Tumbler

Your WinX folder configures nothing. Here is the proof.

The Windows 11 Win+X menu is seventeen entries compiled into a system DLL. The folder in your profile is a picker for those seventeen, not a definition of the menu. Tumbler is the receipts, plus tooling that tells you the truth instead of letting you burn an evening on a menu that was never going to change.

Research PowerShell Windows 11 No admin required

Get in touch

The Thing That Started This

It does not hand you Services.

Right-click the Start button. Windows 11 offers Disk Management, Computer Management, Device Manager, Event Viewer, Network Connections, Task Manager, Terminal, and Terminal (Admin). Somebody looked at a menu that exists for one reason, fast access to admin tools, put Mobility Center on it, and left off the console you open to find out why something will not start.

Fine. Add it yourself. It is your menu, in your profile, in a folder you own, on hardware you paid for. Drop a shortcut in, restart Explorer, get on with your life.

Explorer eats it. No error, no dialog, no event log entry. Your file sits there on disk being ignored while you restart Explorer for the fourth time wondering which character you fat-fingered.

Mechanism

Two gates, and the second one is the real one.

An undocumented hash

Every shortcut in those folders carries a 32-bit hash in its serialized property store. Explorer recomputes it from the target and compares. Wrong hash, or no hash, and your entry does not exist. None of it is documented and no API exposes it.

The salt is in cleartext

Sitting in the DLL, readable by anyone with a hex editor: a note telling you not to prehash links because that should only be done by the user. If you are going to lock a door, do not tape the key to it with a sign explaining who the key is for.

The correct hash is not enough

Compute a valid hash, write a byte-perfect shortcut structurally identical to the ones Microsoft ships, and Explorer still bins it. Twelve stock entries reproduce exactly. A thirteenth, built the same way, pointing at a file in the same directory, is silently dropped.

A table of seventeen

A few hundred bytes from that salt sit seventeen twelve-byte records: a hash, a flags word, a string resource id. Explorer hashes your shortcut, looks the answer up in that array, and draws the label it finds. No match, no menu item. That is the entire mechanism.

The shortcut files in your profile do not define the menu. They never did. The labels beside them are decoration too, since the text comes from the table's string resource, which is why a shortcut renamed "CopyTest" cheerfully rendered itself as "Event Viewer".

The Part That Should Annoy You

They shipped the label and built a gate in front of it.

services.msc hashes to a value that appears nowhere in that table. There is no shortcut you can write, no property you can set, no permission you can grant yourself and no hash you can compute that puts Services on that menu.

Meanwhile shell32.dll ships the label. The string "Services" is localised into every language Windows ships in, sitting in the same block as Computer Management and Event Viewer, the neighbours that made the cut. It is on your disk right now, translated, paid for, unused.

Microsoft built a user-writable configuration directory, in your own profile, that configures nothing.

Tooling

Ask the machine instead of guessing.

Import-Module .\src\Tumbler.psm1

# the table Explorer will actually accept, read off your own DLL
Get-WinXAllowedEntry | Format-Table Hash, Flags, Label -AutoSize

# does this target have any chance at all
Test-WinXTargetSupported -TargetPath "$env:SystemRoot\System32\services.msc"
# Supported : False

# what is in your profile, and whether each stored hash validates
Get-WinXEntry | Format-Table Group, Name, AppId, Valid

Add-WinXEntry and Remove-WinXEntry work within the seventeen: reorder the menu, delete entries you never touch, move one between groups. Handing them an unsupported target fails immediately with the reason instead of writing a file Explorer will ignore.

The Algorithm

Three things that cost real hours.

The target is not hashed as a filesystem path. It is canonicalised against known-folder GUIDs first, and the system folder has to be matched before the Windows folder or every System32 target canonicalises against the shorter prefix and every hash comes out wrong.
Arguments are concatenated onto the path with no separator. Not a space. Just jammed on the end.
The whole string is lowercased, salt included, even though the salt is stored mixed-case in the DLL. Use it verbatim and you will chase your tail for an hour.

A verification script recomputes the hash for every stock shortcut in your own folders and compares against what Microsoft stored there. On build 26200 it reproduces all twelve whose target is readable from the link, across eleven distinct identities. If that ever stops reporting a clean sweep, the algorithm moved and every claim in the repository is void until re-proven.

Can You Not Just Patch The DLL

You can. It is a chore with a monthly cadence.

It is the only route that exists, and the clean version is not even an insertion: repurpose the Mobility Center record, overwrite its hash, clear the laptop-only bit in its flags word, and shorten its label string. Thirteen bytes.

What you are signing up for is voiding a Microsoft Authenticode signature on a TrustedInstaller-owned file that is held open by three processes, having sfc /scannow call it corruption and put it back, having every cumulative update replace it, and recovering in safe mode when the offsets are wrong and Explorer crash-loops.

Tumbler patches nothing. It reads your profile and a system DLL, and writes only inside your profile. What it does instead is tell you, in about a second, that the thing you were about to spend an evening on is not possible, and that Computer Management has Services inside it two clicks away.

Status

Not publicly available.

Tumbler is a Locke Werks research project: a documented reversal of an undocumented Windows mechanism, plus the PowerShell module that makes it usable. The source is private.

It needs Windows 11 and PowerShell 5.1 or later, and no administrator rights. For access or a conversation about the findings, write to archon@lockewerks.com.