects disappear on disable and it must not make persistent registry changes; the guidance is to hook the read instead of writing. Recommended fix: hook the read of PageSpaceControlSizer (RegQueryValueExW/RegGetValueW) and OR the bit into the returned buffer, or carry the "tree expanded" state in the mod's own storage (Wh_GetIntValue/Wh_SetIntValue) and apply it in-memory — either way nothing persists after disable. See mods that hook registry reads for this pattern: spoof-light-dark-theme.wh.cpp and app-theme-crash-fixer.wh.cpp.

• hkey is leaked (restore-explorer-exploring-mode.wh.cpp:378-384). RegOpenKeyExW succeeds but RegCloseKey(hkey) is never called, so this leaks a registry-key handle every time an explore-mode window writes ExpandInitialNav while in Vista mode — it accumulates over a session. The file already pulls in WIL, so wil::unique_hkey is the cleanest fix (or just add RegCloseKey).

• pszTreeMode is leaked on every settings change (restore-explorer-exploring-mode.wh.cpp:754). Wh_GetStringSetting(L"dont_store_tree_state") returns a string that must be freed, and unlike the sibling pszIconMode (freed on line 753) this one never is. Add Wh_FreeStringSetting(pszTreeMode), or read it via WindhawkUtils::StringSetting.

• Unchecked write to lpData[4] (restore-explorer-exploring-mode.wh.cpp:394). Offset 4 is written without verifying the value is at least 5 bytes. PageSpaceControlSizer is normally a large blob so this won't bite in practice, but if the value is ever missing/short/empty, LocalAlloc(LPTR, cbData) yields a buffer smaller than 5 and lpData[4] = 1 overflows it. Guard with if (cbData > 4) before the write. (This concern goes away entirely if you switch to hooking the read per the first item.)

Optional improvements

Minor polish — none of this affects users, so it's your call.

• Leftover blank lines at restore-explorer-exploring-mode.wh.cpp:136-137 where g_fDontStoreTreeState was removed.
• If you keep the LocalAlloc path, wil::unique_hlocal would match the RAII style already used elsewhere in the file (wil::unique_cotaskmem_string, wil::com_ptr).

[aubymori]

Applied most of the recommended changes. As for the Vista mode writing a persistent registry value, all it does is makes opening Explorer in explore mode enable the navigation pane for any future Explorer windows instead of just the one, as it was in Vista. After disabling the mod, hiding the navigation pane through the GUI is trivial.