Universal Windows Platform apps run in sandboxes with restricted access to system APIs. This is good for security and bad for third-party tools that need to manipulate window properties. NoCapture handles UWP apps differently than standard Win32 applications. Here is how.
The UWP Sandbox Problem
Standard Windows applications allow external processes to manipulate their window handles with certain permissions. UWP apps do not. Their windows are managed by ApplicationFrameHost.exe, a broker process that sits between the UWP app and the desktop.
When you try to inject a DLL into a UWP app directly, Windows blocks it. The sandbox does not allow foreign code execution. This means the same injection technique that works for Win32 apps fails for UWP apps unless the tool targets the broker.
How NoCapture Handles UWP
NoCapture detects when a window belongs to a UWP application and redirects protection to the ApplicationFrameHost.exe broker process. The broker then applies WDA_EXCLUDEFROMCAPTURE to the UWP window on behalf of the app.
This works for:
- Microsoft Edge (UWP version)
- Mail and Calendar
- Microsoft Store
- Photos
- Calculator
- Most built-in Windows apps
Where It Gets Complicated
Some UWP apps spawn multiple windows through separate broker instances. Microsoft Teams, for example, has both a Win32 desktop client and a UWP-lite version embedded in Windows 11. NoCapture detects which version is running and applies protection to the correct process.
Other UWP apps use WebView2 or embedded Chromium renderers that create child windows outside the main broker. NoCapture recursively protects these child windows when possible. If a child window escapes the broker's control, it may remain visible to capture.
Edge Specifics
Microsoft Edge is the most common UWP app that users want to cloak. Edge creates multiple processes:
- Main browser process
- GPU process
- Renderer processes per tab
- Extension processes
NoCapture targets the main window handle. The renderer processes that actually draw the tabs are children of this handle. In most cases, cloaking the main window excludes all tabs. In rare cases with certain extensions or flags, a renderer may create a separate window that is not automatically cloaked.
If you notice a specific Edge tab leaking, verify in live preview and manually cloak the tab window if necessary.
The Limitation
UWP sandboxing is designed to prevent exactly the kind of manipulation that NoCapture performs. We work within the sandbox model by targeting the broker, but we cannot override sandbox security. If Microsoft changes the broker architecture in a future Windows update, UWP cloaking may require an update to NoCapture.
We wrote about the honest limitations of all WDA-based tools here.
NoCapture provides OS-level window cloaking, title masking, and notification shielding for Windows. Free for two windows. Because "being careful" isn't a strategy.
