Where's the new Windows 11 context menu queries from?

# Another slow one, yes

The original point of introducing a new menu system was to bla bla bla according to this blog. However, ...

# What happens when you right-click on item(s)

I have no idea where the right click operation is handled, where can I start from? I knew a lot happen in explorerframe.dll so I looked into that dll with IDA. Let's find a demangled symbol named *Right* in the Functions tab.

Found these two! The second one looks to be the destructor, let's looks into the first one.

src="https://i.imgur.com/1TvQu4u.png"

caption="Search result for the symbols named *Right*"

/>

As you can see, it looks like the one we should look into. Hmm, but how we can trace the calls down to the context menu manager if there is? Statically analyzing this can be a lot of work, why not use WinDbg for the runtime debugging.

Let's set breakpoints at functions named *ContextMenu* this time. The flyout itself looks to be WUX (Windows.UI.Xaml) so we also can assume it's located at somewhere in windows.ui.*.dll.

src="https://i.imgur.com/HQxqpBL.png"

caption="Xrefs of the method"

/>

Looking through these functions, what do you think is the function that loads commands for the default simple menu?

# The context menu manager

According to OleView.NET, it is implemented in Windows.UI.FileExplorer.dll, which is mainly developed for XAML in File Explorer. If I search for ContextMenu in the Names tab in IDA, yes, we find it. It's named ContextMenuPresenter.

class ContextMenuPresenter
    : IClosable
    , IInspectable
    , IOleWindow
    , IServiceProvider
    , IUnknown
    , IWeakReferenceSource
{
    // ...
}

Executive Summary

The ContextMenuPresenter class is responsible for creating and managing modern "curated" context menus in Windows File Explorer. The TryCreateMiniMenuFromClassic function serves as the primary bridge between legacy Win32 context menus and the modern XAML-based menu system. This report provides a detailed analysis of how the class initializes context menus and loads menu items from multiple sources.

Component Location

Source File: pcshell\shell\windows.ui.fileexplorer\src\ContextMenuPresenter.cpp
Header File: pcshell\shell\windows.ui.fileexplorer\src\ContextMenuPresenter.h

Class Responsibilities

The ContextMenuPresenter class is responsible for:

1. Menu Creation: Converting classic Win32 HMENU handles to modern XAML MenuFlyout items

2. Item Filtering: Removing unwanted or duplicate menu items from classic menus

3. Extension Integration: Loading and inserting app extensions into menus

4. Icon Management: Asynchronously loading menu item icons

5. Verb Management: Tracking canonical verbs and command IDs

6. Telemetry: Recording context menu usage analytics

---

Architecture: Shell View to Context Menu Presenter

Complete Call Chain from User Action

The context menu creation process follows a well-defined call chain from the shell view (DefView) to the context menu presenter:

User Right-Click Event
    │
    ↓
CDefView::DoContextMenuPopup (0x18029f6b0)
    │
    ↓
CDefView::_DoContextMenuPopup (0x1802b3204)
    │
    ├─► Desktop Spotlight Path (if enabled)
    │   └─► [Spotlight-specific handling]
    │
    └─► Standard Context Menu Path
        │
        ├─► IContextMenu::QueryContextMenu
        │   └─► Populates HMENU with classic items
        │
        └─► CDefView::DoCuratedContextMenu (0x18029f72c)
            │
            ├─► CDefView::TryGetContextMenuPresenter (0x1800a56a0)
            │   └─► IUnknown_QueryService → IContextMenuPresenter
            │
            └─► IContextMenuPresenter::DoContextMenu (vtable+0x20)
                └─► ContextMenuPresenter::DoContextMenuHelper (0x1800a9f8b)
                    └─► [Modern XAML flyout creation]

CDefView::DoContextMenuPopup

Address: 0x18029f6b0

Size: 0x73 bytes (115 bytes)

Purpose: Public interface method for showing context menus

This is the public entry point exposed through the COM interface. Acts as a simple wrapper that validates window state before delegating to the internal implementation.

Implementation:

HRESULT CDefView::DoContextMenuPopup(
    CDefView* this,
    IUnknown* punkSite,
    unsigned int flags,
    POINT pt)
{
    HWND hwnd = *(this + 68);  // Get view window handle
    
    if (hwnd && IsWindowVisible(hwnd))
    {
        // Call internal implementation with Mode = 0 (curated)
        return CDefView::_DoContextMenuPopup(
            this - 38,           // Adjust this pointer
            punkSite,
            flags,
            pt,
            0                    // Mode: 0 = Curated menu
        );
    }
    else
    {
        return E_UNEXPECTED;     // 0x8000FFFF
    }
}

Key Validation:

• Checks if view window exists and is visible
• Returns `E_UNEXPECTED` if window is not ready
• Adjusts `this` pointer for internal class layout
• Always passes `Mode = 0` for curated menu behavior

---

CDefView::_DoContextMenuPopup

Address: 0x1802b3204

Size: 0xe0b bytes (3,595 bytes)

Purpose: Core context menu orchestration and HMENU creation

This is the massive internal implementation that handles the complete context menu creation pipeline. It's one of the most complex functions in the DefView component.

Function Signature:

HRESULT CDefView::_DoContextMenuPopup(
    CDefView* this,
    IUnknown* punkSite,
    unsigned int flags,
    POINT pt,
    int mode                    // 0 = Curated, 1 = Classic
)

High-Level Flow:

_DoContextMenuPopup
    │
    ├─► 1. TELEMETRY & INITIALIZATION
    │   ├─► Start ContextMenuCreationTest telemetry
    │   ├─► Check Shift key state (add 0x100 to flags if pressed)
    │   └─► ETW event: Shell32_GeneratingContextMenu_Start
    │
    ├─► 2. DESKTOP SPOTLIGHT DETECTION
    │   ├─► Check Feature_DesktopSpotlightRightClickContextMenu
    │   ├─► Check location context == LOCATION_CONTEXT_DESKTOP (0x400)
    │   ├─► If Spotlight: Calculate flyout position from icon rect
    │   └─► Log Spotlight telemetry
    │
    ├─► 3. CURATED vs CLASSIC DECISION
    │   ├─► Call: ShouldShowMiniMenu(flags)
    │   ├─► TryGetContextMenuPresenter()
    │   ├─► IsReadyForNewContextMenu()
    │   └─► Set mode based on result
    │
    ├─► 4. CLASSIC MENU CREATION (IContextMenu)
    │   ├─► QueryInterface → IContextMenu
    │   ├─► Setup site if needed (CLauncherUIMode)
    │   ├─► CreatePopupMenu() → hMenu
    │   ├─► QueryInterface → IContextMenu3 (set 0x20000 flag)
    │   ├─► Add IDefaultFolderMenuInitialize restrictions
    │   ├─► SetContextMenuCapability()
    │   └─► IContextMenu::QueryContextMenu(hMenu, 0, 30977, 31487, flags)
    │       └─► Shell extensions populate the menu
    │
    ├─► 5. MERGE ADDITIONAL ITEMS
    │   ├─► Load "Open" menu from resources (0x104)
    │   ├─► SetMenuItemInfoW (custom text)
    │   ├─► Set shield bitmap if needed
    │   ├─► Shell_MergeMenus(hMenu, openMenu, ...)
    │   ├─► CItemsView::MergeSelectionContextMenu
    │   └─► _SHPrettyMenu(hMenu)
    │
    ├─► 6. DARK MODE SUPPORT
    │   ├─► Feature_FileExplorerDarkTheme check
    │   ├─► AllowDarkModeContextMenu()
    │   └─► SetDarkModeForWindows wrapper
    │
    ├─► 7. DISPATCH TO MENU TYPE
    │   ├─► If mode == 0 (Curated):
    │   │   └─► DoCuratedContextMenu(pContextMenu, hMenu, flags, pt)
    │   │       └─► [Calls ContextMenuPresenter]
    │   │
    │   └─► If mode == 1 (Classic):
    │       └─► DoClassicMenu(pContextMenu, hMenu, pt, shellItems)
    │           └─► [Traditional Win32 TrackPopupMenu]
    │
    └─► 8. CLEANUP
        ├─► DestroyMenu(hMenu)
        ├─► Release(pContextMenu)
        ├─► ETW event: Shell32_InvokingContextMenu_Stop
        └─► Complete telemetry test

Critical Decision Points:

Desktop Spotlight Detection:

if (Feature_DesktopSpotlightRightClickContextMenu::IsEnabled() &&
    (this->flags & 0x10000000) != 0)  // Spotlight context flag
{
    IShellItemArray* items = NULL;
    _GetItems(1, 0, IID_IShellItemArray, &items);
    
    if ((GetLocationContext(items) & 0x7FF) == 0x400)  // DESKTOP context
    {
        // Calculate Spotlight flyout position
        int itemIndex = GetItemIndex(-1, 1, 0);
        if (itemIndex != -1)
        {
            RECT rectItem;
            GetItemRect(itemIndex, &rectItem);
            
            pt = GetSpotlightFlyoutPosition(&rectItem, m_someFlag);
            
            if (Feature_DesktopSpotlightFlyoutPositionLogging::IsEnabled())
            {
                DesktopIconLayoutTelemetry::SpotlightFlyoutPositionLogging(
                    &rectItem, &pt);
            }
        }
    }
}

Curated Menu Decision:

bool shouldShowMini = ShouldShowMiniMenu(flags);
testData->shouldShowCuratedMenu = shouldShowMini;

if (shouldShowMini)
{
    IContextMenuPresenter* presenter = NULL;
    TryGetContextMenuPresenter(&presenter);
    
    if (presenter)
    {
        GUID testId = GetTestId();
        if (!presenter->IsReadyForNewContextMenu(&testId, pt))
        {
            // Presenter busy - bail out
            testData->presenterNotReady = 1;
            Complete(telemetryTest);
            return S_OK;
        }
    }
    else
    {
        mode = 1;  // Fall back to classic menu
    }
}
else
{
    mode = 1;  // Force classic menu
}

IContextMenu::QueryContextMenu Call:

// Set up parameters
UINT idCmdFirst = 30977;  // 0x7901
UINT idCmdLast = 31487;   // 0x7AFF
UINT uFlags = flags | 0x20 | 0x400;  // CMF_DEFAULTONLY | CMF_ASYNCVERBS

if (!mode)  // Curated mode
    uFlags |= 0x8000;  // CMF_CURATED flag

// Set menu restrictions for curated mode
if (!mode)
{
    IDefaultFolderMenuInitialize* pInit = NULL;
    if (pContextMenu->QueryInterface(
            IID_IDefaultFolderMenuInitialize,
            &pInit) >= 0)
    {
        pInit->SetMenuRestrictions(0x2040);
        pInit->Release();
    }
}

SetContextMenuCapability(hMenu);

// Populate menu with shell extensions
HRESULT hr = pContextMenu->QueryContextMenu(
    hMenu,
    0,              // Index to insert at
    idCmdFirst,
    idCmdLast,
    uFlags
);

Menu Item Merging:

// Load additional menu items for file selection
if (m_pShellBrowser && (flags & 0x80))  // DROPEFFECT_COPY flag
{
    ICommDlgBrowser2* pCommDlg = NULL;
    m_pShellBrowser->QueryInterface(IID_ICommDlgBrowser2, &pCommDlg);
    
    DWORD commDlgFlags = 0;
    if (pCommDlg)
        pCommDlg->GetCommDlgOptions(&commDlgFlags);
    
    if (!(commDlgFlags & 8))  // CDB2GCO_NO_OPENMENU
    {
        // Load "Open" menu from resources
        HMENU hOpenMenu = SHLoadPopupMenu(g_hinst, 0x104);
        
        if (hOpenMenu)
        {
            // Customize menu item text if needed
            if (pCommDlg)
            {
                WCHAR szText[260];
                if (pCommDlg->GetDefaultMenuText(this, szText, 260) == S_OK)
                {
                    MENUITEMINFOW mii = {0};
                    mii.cbSize = 80;
                    mii.fMask = MIIM_STRING;
                    mii.dwTypeData = szText;
                    SetMenuItemInfoW(hOpenMenu, 0, TRUE, &mii);
                }
            }
            
            // Add shield icon if needed
            if ((commDlgFlags & 0x40) && m_hShieldBitmap)
            {
                SHEnableMenuCheckMarkOrBmp(hOpenMenu);
                
                MENUITEMINFOW mii = {0};
                mii.cbSize = 80;
                mii.fMask = MIIM_BITMAP;
                mii.hbmpItem = m_hShieldBitmap;
                SetMenuItemInfoW(hOpenMenu, 0, TRUE, &mii);
                SHEnableMenuCheckMarkOrBmp(hMenu);
            }
            
            // Merge into main menu
            Shell_MergeMenus(
                hMenu,           // Target menu
                hOpenMenu,       // Source menu
                0,               // Insert position
                0x7026,          // First ID
                0xFFFFFFFF,      // Last ID
                1                // Flags
            );
            
            SetMenuDefaultItem(hMenu, 0, MF_BYPOSITION);
            DestroyMenu(hOpenMenu);
        }
    }
}

// Merge items from CItemsView
if (flags & 0x80)  // Selection context
{
    IItemsView* pItemsView = m_pItemsView;
    if (pItemsView)
    {
        pItemsView->MergeSelectionContextMenu(
            hMenu,
            mergeIndex,
            m_pidl  // Item ID list
        );
    }
}

// Apply shell menu styling
_SHPrettyMenu(hMenu);

Dark Mode Setup:

Feature_FileExplorerDarkTheme::ReportUsage(
    UsageReportingMode::ReportUsage,
    TelemetryReportingStage::InUsePhase
);

SetDarkModeForWindows* pDarkMode = NULL;
int darkModeFlags = 0;
bool allowDarkMode = false;

if (allowDarkMode)
{
    pDarkMode = new (std::nothrow) SetDarkModeForWindows();
    if (pDarkMode)
    {
        if (AllowDarkModeContextMenu(this, pDarkMode, &darkModeFlags) >= 0)
            allowDarkMode = true;
    }
}

// Store dark mode context for menu display
// (cleanup via RAII wrapper)

Final Dispatch:

// Store context menu state
m_pContextMenu = pContextMenu;
pContextMenu->AddRef();

// Set UI display flag in data object
IDataObject* pDataObj = NULL;
if (IUnknown_GetSelection(m_pContextMenu, &pDataObj) >= 0)
{
    DWORD displayed = 1;
    DataObj_SetBlobWithIndex(pDataObj, g_cfUIDisplayed, &displayed, 4);
    pDataObj->Release();
}

// ETW event
if (ETW_enabled)
    McGenEventWrite_EtwEventWriteTransfer(&Shell32_GeneratingContextMenu_Stop);

// Dispatch based on mode
if (mode == 0)  // Curated
{
    LocationContext = GetLocationContext(shellItems);
    testData->locationContextFlags = LocationContext;
    Complete(telemetryTest);
    
    DoCuratedContextMenu(pContextMenu, hMenu, flags, &pt);
}
else  // Classic
{
    LocationContext = GetLocationContext(shellItems);
    testData->locationContextFlags = LocationContext;
    Complete(telemetryTest);
    
    DoClassicMenu(pContextMenu, hMenu, &pt, shellItems);
    CleanupAfterContextMenu();
}

Exception Handling:

try
{
    // Desktop Spotlight detection and positioning
    if (Feature_DesktopSpotlightRightClickContextMenu::IsEnabled() && ...)
    {
        // ... Spotlight logic ...
    }
}
catch (...)
{
    wil::Log_CaughtException();
    // Continue with regular menu - graceful degradation
}

Key Constants:

Telemetry Points:

1. ContextMenuCreationTest: Tracks menu creation performance

2. Shell32_GeneratingContextMenu_Start/Stop: ETW events

3. DesktopSpotlightIconRightClicked: Spotlight interaction

4. SpotlightFlyoutPositionLogging: Position debugging

5. DesktopSpotlightRejuvenatedFlyout: Feature usage

---

CDefView::DoCuratedContextMenu

Address: 0x18029f72c

Size: 0x337 bytes (823 bytes)

Purpose: Bridge between DefView and ContextMenuPresenter for curated menus

This function is the critical bridge that connects the shell view's classic HMENU to the modern ContextMenuPresenter's XAML flyout.

Function Signature:

void CDefView::DoCuratedContextMenu(
    CDefView* this,
    IContextMenu* pContextMenu,
    HMENU hMenu,
    unsigned int flags,
    POINT* ppt
)

Execution Flow:

DoCuratedContextMenu
    │
    ├─► 1. GET SHELL ITEMS
    │   ├─► _GetItems(1, 0, IID_IShellItemArray, &items)
    │   └─► GetLocationContext(items) → locationContext
    │
    ├─► 2. ACQUIRE CONTEXT MENU PRESENTER
    │   ├─► TryGetContextMenuPresenter(&presenter)
    │   ├─► If NULL: Throw E_FAIL (0x80004005)
    │   └─► Store current focus: m_hWndFocus = GetFocus()
    │
    ├─► 3. SET PRESENTER FLAGS
    │   ├─► If (this->flags & 0x100): presenter->flags |= 0x8
    │   ├─► If (screenReaderEnabled): presenter->flags |= 0x1
    │   └─► If (Spotlight + Desktop): presenter->flags |= 0x10
    │
    ├─► 4. CALL CONTEXTMENUPRESENTER::DOCONTEXTMENU
    │   ├─► Get vtable: vtable = *presenter
    │   ├─► Get method: fn = vtable[0x20]  // 4th virtual method
    │   │
    │   ├─► Parameters:
    │   │   ├─► rcx = presenter (this)
    │   │   ├─► rdx = locationContext
    │   │   ├─► r8 = CDefView* (callback context)
    │   │   ├─► r9 = POINT (cursor position)
    │   │   │
    │   │   ├─► Stack parameters:
    │   │   │   ├─► hMenu (classic menu handle)
    │   │   │   ├─► flags (menu flags)
    │   │   │   ├─► testId (telemetry GUID)
    │   │   │   ├─► pContextMenu
    │   │   │   ├─► idCmdFirst = 30977
    │   │   │   ├─► idCmdLast = 31487
    │   │   │   ├─► hasIdMap = 1
    │   │   │   ├─► pIdMap = &c_DefViewIDMAP
    │   │   │   └─► (more params)
    │   │   │
    │   │   └─► Call via CFG: _guard_dispatch_icall(fn)
    │   │
    │   └─► If FAILED: Throw_Hr()
    │
    ├─► 5. CONDITIONAL SECONDARY CALLS
    │   │
    │   ├─► If (Spotlight && Desktop):
    │   │   ├─► Destroy classic menu: hMenu = NULL
    │   │   ├─► Get vtable[0x28] → DoContextMenuWithClassicMenu
    │   │   └─► Call with alt flags + extensions
    │   │
    │   ├─► If (hasOptionalPresenter):
    │   │   ├─► hMenu = NULL
    │   │   ├─► Get vtable[0x28]
    │   │   └─► Call DoContextMenu variant
    │   │
    │   └─► Else:
    │       ├─► hMenu = NULL
    │       ├─► Get vtable[0x28]
    │       └─► Standard DoContextMenu call
    │
    └─► 6. EXCEPTION HANDLING
        ├─► catch(...):
        │   ├─► Log_CaughtException()
        │   ├─► testData->curatedMenuException = 1
        │   ├─► Complete(telemetryTest)
        │   └─► DoExpandedContextMenu (fallback)
        │
        └─► Release(presenter)

Detailed Analysis:

Getting the Presenter:

IContextMenuPresenter* presenter = NULL;
TryGetContextMenuPresenter(&presenter);

if (!presenter)
{
    wil::Throw_Hr(
        E_FAIL,
        "shell\\SrcPkg\\FileExplorer\\DefView\\src\\DefView.cpp",
        Line 2127
    );
}

TryGetContextMenuPresenter Implementation (0x1800a56a0):

ComPtr<IContextMenuPresenter> CDefView::TryGetContextMenuPresenter()
{
    ComPtr<IContextMenuPresenter> result;
    
    // Query for presenter service from shell browser
    HRESULT hr = IUnknown_QueryService(
        m_pShellBrowser,  // Service provider
        &SID_ContextMenuPresenter,  // GUID_b306c5b1_b4f2_473c_b6ff_701b246ce2d2
        &IID_IContextMenuPresenter, // GUID_37a472f7_63cf_4ccf_a88b_5231a3c7d8b6
        &result
    );
    
    // Handle expected failure codes
    if (hr == CLASS_E_CLASSNOTAVAILABLE ||  // -2147221164 (0x80040154)
        hr == E_NOINTERFACE ||                // -2147467259 (0x80004002)
        hr == E_NOTIMPL ||                    // -2147467263 (0x80004001)
        hr == ERROR_MOD_NOT_FOUND)            // -2147024770 (0x8007007E)
    {
        // Mark in telemetry that presenter was not available
        auto testData = EnsureTestData();
        testData->contextMenuPresenterNotAvailable = 1;
    }
    
    return result;
}

The Critical Call to ContextMenuPresenter::DoContextMenu:

Looking at the assembly at 0x18029f82f - 0x18029f8a0:

; Get the presenter pointer
18029f82f  mov     r10, [rsp+0E8h+var_50]     ; r10 = IContextMenuPresenter*

; Load vtable
18029f837  mov     rax, [r10]                  ; rax = vtable pointer

; Load function pointer at vtable+0x20 (4th virtual method)
18029f83a  mov     r11, [rax+20h]             ; r11 = vtable[4]

; Prepare parameters
18029f892  mov     r9, [r14]                   ; r9 = &POINT
18029f895  mov     r8, rbx                     ; r8 = CDefView* (this)
18029f898  mov     edx, edi                    ; edx = locationContext
18029f89a  mov     rcx, r10                    ; rcx = presenter (this)

; Stack parameters already set up above
; ...

; Make the CFG-protected call
18029f89d  mov     rax, r11                    ; Load function pointer
18029f8a0  call    _guard_dispatch_icall$thunk ; CFG validated indirect call

Vtable Layout Analysis:

// IContextMenuPresenter vtable layout (x64)
0x00: QueryInterface
0x08: AddRef
0x10: Release
0x18: (method 3)
0x20: DoContextMenu ← Called here (vtable+0x20)
0x28: DoContextMenuWithClassicMenu (variant method)

Full Parameter Marshaling:

// From the assembly and decompiled code:
HRESULT hr = presenter->DoContextMenu(
    // rcx: this pointer (presenter)
    locationContext,                   // rdx: LOCATION_CONTEXT_FLAGS
    (CDefView*)this,                   // r8: callback context
    *ppt,                              // r9: POINT structure
    
    // Stack parameters (pushed right-to-left):
    hMenu,                             // Classic menu handle
    presenter->flags,                  // Flags set above
    &testId,                           // Telemetry test GUID
    pContextMenu,                      // IContextMenu interface
    30977,                             // idCmdFirst
    31487,                             // idCmdLast
    1,                                 // hasIdMap
    &c_DefViewIDMAP,                   // Command ID mapping table
    &testId,                           // Test ID again
    NULL                               // Reserved
);

Spotlight Special Case:

if (Feature_DesktopSpotlightIconHoverAndSingleClick::IsEnabled() &&
    (locationContext & 0x7FF) == 0x400 &&  // DESKTOP context
    m_spotlightEnabled)
{
    // Desktop Spotlight gets special handling
    presenter->flags |= 0x10;  // Spotlight flag
    
    // Destroy classic menu - Spotlight doesn't use it
    hMenu = NULL;
    
    // Call different vtable method at offset 0x28
    // This method handles Spotlight-specific XAML extension loading
    presenter->DoContextMenuWithClassicMenu(
        hMenu,
        presenter->flags,
        &testId,
        pContextMenu,
        30977,
        31487,
        1,
        &c_DefViewIDMAP,
        &testId,
        NULL
    );
}

Exception Handling and Fallback:

try
{
    // ... Call presenter ...
}
catch (...)
{
    wil::Log_CaughtException();
    
    // Mark failure in telemetry
    auto testData = GetTestData();
    testData->curatedMenuException = 1;
    
    // Complete telemetry test
    Complete(telemetryTest);
    
    // Fall back to expanded context menu (classic Win32)
    DoExpandedContextMenu(
        *ppt,
        flags >> 7,  // Extract high byte
        NULL,
        NULL,
        NULL
    );
}

Key Data Structure: c_DefViewIDMAP

// Command ID mapping table for DefView
const struct QITAB c_DefViewIDMAP[] = {
    // Maps command IDs to interface offsets
    // Used by ContextMenuPresenter to route commands back to DefView
    // ...
};

Integration Points:

1. Service Query: Uses IUnknown_QueryService to locate presenter

2. Vtable Dispatch: CFG-protected indirect call through vtable

3. Parameter Passing: Mix of register and stack parameters (x64 calling convention)

4. Exception Safety: Try/catch with graceful fallback to classic menu

5. Telemetry Integration: TIP test framework tracks success/failure

---

Context Menu Entry Points

The context menu creation process begins with one of two entry points, depending on whether the user is interacting with Desktop Spotlight or regular file/folder items.

Entry Point Decision Tree

User Right-Click
    │
    ├─► Is Desktop Spotlight Context?
    │   └─► Feature Flag: DesktopSpotlightRightClickContextMenu
    │       ├─► Enabled + Spotlight Active
    │       │   └─► ShowSpotlightContextMenu (0x1800b21d0)
    │       │       └─► Loads XAML extension
    │       │       └─► DesktopSpotlightHost::ShowXamlFlyout
    │       │
    │       └─► Disabled or Not Spotlight
    │           └─► DoContextMenuHelper (0x1800a9f8b)
    │
    └─► Regular File/Folder Context
        └─► DoContextMenuHelper (0x1800a9f8b)
            ├─► Initialize telemetry
            ├─► Query browser services  
            ├─► Decision: Spotlight vs Curated Menu
            └─► [Main Flow - See Next Section]

ShowSpotlightContextMenu

Address: 0x1800b21d0

Size: 0x329 bytes (809 bytes)

This function handles the special case of Desktop Spotlight right-click menus, which use a completely separate XAML extension instead of the standard curated menu.

Purpose:

• Loads the Desktop Spotlight XAML extension dynamically
• Creates a flyout UI specifically for Spotlight interactions
• Bypasses the standard context menu creation entirely

Key Steps:

void ShowSpotlightContextMenu(ContextMenuPresenter* this, TipTest* tipTest)
{
    // 1. Load the Spotlight XAML extension
    hstring category = L"com.microsoft.windows.extensions.xaml.desktopspotlight";
    auto xamlExtensions = XamlExtensions::GetForCategory(category);
    
    if (!xamlExtensions)
        throw E_FAIL; // Extension not found
    
    // 2. Create the flyout host
    hstring hostName = L"DesktopSpotlightFlyoutHost";
    hstring contentName = L"DesktopSpotlight";
    
    IInspectable flyoutObject;
    xamlExtensions.CreateForPackageFullName(
        &flyoutObject, 
        contentName, 
        hostName
    );
    
    // 3. Query for IFlyout interface
    IFlyout flyout;
    flyoutObject->QueryInterface(IID_IFlyout, &flyout);
    
    // 4. Convert to FlyoutBase and store
    FlyoutBase flyoutBase = flyout.as<FlyoutBase>();
    m_xamlFlyout = flyoutBase;
    
    if (!m_xamlFlyout)
        throw E_FAIL;
    
    // 5. Register event handlers
    auto weakThis = get_weak();
    
    // Closed event handler
    m_xamlFlyout.Closed([weakThis](auto sender, auto args) {
        if (auto strongThis = weakThis.get())
            strongThis->OnSpotlightFlyoutClosed();
    });
    
    // Opened event handler  
    m_xamlFlyout.Opened([weakThis](auto sender, auto args) {
        if (auto strongThis = weakThis.get())
            strongThis->OnSpotlightFlyoutOpened();
    });
    
    // 6. Show the flyout via DesktopSpotlightHost
    CuratedContextMenuTelemetry::CuratedContextMenu_ShowMenu();
    
    tipTest.operator=(m_contextMenuCreationTest);
    
    DesktopSpotlightHost::ShowXamlFlyout(
        m_spotlightHost,
        m_xamlFlyout,
        m_parentWindow,
        m_invokePoint
    );
}

Important Notes:

• This is a completely separate code path from the standard context menu
• Only activated when Desktop Spotlight feature flag is enabled
• Uses AppExtension system to load XAML UI dynamically
• Package name: `com.microsoft.windows.extensions.xaml.desktopspotlight`
• No classic menu filtering - entirely modern UI

---

DoContextMenuHelper - Main Orchestration

Address: 0x1800a9f8b

Size: 0x678 bytes (1,656 bytes)

Purpose: Main orchestration function that coordinates context menu creation

This is the primary entry point for standard file/folder context menus. It orchestrates the entire menu creation pipeline from initialization through display.

Function Signature

void ContextMenuPresenter::DoContextMenuHelper(
    ContextMenuPresenter* this,
    HMENU hClassicMenu,           // [in] Classic context menu from shell extensions
    TipTest* tipTest              // [in/out] Telemetry test data
)

Where `hClassicMenu` Comes From

The hClassicMenu passed into DoContextMenuHelper (and then into TryCreateMiniMenuFromClassic) is created by the caller of ContextMenuPresenter::DoContextMenu, not inside ContextMenuPresenter itself.

Evidence in binary:

• `ContextMenuPresenter::DoContextMenu` (0x180053500) receives `HMENU a2` and immediately stores it in a member `wil::unique_any_t` without creating it.
• The presenter never calls `CreatePopupMenu` in `DoContextMenu` or `DoContextMenuHelper`.

Observed call chain (in this binary):

FileExplorerFolderViewController::ShowContextMenuForSelection / ShowContextMenuForBackground
    └─► IListControlHost2::ShowContextMenu... (vtable call)
        └─► ContextMenuPresenter::DoContextMenu(HMENU hClassicMenu, flags, invokePoint)
            └─► ContextMenuPresenter::DoContextMenuHelper(hClassicMenu, tipTest)
                └─► TryCreateMiniMenuFromClassic(&hMenu, hClassicMenu)

Creation point (classic menu):

The HMENU itself is produced by the shell context menu host using the classic Win32 flow:

1. CreatePopupMenu() creates the base menu.

2. IContextMenu::QueryContextMenu() (plus IContextMenu2/3 hooks) populates it.

3. That populated HMENU is then handed to ContextMenuPresenter::DoContextMenu.

The concrete function that calls QueryContextMenu is part of the list control host / shell context menu host, not in ContextMenuPresenter.

High-Level Flow

DoContextMenuHelper
    │
    ├─► 1. INITIALIZATION PHASE
    │   ├─► Start telemetry watch_errors
    │   ├─► Mark ContextMenuCreationTest as started
    │   ├─► Transition flyout state to "Creating"
    │   └─► Query IServiceProvider for browser services
    │       ├─► Get SID_STopLevelBrowser
    │       └─► Get frame/window information
    │
    ├─► 2. FEATURE FLAG DECISION
    │   ├─► Check: DesktopSpotlightRightClickContextMenu flag
    │   │   └─► If Spotlight context
    │   │       ├─► Report DesktopSpotlightRejuvenatedFlyout usage
    │   │       ├─► If location_context == LOCATION_CONTEXT_DESKTOP (0x400)
    │   │       │   └─► If Spotlight enabled for this presenter
    │   │       │       └─► ShowSpotlightControl()
    │   │       │       └─► RETURN EARLY
    │   │       │
    │   │       └─► Otherwise: Fall through to curated menu
    │   │
    │   └─► Regular Context Menu Flow
    │       └─► Report DesktopSpotlightRejuvenatedFlyout usage
    │
    ├─► 3. MENU CREATION PHASE
    │   ├─► Set next menu ID counter to 32000 (0x7D00)
    │   ├─► Create temporary HMENU: hMenu = NULL
    │   │
    │   ├─► Call: TryCreateMiniMenuFromClassic(&hMenu, hClassicMenu)
    │   │   └─► [Filters and creates curated menu - See dedicated section]
    │   │
    │   ├─► Mark in telemetry: miniMenuCreated = true
    │   │
    │   └─► If GetMenuItemCount(hMenu) > 0
    │       ├─► Mark in telemetry: hasContextMenuItems = true
    │       └─► Store menu: swap(m_curatedMenu, hMenu)
    │
    ├─► 4. TELEMETRY SETUP
    │   ├─► Create ContextMenuSelectionTest data
    │   ├─► Start timing for selection test
    │   ├─► Store in m_contextMenuSelectionTest
    │   └─► Record location_context flags
    │
    ├─► 5. XAML MENU CREATION (if enabled)
    │   ├─► If Spotlight extensions enabled
    │   │   │
    │   │   ├─► Get IFileExplorerContextMenuExtension2
    │   │   │
    │   │   ├─► CreateMenuItems(m_curatedMenu)
    │   │   │   └─► Convert HMENU to IIterable<MenuItem>
    │   │   │
    │   │   ├─► CreateMicrosoftUIXamlControlsPrimitivesMenu(menuItems)
    │   │   │   └─► Creates CommandBarFlyout
    │   │   │
    │   │   ├─► Cast to FlyoutBase
    │   │   │   └─► Store in m_xamlFlyout
    │   │   │
    │   │   ├─► Query for ICommandBarFlyout interface
    │   │   │
    │   │   ├─► RegisterTappedOnShowMoreOptions()
    │   │   │   └─► Register handler for "Show more options" button
    │   │   │
    │   │   ├─► Set flyout state = FlyoutState::ShowingXaml (3)
    │   │   │
    │   │   ├─► Register Closed event handler
    │   │   │   └─► Lambda captures weak_ptr<this>
    │   │   │   └─► Calls OnFlyoutClosed when menu dismissed
    │   │   │
    │   │   ├─► Register Opened event handler
    │   │   │   └─► Lambda captures weak_ptr<this>  
    │   │   │   └─► Calls OnFlyoutOpened when menu shown
    │   │   │
    │   │   ├─► Get strong reference: get_strong()
    │   │   │
    │   │   ├─► Update telemetry: m_contextMenuCreationTest = tipTest
    │   │   │
    │   │   ├─► Call telemetry: CuratedContextMenu_ShowMenu()
    │   │   │
    │   │   └─► ContextMenuHost::ShowXamlFlyout()
    │   │       ├─► Parameters:
    │   │       │   ├─► m_contextMenuHost (host window)
    │   │       │   ├─► m_xamlFlyout (flyout to show)
    │   │       │   ├─► m_parentWindow (parent HWND)
    │   │       │   └─► m_invokePoint (screen coordinates)
    │   │       │
    │   │       └─► [Shows XAML flyout on screen]
    │   │
    │   └─► Destroy temporary HMENU if still exists
    │
    └─► 6. CLEANUP & EXCEPTION HANDLING
        ├─► Release service provider interface
        ├─► Destroy test watcher
        └─► Exception handlers at multiple points:
            ├─► ShowSpotlightControl exceptions
            │   └─► Log exception, record in telemetry
            │   └─► Fall back to regular menu
            │
            └─► ShowXamlFlyout exceptions
                └─► Log exception
                └─► Complete selection test
                └─► Cancel current flyout

Detailed Phase Analysis

#### Phase 1: Initialization

// Initialize telemetry tracking
TipTestWatcher<ContextMenuCreationTest> watcher;
tip_test::watch_errors(tipTest, &watcher);

// Mark that context menu creation has started
auto testData = tipTest.operator->();
testData->contextMenuCreationStarted = true;

// Transition state machine
TransitionFlyoutState(FlyoutState::Creating); // State = 1

// Query browser services for window/frame information
IServiceProvider* pServiceProvider = m_site;
IShellBrowser* pBrowser = nullptr;

HRESULT hr = IUnknown_QueryService(
    pServiceProvider,
    SID_STopLevelBrowser,
    IID_IShellBrowser,
    &pBrowser
);

if (SUCCEEDED(hr))
{
    // Get frame and window handles
    pBrowser->QueryInterface(IID_IShellFrame, &m_frame);
    pBrowser->GetWindow(&m_parentWindow);
}
else
{
    // Log warning but continue
    wil::Log_Hr(hr, "Failed to get IShellBrowser");
}

Key Points:

• Telemetry tracking begins immediately
• State machine transitions: `Idle` → `Creating`
• Browser services provide parent window context
• Failures are logged but don't abort the process

#### Phase 2: Feature Flag Decision

// Check if Desktop Spotlight menu should be shown
if (wil::Feature_DesktopSpotlightRightClickContextMenu::IsEnabled())
{
    if (m_isSpotlightContext)  // Set by caller
    {
        // Report usage of rejuvenated flyout feature
        wil::Feature_DesktopSpotlightRejuvenatedFlyout::ReportUsage(
            UsageReportingMode::ReportUsage,
            TelemetryReportingStage::InUsePhase
        );
        
        // Check location context
        LOCATION_CONTEXT_FLAGS flags = m_locationContextFlags;
        
        if ((flags & 0x7FF) == LOCATION_CONTEXT_DESKTOP &&
            m_spotlightEnabled)
        {
            try
            {
                // Show Spotlight-specific menu
                ShowSpotlightControl(tipTest);
                return; // EARLY EXIT
            }
            catch (...)
            {
                // Log exception
                int hr = wil::ResultFromCaughtException();
                testData->spotlightControlException = hr;
                
                Log("ShowSpotlightControl exception: %d", hr);
                
                // Fall through to standard menu
            }
        }
    }
}
else
{
    // Feature disabled - report and use standard flow
    wil::Feature_DesktopSpotlightRejuvenatedFlyout::ReportUsage(
        UsageReportingMode::ReportUsage,
        TelemetryReportingStage::InUsePhase
    );
}

Decision Factors:

1. Feature Flag: Feature_DesktopSpotlightRightClickContextMenu must be enabled

2. Context Type: m_isSpotlightContext flag set during initialization

3. Location: Must be desktop context (LOCATION_CONTEXT_DESKTOP = 0x400)

4. Spotlight State: m_spotlightEnabled must be true

Exception Handling:

• If ShowSpotlightControl throws, exception is caught
• Error is logged to telemetry
• Flow continues to standard curated menu (graceful fallback)

#### Phase 3: Menu Creation

// Reset menu ID counter to start of range
_InterlockedExchange(&m_nextMenuId, 32000); // 0x7D00

// Create curated menu from classic menu
HMENU hMenu = nullptr;
TryCreateMiniMenuFromClassic(&hMenu, hClassicMenu);
// [Details in dedicated TryCreateMiniMenuFromClassic section]

// Mark in telemetry
testData->miniMenuCreated = true;

// Check if menu has any items
if (GetMenuItemCount(hMenu) > 0)
{
    // Mark success in telemetry
    testData->hasContextMenuItems = true;
    
    // Store the menu handle
    // Uses wil::unique_any_t for RAII cleanup
    m_curatedMenu.swap(hMenu);
    
    hMenu = m_curatedMenu.get();
}

Menu ID Assignment:

• Range starts at `32000` (0x7D00)
• Upper limit is `32255` (0x7DFF) - checked during insertion
• Each menu item gets sequential ID via `_InterlockedExchangeAdd`
• IDs used to map back to VerbInfo structures for command routing

#### Phase 4: Telemetry Setup

// Create selection test data
winrt::com_ptr<TipTestData<ContextMenuSelectionTest>> selectionTest;
selectionTest = tip_test::ensure_data();

// Start timing
selectionTest->timestamp.start();

// Store in member variable
m_contextMenuSelectionTest = selectionTest;

// Record context flags
selectionTest->locationContextFlags = m_locationContextFlags;

Telemetry Captured:

• Selection start time
• Location context flags
• User interactions with menu
• Final selection or dismissal
• Performance metrics

#### Phase 5: XAML Menu Creation

This is the most complex phase, creating the modern XAML UI:

if (m_spotlightEnabled)
{
    // 1. Get the context menu extension interface
    IFileExplorerContextMenuExtension2* pExtension = nullptr;
    TryGetContextMenuExtension2(&pExtension);
    
    // 2. Convert HMENU to XAML MenuItem collection
    IIterable<MenuItem> menuItems;
    CreateMenuItems(hMenu, &menuItems);
    
    // 3. Create XAML menu flyout
    IInspectable menuUIElement;
    pExtension->CreateMicrosoftUIXamlControlsPrimitivesMenu(
        menuItems,
        &menuUIElement
    );
    
    // 4. Cast to FlyoutBase
    FlyoutBase flyout = menuUIElement.as<FlyoutBase>();
    m_xamlFlyout = flyout;
    
    // 5. Query for CommandBarFlyout interface (optional)
    ICommandBarFlyout* pCommandBarFlyout = nullptr;
    if (m_xamlFlyout)
    {
        m_xamlFlyout->QueryInterface(
            IID_ICommandBarFlyout,
            &pCommandBarFlyout
        );
    }
    
    // 6. Register "Show more options" handler
    RegisterTappedOnShowMoreOptions(pCommandBarFlyout);
    
    // 7. Update state
    m_flyoutState = FlyoutState::ShowingXaml; // = 3
    
    // 8. Register Closed event
    auto weakThis = get_weak();
    
    event_token closedToken = m_xamlFlyout.Closed(
        [weakThis](auto sender, auto args) 
        {
            if (auto strong = weakThis.get())
            {
                strong->OnFlyoutClosed();
            }
        }
    );
    m_flyoutClosedRevoker = closedToken;
    
    // 9. Register Opened event
    event_token openedToken = m_xamlFlyout.Opened(
        [weakThis](auto sender, auto args)
        {
            if (auto strong = weakThis.get())
            {
                strong->OnFlyoutOpened();
            }
        }
    );
    m_flyoutOpenedRevoker = openedToken;
    
    // 10. Get strong reference for callback
    winrt::com_ptr<ContextMenuPresenter> strong;
    get_strong(&strong);
    
    // 11. Record telemetry
    CuratedContextMenu_ShowMenu();
    m_contextMenuCreationTest = tipTest;
    
    // 12. Show the flyout
    try
    {
        ContextMenuHost::ShowXamlFlyout(
            m_contextMenuHost,        // Host control
            m_xamlFlyout,             // Flyout to show
            m_parentWindow,           // Parent HWND
            m_invokePoint             // Screen coordinates
        );
    }
    catch (...)
    {
        // Log exception but don't crash
        wil::Log_CaughtException();
        
        // Update telemetry
        auto selTest = tip_test::ensure_data(m_contextMenuSelectionTest);
        // ... record exception ...
        
        // Complete test and cancel
        tip_test::complete(m_contextMenuSelectionTest);
        CancelCurrentFlyout(CancelReason::Exception);
    }
}

Event Handler Pattern:

• Uses `weak_ptr` to avoid circular references
• Lambda captures weak pointer
• Checks if object still exists before calling methods
• Event tokens stored in member variables for cleanup

Error Recovery:

• ShowXamlFlyout exceptions are caught
• Telemetry updated with error information
• Flyout is cancelled gracefully
• No crash or hang - degrades gracefully

State Management

FlyoutState Enum:

enum FlyoutState
{
    Idle = 0,
    Creating = 1,
    WaitingForAsync = 2,
    ShowingXaml = 3,
    ShowingWin32 = 4,
    Dismissed = 5
};

State Transitions in DoContextMenuHelper:

Idle (0)
  ↓ [TransitionFlyoutState called]
Creating (1)
  ↓ [Menu created]
ShowingXaml (3)
  ↓ [User interacts/dismisses]
Dismissed (5)