Click here to Skip to main content
Click here to Skip to main content

Advanced Class Probe

, 19 Oct 2004
Rate this:
Please Sign up or sign in to vote.
A program to probe a window for its class, and enumerate all the loaded modules

Contents

  1. Introduction
  2. Class Probe
  3. Usage / Help
  4. How it works
  5. Disclaimer

Introduction

In the Windows platform, each window is an instance of a registered class. The class for a control stores certain attributes for the control, and defines some criteria that the Windows OS treats them.

WNDCLASSEX structure:

 
typedef struct _WNDCLASSEX {
    UINT       cbSize; 
    UINT       style;
    WNDPROC    lpfnWndProc;
    int        cbClsExtra; 
    int        cbWndExtra; 
    HINSTANCE  hInstance;  
    HICON      hIcon;      
    HCURSOR    hCursor;    
    HBRUSH     hbrBackground;  
    LPCTSTR    lpszMenuName;  
    LPCTSTR    lpszClassName; 
    HICON      hIconSm;      
} WNDCLASSEX, *PWNDCLASSEX;

A class structure stores Pointer to the window procedure, brush to paint the background, Icon to display for the window, cursor and so on…

In Windows platform each control is a derived from a registered class, and the class name distinguishes them. The in built windows controls have different class names but are available through macros to the developer.

Ex: WC_TABCONTROL, it is defined as

#define WC_TABCONTROLA          "SysTabControl32"
#define WC_TABCONTROLW          L"SysTabControl32"

#ifdef UNICODE
#define  WC_TABCONTROL          WC_TABCONTROLW
#else
#define  WC_TABCONTROL          WC_TABCONTROLA
#endif

This ensures that the class name dependency is avoided.

Some times the windows controls are not adequate for particular purpose. For that purpose the Windows programming provides methods of “sub classing“and “super classing” of standard windows controls.

But this only provides very limited scope of customization and often at the stake of degraded performance. This also introduces new untraceable errors to the program. In actual practice 100% custom controls provides more flexibility in design, scope for customization and good performance.

Class Probe

Class probe is a small utility to monitor the class for a control. Using this one can check a new control for the registered class name, window handle, thread ID, and enumerate all the loaded process for the process displaying the control.

Using this one can check whether a control is a custom control or one derived from a standard windows control. Now you can spy on some dude shareware and find the junk beneath the skin. Yes most of the sinkable programs are built upon large scale sub-classing of the standard windows controls. This is some times with memory leaks and unnecessary memory loading and processor time wastage.

This also gives more knowledge about some of the shareware which apparently load modules which are some times inside the System32 directory and other directory. This provides me with added knowledge to diffuse a bully unwanted uninvited invisible installations (Viruses that come with shareware/ freeware).

Usage / Help

Advanced Class Probe gives information about handle of the window (if handle is unavailable it shows the thread ID) the Process which started this window, the maximum memory, and current memory usage, and lists all the modules loaded by the process. You can RIGHT CLICK on the window to stop the hook. Then you can double click on the module name to view its property sheet.

How it Works!

It uses a MOUSE HOOK to monitor all the mouse messages. In fact with a mouse hook all the mouse events are routed through the hook procedure. It installs a global mouse hook for all the running threads. To do so, it requires the hook procedure to be inside a DLL. The Hook.dll has the hook procedure. It is programmed in Win32 ASM (MASM), so that it works and the loaded module size is kept at minimum. The small size of the DLL is a requirement since each procedure loads the hook dll, when probed by the mouse hook. (Windows 98 and I think even windows 2000 don't unload the hook dll until the probed process terminates.)

I got the Hook idea from Icezelion MASM32 tutorials.

Disclaimer:

This code and the executable don’t claim to be perfect and error free. It also doesn’t come with any warranties and even any implied warranty of being fit for any proposes what so ever which includes "merchantability".

If there was any mistake in the writing, it is regretted

I am currently looking for some persons to join in my open source project. If any one wants to contribute he/she is most welcome. My project is not personal and every one is invited... I am developing a multiplatform IDE for C/C++ with its own class lib, APIs and classes using pure C/C++.

Please visit: http://thunder.sourceforge.net/for details

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here

About the Author

sanjit_rath
Web Developer
United States United States
No Biography provided

Comments and Discussions

 
GeneralExcellent! PinmemberGrega81512-Jan-07 16:23 
QuestionMHOOK.dll? PinmemberBasic00116-Jul-05 18:03 
AnswerRe: MHOOK.dll? Pinmembersanjit_rath18-Jul-05 21:14 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web04 | 2.8.140709.1 | Last Updated 19 Oct 2004
Article Copyright 2004 by sanjit_rath
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid