This research started with my curiosity about Paint. I recently had some success looking into less-explored Windows features likeUCPD,WHESCVC, and I have long known that Microsoft
added a bunch ofAI featuresinto the Paint app.
I do not know if anyone actually uses Paint + AI to generate images, but I wanted to see how exactly the image generation works.
Before I started, I expected that it simply called a remote API to do the image generation. However, after I set upBinary Ninja MCPwith Codex and started the analysis, I soon realized that Microsoft actually shipped local models in Windows as part of Copilot.
The Paint App is sitting in the following path (yes, they are allWindows Appsnow):
And there are four apparent model files with the.onnxeextension:
The format ofseg.onnxewaspreviously known, i.e., when it is XORed with the stringMicrosoft_2023, it becomes a normal ONNX file. However, the format of the other three.onnxefiles initially looked different.
It turned out that Microsoft had not changed the algorithm, only the key.segapi.dllcontains a small key registry:
After decryption,onnx.checker.check_model()works on all of them:
While walking through these files, I found aWatermarker.dll:
This is not super surprising to me, because while I interacted with the Paint app, I already discovered that it has a setting to embed avisible watermarkto the image that it produces:
The visible watermark is just a small Copilot logo at the bottom right of the image, which is totally normal.
Then, out of nowhere, I decided to ask AI to analyze the DLL and see if it could also be embedding aninvisiblewatermark. This is part of my intuition as a reverse engineer, because the file is 1.67 MB in size, which is unusually large for such trivial functionality (arguably, the visible watermark does not even require a separate DLL). Apparently, the recent Claude Codetext-watermark announcementalso played a role in prompting me to think about this possibility.
To begin with, the visible watermark is added byAddPerceptibleWatermark: