Click here to Skip to main content
13,005,748 members (66,704 online)
Click here to Skip to main content
Add your own
alternative version


13 bookmarked
Posted 21 Jul 2007

Integrating autosave feature with the Windows Notepad application

, 21 Jul 2007
Rate this:
Please Sign up or sign in to vote.
Illustration of Windows hooks for adding extra code in applications without the source available.


This program demonstrates using Windows hooks for adding additional functionality to applications which do not have their source available.

How it works

The actual code for handling the autosave feature comes from a separate DLL. To include the DLL in the application, the executable file notepad.exe (shipped with Microsoft Windows) is modified. The import section of an executable contains the names of other DLLs it requires along with the functions required by Notepad from each DLL. The dumpbin utility (shipped with Microsoft Visual Studio) can be used to find these dependencies of an executable.

On my computer, I use the following command line:

C:\Program Files\Microsoft Visual Studio\VC98\Bin>DUMPBIN.EXE /imports 

and following is a section of the output I get on the screen:

- - - -

1001020 Import Address Table
10076EC Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference

773DD2ED 8 CreateStatusWindowW

Along with other DLLs, Notepad.exe requires COMCTL32.dll for a single function CreateStatusWindowW.

To include my own DLL (which is Autosave.dll), I replaced the name of the dependency (COMCTL32.dll) with Autosave.dll in the notepad.exe executable file. It can be easily done by modifying the exe file in a hex/binary editor. Note that the number of characters in the string "Autosave.dll" is the same as that in "Comctl32.dll" (12), so no issues. If the character length does not match, then we need to modify it by writing additional code, which is out of the scope for now.

Now when the user runs notepad.exe, the loader loads Autosave.dll also in the process address space.

However, the function CreateStatusWindowW is still required by Notepad (which resides in COMCTL32.dll). To solve this problem, I use the function forwarder approach. I export the function in my AutoSave.dll and tell the linker that this function is actually present in COMCTL32.dll.

This is achieved by using a single line in the DLL code:

#pragma comment(linker, "/export:CreateStatusWindowW=COMCTL32.CreateStatusWindowW")

The above line also loads COMCTL32.dll in the process address space and hence the dependencies are resolved.

Now since my DLL (autosave.dll) is finally loaded, I can add extra code in the process to add more features. I tried adding the autosave feature.

I use Windows hooks (WH_GETMESSAGE and WH_CALLWNDPROC) to do the job. The WH_GETMESSAGE hook is used to sniff (and can even modify) all the messages from the required thread's message queue. Similarly, the WH_CALLWNDPROC hook sniffs all the messages posted to the window procedure of the desired thread. Now since I can monitor and post messages to the Notepad window, the DLL starts a timer. Every time the timer expires, the DLL posts a WM_COMMAND message to the Notepad main window invoke File->Save menu option, thereby saving the content of the window.

Using the code

Following is a snapshot of the Autosave.dll source code.

#include <windows.h>
#include <stdio.h>

/* forward the function required by notepad.exe to the actual application */
#pragma comment(linker, "/export:CreateStatusWindowW=COMCTL32.CreateStatusWindowW")


#define IDLE_TIMER_ID 0xdcba
/* any probably unique timer id value not used in notepad application */

#define IDLE_TIMER_INTERVAL (15 * 1000) /* 15 seconds */


/* global variables definitions */
HHOOK g_getmsg_hook = NULL;
/* Handle to hook for monitoring queued messages in the thread's queue */

HHOOK g_callwnd_hook = NULL;
/* Handle to Call window proc (for getting window handle only)*/

HWND g_hwnd = NULL; /* Handle to notepad main window */
unsigned char g_save_mode = AUTOSAVE_NOT_ASKED;
/* option selected by the user */

unsigned char g_window_contents_status = WINDOW_CONTENTS_SAVED;
/* current notepad window contents status */

/* Hook procedure to get initial messages */
LRESULT CALLBACK GetMsgProc(int code, WPARAM wParam, LPARAM lParam);
LRESULT CALLBACK CallWndProc(int code, WPARAM wParam, LPARAM lParam);

BOOL WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, void *gbg_ptr)
    DWORD thread_id = 0;
        case DLL_PROCESS_ATTACH: /* This is called only once at startup */
            /* Install the GetMessage and CallWndProc Hook into the application */
            thread_id = GetCurrentThreadId();
            g_getmsg_hook = SetWindowsHookEx(WH_GETMESSAGE, 
                                      GetMsgProc, hInst, thread_id);
            g_callwnd_hook = SetWindowsHookEx(WH_CALLWNDPROC, 
                                CallWndProc, hInst, thread_id);
            if (g_getmsg_hook == NULL)
                MessageBox(NULL, TEXT("Unable to initialize the autosave feature"), 
                           TEXT("Error"), 0);

        case DLL_PROCESS_DETACH: /* This is called only once at the time of termination */
            if (g_getmsg_hook != NULL) 
    return TRUE;

/* Following routine gets called at startup to ask the user whether to turn the 
* autosave feature ON
void AskForAutoSaveEnable()
    unsigned char users_reply;

    if (g_save_mode == AUTOSAVE_NOT_ASKED)
        /* Ask the user at startup to enable the autosave feature */
        users_reply = MessageBox(NULL, TEXT(
          "Do you want to enable the automatic save on idle feature"), \
          TEXT("Program option"), MB_YESNO|MB_DEFBUTTON1);

        if (users_reply == IDYES)
        /* User accepted to turn the autosave feature ON */
            g_save_mode = AUTOSAVE_ACCEPTED;
            SetTimer(g_hwnd, IDLE_TIMER_ID, IDLE_TIMER_INTERVAL, NULL); 
        else /* User rejected it. Now no use of keeping the hook ON. Cleanup */
            g_getmsg_hook = NULL;
            g_save_mode = AUTOSAVE_DENIED;

* Hook procedure to listen to keyboard inputs and timer messages.
LRESULT CALLBACK GetMsgProc(int code, WPARAM wParam, LPARAM lParam)
    MSG *msg_str = NULL;
    static unsigned char control_key_down = FALSE;

    if (code < 0)
        /* Action recommended by the Hooks functionality */
        return CallNextHookEx(g_getmsg_hook, code, wParam, lParam);

    msg_str = (MSG *)lParam;

    /* User did some keyboard event. If idle timer is running, restart it */
    if (g_save_mode == AUTOSAVE_ACCEPTED && msg_str->message == WM_KEYDOWN)
        KillTimer(g_hwnd, IDLE_TIMER_ID);

    /* User typed something, contents need to be saved again now */
    if (msg_str->message == WM_CHAR)
        g_window_contents_status = WINDOW_CONTENTS_UNSAVED;

    * Idle timer expired. Save the contents of the window if not
    * already saved
    if (msg_str->hwnd == g_hwnd && msg_str->message == WM_TIMER && 
    msg_str->wParam == IDLE_TIMER_ID)
        if (g_window_contents_status == WINDOW_CONTENTS_UNSAVED)
            g_window_contents_status = WINDOW_CONTENTS_SAVED;
            PostMessage(g_hwnd, WM_COMMAND, MAKEWORD(3, 0), 0);
            /* Save menu option has ID 3 => Spy++ */ 
    return CallNextHookEx(g_getmsg_hook, code, wParam, lParam);

* Call window procedure hook function. The sole purpose of the function is
* just to get the handle of the notepad main window
LRESULT CALLBACK CallWndProc(int code, WPARAM wParam, LPARAM lParam)
    CWPSTRUCT *msg_str = NULL;
    char window_class_name[50];

    if (code != HC_ACTION)
        return CallNextHookEx(g_callwnd_hook, code, wParam, lParam);

    msg_str = (CWPSTRUCT *)lParam;
    if (msg_str->message == WM_CREATE)
        GetClassName(msg_str->hwnd, window_class_name, 
                     sizeof(window_class_name) - 1);
        if (strcmp(window_class_name, "Notepad") == 0)
            g_hwnd = msg_str->hwnd;
    return CallNextHookEx(g_callwnd_hook, code, wParam, lParam);

Some tricky internals

I used both WH_GETMESSAGE<code> and WH_CALLWNDPROC. I was better off with using just WH_GETMESSAGE to monitor the keyboard events which were all I needed (almost all). However, to get the handle of the main Notepad window, I listened on the WM_CREATE message (which is not a queued message, so is not available through WH_GETMESSAGE).

Also, the WM_CREATE message is received multiple times in the hook procedure, therefore I had to check on the class name to find out the message for the main window. (I retrieved the class name from Spy++, shipped with Microsoft Visual Studio, which is "Notepad").

Windows regenerates notepad.exe kept in the system32 folder if it finds it missing/modified. Therefore you store the modified notepad.exe in a separate folder along with AutoSave.dll.

One little thing I was unable to understand about notepad.exe was that I was not able to capture keyboard accelerator events in GetMessageProc. Therefore, I decided to leave the idea of monitoring the save command given by the user (which had an initial intention of avoiding saving the contents again unnecessarily if the user has already saved the contents before the timer expired the next time).

Final word and warning

The purpose of this article was just to illustrate a method for modifying applications which do not have their source available.

The application has not been tried on all platforms and a lot of complicated scenarios have not been tested. It is recommended to try this approach on executables which have known logic.

History and further...

First document.

Besides numerous improvements that can be made, one that I can think of is using some utility like resource hacker to add another menu option of autosave in the File menu of notepad.exe and letting the user decide at runtime when to start/stop autosave.

However, the same is also possible by writing additional code using Windows ImgHelper.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

manik singhal
Web Developer
United States United States
No Biography provided

You may also be interested in...

Comments and Discussions

QuestionInfringement? Pin
Sharjith24-May-12 7:32
memberSharjith24-May-12 7:32 
Generalit doesn't work on windows 7 Pin
gndnet17-Sep-10 6:19
membergndnet17-Sep-10 6:19 
GeneralNo wonder windows crashes Pin
Jim Crafton23-Jul-07 4:39
memberJim Crafton23-Jul-07 4:39 
AnswerRe: No wonder windows crashes Pin
manik singhal23-Jul-07 6:36
membermanik singhal23-Jul-07 6:36 
GeneralRe: No wonder windows crashes Pin
Jim Crafton23-Jul-07 6:44
memberJim Crafton23-Jul-07 6:44 
GeneralRe: No wonder windows crashes Pin
hamo200823-Jul-07 17:53
memberhamo200823-Jul-07 17:53 
GeneralRe: No wonder windows crashes Pin
Jim Crafton23-Jul-07 17:56
memberJim Crafton23-Jul-07 17:56 
GeneralRe: No wonder windows crashes Pin
hamo200824-Jul-07 5:45
memberhamo200824-Jul-07 5:45 
QuestionGreat Work! [modified] Pin
Coolboy12321-Jul-07 17:36
memberCoolboy12321-Jul-07 17:36 
AnswerRe: Great Work! Pin
manik singhal23-Jul-07 6:15
membermanik singhal23-Jul-07 6:15 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.170627.1 | Last Updated 21 Jul 2007
Article Copyright 2007 by manik singhal
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid