View the running process of Windows applications from the perspective of Windows messages

The framework of a typical Win32 Window application is as follows:
Program entry point (winmain function) --> Register window class (call registerclass function or registerclassex function) --> Create Main Window (call createwindow function or createwindow Wex function) --> display the main window (call the showwindow function) --> Update the main window (call the updatewindow function) --> enter the message loop (getmessage, translatemessage, dispatchmessage) and process various Windows messages (window procedure function) --> program exit point (returned by winmain ). As in the following example:

# Include <windows. h>
# Include <tchar. h>
// Window class name and window title
Tchar szwindowclass [] = _ T ("hellowindows ");
Tchar szwindowtitle [] = _ T ("this is the main window ");
// Window Process Functions
Lresult callback wndproc (hwnd, uint MSG, wparam, lparam)
{
// Logmessage (logfile, MSG, wparam, lparam );//
Switch (MSG)
{
Case wm_destroy:
Postquitmessage (0 );
Return 0;
Default:
Return defwindowproc (hwnd, MSG, wparam, lparam );
}
}

Int winapi _ twinmain (hinstance, hinstance, lptstr lpcmdline, int ncmdshow)
{
// Register the window class
Wndclassex wcex;
Wcex. cbsize = sizeof (wndclassex );
Wcex. Style = cs_hredraw | cs_vredraw;
Wcex. lpfnwndproc = (wndproc) wndproc;
Wcex. cbclsextra = 0;
Wcex. cbwndextra = 0;
Wcex. hinstance = hinstance;
Wcex. hicon = NULL;
Wcex. hcursor = loadcursor (null, idc_arrow );
Wcex. hbrbackground = (hbrush) (color_window + 1 );
Wcex. lpszmenuname = NULL;
Wcex. lpszclassname = szwindowclass;
Wcex. hiconsm = NULL;
Registerclassex (& wcex );
// Create the Main Window
Hwnd = createdomainwex (0, szwindowclass, szwindowtitle, ws_overlappedwindow,
128, 96,512,480, hwnd_desktop, null, hinstance, null );
 
If (! Hwnd)
Return false;
// Display and update the Main Window
Showwindow (hwnd, ncmdshow );
Updatewindow (hwnd );
// Enter the message loop
MSG;
While (getmessage (& MSG, null, 0, 0 ))
{
Translatemessage (& MSG );
Dispatchmessage (& MSG );
}
Return msg. wparam;
// Exit the program
}

This example is very simple. It just shows a window and it is finished. However, although the sparrow is small and dirty, it can basically be used as a Win32 window program framework.
The following figure shows its Window Process wndproc. It only processes one message: wm_destroy, and the rest of the messages are handed over to Windows for processing (call defwindowproc ). For an actual windows program, there will be a lot of messages to be processed during the window process; however, there are hundreds of Windows messages, no matter how many messages you process, for the rest, you still have to call defwindowproc and hand it over to the Windows system for processing. This time, let's take a look at how much work defwindowproc will help us from program startup to exit.
The idea of the experiment is very simple. We can record all the messages passed to the window process in a log file and view all the messages in the life process of a program. In the above example, we call a method at the beginning of the window function wndproc (such as the comment-out line: logmessage (logfile, MSG, wparam, lparam )), record the passed message type, wparam parameter, and lparam Parameter order to form a Windows message log file.
The following are the results of the two experiments (assuming hellowin. EXE is obtained after the preceding example is compiled ):
Experiment 1: Select hellowin. EXE in file management and press enter to start. press Alt + F4 to close the main window. The log file obtained is as follows:

Description of time message code Parameters
Hh: mm: Ss. mss msg wparam lparam decription
03:21:39. 187 0x0024 0x00000000 0x0012f910 wm_getminmaxinfo get maximization minimization Information
03:21:39. 187 0x0081 0x00000000 0x0012f908 wm_nccreate window non-customer zone created
03:21:39. 187 0x0083 0x00000000 0x0012f930 wm_nccalcsize calculate the size of the non-customer Zone
(Wparam: false-> do not specify the valid region of the window customer area)
03:21:39. 187 0x0001 0x00000000 0x0012f8d4 wm_create Main Window created
03:21:39. 187 0x0018 0x00000001 0x00000000 wm_showwindow
(Wparam: True-> display window lparam: 0-> indicates that the message is sent by calling the showwindow function)
03:21:39. 187 0x0046 0x00000000 0x0012feb0 wm_windowposchanging window position (including size) is changing
03:21:39. 203 0x001c 0x00000001 0x00000584 wm_activateapp Window Process activation status change
(Wparam: True-> activate lparam: thread id = 0x0584)
03:21:39. 203 0x0086 0x00000001 0x00000000 wm_ncactivate the activation status of non-customer zones needs to be changed
(Wparam: True-> activate activated)
03:21:39. 203 0x007f 0x00000002 0x00000000 wm_geticon get small icon 2
(Wparam: 2 ----> icon_small2)
03:21:39. 203 0x007f 0x00000000 0x00000000 wm_geticon get small icon
(Wparam: 0 ----> icon_small)
03:21:39. 203 0x007f 0x00000001 0x00000000 wm_geticon get the big icon
(Wparam: 1 ----> icon_big)
03:21:39. 203 0x0006 0x00000001 0x00000000 wm_activate window activation status change
(Wparam: 1 ----> wa_active activation)
03:21:39. 203 0x0281 0x00000001 0xc000000f wm_ime_setcontext Input Method true-> active
03:21:39. 203 0x0282 0x00000002 0x00000000 wm_ime_policy Input Method imn_openstatuswindow
03:21:39. 203 0x0007 0x00000000 0x00000000 wm_setfocus window get input focus
03:21:39. 218 0x0085 0x00000001 0x00000000 wm_ncpaint non-customer areas need to be repainted
(Wparam: 1 ----> the entire window (Window Frame) needs to be re-painted.
03:21:39. 218 0x0014 0x0101005d 0x00000000 wm_erasebkgnd erase background
03:21:39. 218 0x0047 0x00000000 0x0012feb0 wm_windowposchanged window position (including size) has changed
03:21:39. 218 0x0083 0x00000001 0x0012faec wm_nccalcsize calculate the size of the non-customer Zone
(Wparam: True-> nccalcsize_params parameter is valid (based on this parameter, the redraw area is calculated)
03:21:39. 218 0x0085 0x00000001 0x00000000 wm_ncpaint non-customer areas need to be repainted
(Wparam: 1 ----> the entire window (Window Frame) needs to be re-painted.
03:21:39. 218 0x0014 0x890116b8 0x00000000 wm_erasebkgnd erase background
03:21:39. 218 0x0005 0x00000000 0x01be01f8 wm_size the window size has changed
(Wparam: 0-> size_restored is neither maximized nor minimized (msdn says so ......))
03:21:39. 218 0x0003 0x00000000 0x007e0084 wm_move window moved
(Lparam: x = 84 [132] Y = 7E [126] indicates the new coordinates of the window customer zone)
03:21:39. 218 0x000f 0x00000000 0x00000000 wm_paint window the customer area needs to be re-painted
03:21:39. 218 0x007f 0x00000002 0x00000000 wm_geticon 2 ----> icon_small2
03:21:39. 218 0x007f 0x00000000 0x00000000 wm_geticon 0 ----> icon_small
03:21:39. 218 0x007f 0x00000001 0x00000000 wm_geticon 1 ----> icon_big
========================================================== ========================================================== ===
03:21:39. 375 0x0101 0x0000000d 0xc01c0001 wm_keyup a key is pressed on the keyboard.
(Wparam: 0d ---> vk_return (enter key) lparam: recnt: 1; sccode: 1C; NON-EXKEY)
03:21:41. 000 0x0104 0x00000012 0x20380001 wm_syskeydown system key pressed
(Wparam: 12 ---> vk_menu (Alt key) lparam: recnt: 1; sccode: 38; Alt-down)
03:21:41. 609 0x0104 0x00000073 0x203e0001 wm_syskeydown system key pressed
(Wparam: 73 ---> vk_f4 (F4 key) lparam: recnt: 1; sccode: 3E; Alt-down (Alt key is also pressed ))
========================================================== ========================================================== ========
03:21:41. 609 0x0112 0x0000f060 0x00000000 wm_syscommand system command
(Wparam: f060-> SC _close)
03:21:41. 609 0x0010 0x00000000 0x00000000 wm_close window needs to be closed
03:21:41. 609 0x0046 0x00000000 0x0012f8a0 wm_windowposchanging window position (including size) is changing
03:21:41. 609 0x0047 0x00000000 0x0012f8a0 wm_windowposchanged window position (including size) has changed
03:21:41. 609 0x0086 0x00000000 0x00000000 wm_ncactivate window non-customer activation status change
(Wparam: false-> inactivate is not activated)
03:21:41. 625 0x0006 0x00000000 0x00000000 wm_activate window activation status change
(Wparam: 0 -----> wa_inactivate is not activated)
03:21:41. 625 0x001c 0x00000000 0x00000584 wm_activateapp Window Process activation status change
(Wparam: false-> inactivate tid = 0584)
03:21:41. 625 0x0008 0x00000000 0x00000000 wm_killfocus window lost input focus
03:21:41. 625 0x0281 0x00000000 0xc000000f wm_ime_setcontext Input Method false-> inactivate
03:21:41. 625 0x0282 0x00000001 0x00000000 wm_ime_notify Input Method imn_closestatuswindow
03:21:41. 625 0x0002 0x00000000 0x00000000 wm_destroy window destroyed
03:21:41. 625 0x0082 0x00000000 0x00000000 wm_ncdestroy window non-customer zone destroyed

Experiment 2: In file management, double-click hellowin. EXE to start the program. After the main window is displayed, move the mouse to the close button in the upper right corner of the window to close the program. The resulting log file is as follows:

Description of time message code Parameters
Hh: mm: Ss. mss msg wparam lparam decription
04:29:01. 421 0x0024 0x00000000 0x0012f910 wm_getminmaxinfo
04:29:01. 421 0x0081 0x00000000 0x0012f908 wm_nccreate
04:29:01. 421 0x0083 0x00000000 0x0012f930 wm_nccalcsize
04:29:01. 421 0x0001 0x00000000 0x0012f8d4 wm_create
04:29:01. 421 0x0018 0x00000001 0x00000000 wm_showwindow
04:29:01. 421 0x0046 0x00000000 0x0012feb0 wm_windowposchanging
04:29:01. 437 0x001c 0x00000001 0x00000584 wm_activateapp
04:29:01. 437 0x0086 0x00000001 0x00000000 wm_ncactivate
04:29:01. 437 0x007f 0x00000002 0x00000000 wm_geticon
04:29:01. 437 0x007f 0x00000000 0x00000000 wm_geticon
04:29:01. 437 0x007f 0x00000001 0x00000000 wm_geticon
04:29:01. 437 0x0006 0x00000001 0x00000000 wm_activate
04:29:01. 437 0x0281 0x00000001 0xc000000f wm_ime_setcontext
04:29:01. 437 0x0282 0x00000002 0x00000000 wm_ime_notify
04:29:01. 437 0x0007 0x00000000 0x00000000 wm_setfocus
04:29:01. 437 0x0085 0x00000001 0x00000000 wm_ncpaint
04:29:01. 437 0x0014 0x8401_b2 0x00000000 wm_erasebkgnd
04:29:01. 437 0x0047 0x00000000 0x0012feb0 wm_windowposchanged
04:29:01. 437 0x0083 0x00000001 0x0012faec wm_nccalcsize
04:29:01. 437 0x0085 0x00000001 0x00000000 wm_ncpaint
04:29:01. 437 0x0014 0x0f01_3a 0x00000000 wm_erasebkgnd
04:29:01. 437 0x0005 0x00000000 0x01be01f8 wm_size
04:29:01. 437 0x0003 0x00000000 0x007e0084 wm_move
04:29:01. 437 0x000f 0x00000000 0x00000000 wm_paint
04:29:01. 437 0x007f 0x00000002 0x00000000 wm_geticon
04:29:01. 437 0x007f 0x00000000 0x00000000 wm_geticon
04:29:01. 437 0x007f 0x00000001 0x00000000 wm_geticon
========================================================== ========================================================== ==========
04:29:01. 828 0x0084 0x00000000 0x009e0266 wm_nchittest move the cursor or press the mouse key
(Lparam: current cursor position (relative to the upper left corner of the screen) x = 0266 [614] Y = 009e [236])
04:29:01. 828 0x0020 0x00a40268 0x02000001 wm_setcursor move the cursor
(Lparam: Hit-test code: 01-> htclient mouse message code in the customer area: 0200-> mousemove mouse)
04:29:01. 828 0x0200 0x00000000 0x002001e2 wm_mousemove move the mouse
(Lparam: current mouse position X = 01e2 [482] Y = 0020 [32])
***************
04:29:01. 984 0x0084 0x00000000 0x007f0268 wm_nchittest
(Lparam: current cursor position (relative to the upper left corner of the screen) x = 0268 [616] Y = 007f [127])
04:29:01. 984 0x0020 0x00a40268 0x02000001 wm_setcursor
(Lparam: Hit-test code: 01-> htclient mouse message code in the customer area: 0200-> mousemove mouse)
04:29:01. 984 0x0200 0x00000000 0x000101e4 wm_mousemove
(Lparam: current mouse position X = 01e4 [484] Y = 0001 [1])
04:29:02. 000 0x0084 0x00000000 0x007d0269 wm_nchittest
(Lparam: current cursor position (relative to the upper left corner of the screen) x = 0269 [617] Y = 007d [125])
04:29:02. 000 0x0020 0x00a40268 0x02000002 wm_setcursor move the cursor
(Lparam: Hit-test code: 02-> htcaption In the title area, the mouse message code: 0200-> mousemove the mouse)
04:29:02. 000 0x00a0 0x00000002 0x007d0269 wm_ncmousemove move the mouse in a non-customer Zone
(Wparam: Hit-test code: 02-> htcaption lparam: cursor position: x = 0269 [617] Y = 007d [125])
******************
04:29:02. 234 0x0084 0x00000000 0x0075026d wm_nchittest
(Lparam: current cursor position (relative to the upper left corner of the screen) x = 026d [621] Y = 0075 [117])
04:29:02. 234 0x0020 0x00a40268 0x02000014 wm_setcursor
(Lparam: Hit-test code: 14-> httopright in the upper right corner of the mouse message code: 0200-> mousemove the mouse)
04:29:02. 234 0x00a0 0x00000014 0x0075026d wm_ncmousemove
(Wparam: Hit-test code: 14-> httopright lparam: cursor position: x = 026d [621] Y = 0075 [117]
04:29:02. 296 0x0084 0x00000000 0x0075026d wm_nchittest
(Lparam: current cursor position (relative to the upper left corner of the screen) x = 026d [621] Y = 0075 [117])
04:29:02. 296 0x0020 0x00a40268 0x02010014 wm_setcursor
(Lparam: Hit-test code: 14-> httopright in the upper right corner of the mouse message code: 0201-> lbuttondown left mouse button is pressed
04:29:02. 296 0x00a1 0x00000014 0x0075026d wm_nclbuttondown left mouse button pressed in non-customer Zone
(Lparam: current cursor position (relative to the upper left corner of the screen) x = 026d [621] Y = 0075 [117])
04:29:02. 484 0x0215 0x00000000 0x00000000 wm_capturechanged is losing Mouse capture
(Lparam: 0 ----> hwnd_desktop desktop will get the mouse)
========================================================== ========================================================== ==============
04:29:02. 484 0x0112 0x0000f060 0x0075026d wm_syscommand f060 --> SC _close
04:29:02. 484 0x0010 0x00000000 0x00000000 wm_close
04:29:02. 484 0x0046 0x00000000 0x0012f5e4 wm_windowposchanging
04:29:02. 484 0x0047 0x00000000 0x0012f5e4 wm_windowposchanged
04:29:02. 484 0x0086 0x00000000 0x00000000 wm_ncactivate
04:29:02. 484 0x0006 0x00000000 0x00000000 wm_activate
04:29:02. 484 0x001c 0x00000000 0x00000584 wm_activateapp
04:29:02. 484 0x0008 0x00000000 0x00000000 wm_killfocus
04:29:02. 484 0x0281 0x00000000 0xc000000f wm_ime_setcontext
04:29:02. 484 0x0282 0x00000001 0x00000000 wm_ime_notify
04:29:02. 484 0x0002 0x00000000 0x00000000 wm_destroy
04:29:02. 484 0x0082 0x00000000 0x00000000 wm_ncdestroy
In experiment 2, the asterisks (*) omit many [WM_NCHITTEST-WM_SETCURSOR-WM_MOUSEMOVE] messages, which are generated all the time while moving the mouse, and the only difference is that the cursor positions are different.
From the windows messages recorded in the previous two log files, we can see that starting the program (from the keyboard or double-click the mouse) to the main window is finally displayed in front of us, windows has processed the wm_getminmaxinfo message from the start to the wm_geticon message before the first double dash, and closed a window from US (whether pressing Alt + F4 or clicking the "close" button) to exit the program, Windows needs to process the wm_syscommand after the second double line to the last wm_ncdestroy message. The messages generated during the running process of the program are between two dashes (the difference between the two log files above can be seen, which is related to the program's behavior ). It is worth mentioning that the program finally receives a message wm_quit, which is sent by the postquitmessage function and is captured by getmessage in the message loop. After the getmessage function captures the wm_quit message, false is returned, therefore, the winmain function exits the message loop and is not handed over to the window for processing. Therefore, it is not recorded above; then the program exits.
When writing a Windows program, we can also debug the program by recording the Windows message. As for how to come, I won't be so arrogant :)