Winsight of Delphi Tool

Winsight: window detection (spying on Windows)

Note

Winsight cannot work normally in win7, so we will introduce the winsight tool in the XP environment.

Winsight is a tool that users can use to detect windows. Winsight displays every window of every running application and Application (do not forget, the control is also a window ). Winsight also displays each message generated by Windows (that is, each message sent to the window ).

You can choose to view all messages or messages sent in a specific window. To start winsight, find ws32.exe in Windows Resource Manager and double-click the file (the file is in the Delphi7 \ bin directory ). Like image editor, winsight is also an independent program that can be run outside of Delphi IDE. For example, Windows Resource Manager winsight is being investigated.

As you can see, the winsight window is divided into two panes, the upper pane lists the active windows, and the lower pane displays messages sent to a specific window or all windows. Drag the separation bar between two panes to adjust the size of the pane. Lack of time, the winsight window is divided horizontally into two parts; a single user can also choose Vertical Split. For example:

To change the layout of the winsight window, choose split horizontal or split vertical from the View menu.

Next we will first introduce Windows messages.

Windows Messaging System)

If you are not familiar with windows, it is useless to detect windows. Therefore, you must spend some time learning windows programming to understand all the information displayed by winsight.

Delphi is an advanced platform that allows users to write truly independent Windows applications in the shortest time. If there is a disadvantage in this programming environment, the user has no chance to understand what actually drives the windows application program.

A Windows application is driven by messages and many messages. Windows sends a window message to indicate that the window action or notification window event has occurred. For example, if a window is to be refreshed, Windows sends a wm_paint message to it, which indicates that the window is refreshed.

When a window is changed, Windows sends a wm_windowposchanging Message notification window, and its size or position is changing. After the window size and position are modified, the wm_windowposchanged message and wm_size message are also sent to this window. In a common Windows environment, messages are sent dozens or even hundreds of times in one second.

Windows sends more than 100 messages to applications. A small amount of Windows messages have been described in the previous sections. Many events that the Delphi Program responds to are Windows messages. The oncreate event is generated in response to the wm_create message. You can continue with the example. Delphi enables users to process messages at a higher level, so users do not need to write more important parts of the application.

Eventually, users will want to know what driver windows is running. Delphi's biggest advantage is that users can quickly learn to write Windows programs and learn more deeply.

Note

Some very good Windows programmers may say that they should first learn to write Windows programs in C language. They believe that C language programming is essential for every Windows programmer, No matter what programming environment he uses. Although I agree that this is the best idea, I still think that today few programmers can spend so much time learning C programming.

After briefly introducing the Windows message, let's look back at how winsight works.

 

Window Detection (spying on a window)

The upper pane of A winsight window is called a window tree. The window Tree displays all the currently opened windows. It also displays some details about the window classes of a specific window. This information is displayed as follows:

Overlapped 0007013c {cabinetwclass} EXPLORER. EXE (879,80)-(1679,680) "E: \ hypersnap 7"

The first entry of the row indicates the window type of the window. Here is an overlapping window (ws_overlapped window). Other window types include subwindows and pop-up windows. overlapping windows, subwindows, and pop-up windows are the most common window types.

The second item indicates the window handle (hwnd), which is related to the handle attribute of the VCL window component.

The third item is the window class name enclosed in braces. The application uses this class name to register the window. Generally, multiple Windows share a class name. For example, the generic button component class is called button, and dozens of buttons may exist in different applications at the same time, but they are the same window class. When the application is a Delphi application, winsight displays the VCL class representing the component for forms and components. For a button component, the class name displayed by winsight is tbutton. For example:

Note

When developing delphi1, Delphi is the project code name, and the product name is intended to be appbuilder. Later, Delphi became the official product name. When you use winsight to detect Delphi IDE, you will find that the class in the main window of Delphi is called tappbuilder. This is a proof of this statement. For example:

The fourth item is the module name of the window creation process. Generally, this module is an executable program. The alias is assumer.exe. The size and position of a window are followed by the window body. For overlapping windows, the window body indicates the text on the title bar. For other window types, the meaning of the window body varies with the window type. For example, the window body of a button refers to the text on the button.

Note

Creating an implicit window in an application to complete specific tasks is a common practice for commercial applications. The implicit window only displays "hidden" after the module. Because the window is hidden, there is no size, position information, or window body. For example:

The window tree is layered, the top layer of the tree is Windows desktop, and the next layer is all sub-windows on the desktop. For example, the executable file is located under the desktop node. Each desktop window can also have its own subwindow. The parent window, child window, and same-level window are connected by a line.

Look, there is a diamond on the left of each item in the tree window. If a window has a subwindow, the diamond on the left contains a "+" or "-". "+" indicates that the node is a contraction node, you can expand it to display subwindows. "-" indicates that the node has been expanded and its subwindows have been displayed. You can expand or contract nodes by clicking any part on the left of the project in the window tree. When the diamond is empty, no subwindow is identified.

Note

If a window in the window tree is enabled, the diamond on the left will flash whenever the window receives a message from windows.

 

Message trace options)

The message tracing window displays a single message generated by windows. A typical message tracing item is as follows:

000747: 00290220 "H □□“ wm_keydown dispatched 48 h 72d vk_h scan 23 h down

There is no need to analyze the content in detail, because the content varies greatly with the message. Here, a memo component receives a wm_keydown message with the vk_h parameter. In other words, it is to press the H key when the cursor is on the memo component. As you can see, some information in the message tracking item also appears in the window tree, such as the window handle and class name.

Select Start! From the main menu !] You can start message tracing. the messages received in the window appear in the message tracing window. To terminate message tracing, choose [Stop!] from the main menu !] Menu item.

Note

[Stop !] And [start !] The menu item occupies the same position on the menu bar of the main menu. When the message tracking is disabled, this menu item is start !]; When the message tracing is running, this menu item is [Stop !].

When a message is received in the message tracking window, the message can be rolled in the window. You can terminate the message tracing and scroll to view any messages in the message tracing window. Another option is to output a message to a log file.

Winsight allows you to view messages sent to all windows or messages sent to a specific window. To view all messages, select message | all windows from the main menu. Although you can choose to view all messages sent to all windows, this is usually inefficient; it is difficult for users to find desired messages because there are many and complex messages in the window.

A better way is to select a specific window to monitor the messages received by the window. In this way, the message tracing window can be easily managed. To view the message of a specific window, you can first find the window in the message tree, click it to select it; then select messages | selected windows from the main menu, and then select start!] Menu, any message sent to the selected window will appear in the message tracking window.

Note

When using winsight, you 'd better first think about the content you want to view. Because many messages are sent to a single window, the messages you want to view may quickly roll over the screen. To maximize the benefits of winsight, you can select the window for viewing messages, start message tracing, operate the window as needed, and close message tracing.

 

Message tracing options

In the message trace Options dialog box, you can control the display of messages in the message tracing window and change the display mode of messages. You can select messages | options from the main menu to bring up the message trace Options dialog box. You can control the display of messages in the message tracing window and change the display mode of messages. You can select messages | options from the main menu to bring up the message trace Options dialog box.

The area marked with messages to trace in the dialog box is the subject of the dialog box. There are several message groups on the left of this area, and a list box on the right, showing all Windows messages. When you select or cancel a message group, the corresponding message in the list is selected or unselected.

Note

All uppercase messages in the list are standard Windows messages, while Windows messages in the document are not recorded in the lower-case messages. Windows messages not recorded in the document are used in windows and cannot be found in the Windows API help file.

 

When the all messages check box is selected, winsight tracks all Windows messages. To reduce the clutter of the message tracing window, you can select to view only a few message groups. For example, if you only want to view the mouse message, you can close the all messages check box and select the mouse check box. To further clarify the messages to be identified, you can disable all options and select a specific message from the list. For example, if you only want to view the wm_lbuttondown message, you can disable all options and select the wm_lbuttondown message from the list box. The message tracing window will only display the wm_lbuttondown message.

In the message trace Options dialog box, another set of options controls the display mode of messages in the message trace window. For example:

The interpret values option notifies winsight that the parameters of each message are decomposed into readable formats. For example, if a wm_keydown message is given, the following information is displayed in the message tracking window:

If the interpret values option is checked, the following message is displayed:

Most of the time, you prefer more detailed display, so you generally select the interpret values option.

The hex values option notifies winsight that the values in the message tracing window are displayed in hexadecimal format. If you have some programming experience, you will find this option useful in some situations. The show times option is of little use. It displays the system time.

The log file option allows you to store the message tracing results to files on the disk. When this option is selected, the message is still displayed in the message tracing window. This option is useful when you need to back up the generated messages.

Note

Creating a log file has another advantage: after creating a log file, you can open it in a text editor and view it using the search function provided by the text editor, view the specific message or message parameters.

 

Other winsight features (Other winsight features)

Winsight also has some other features that can make window detection more flexible and convenient.

1) view the window details

The detail feature of winsight displays all relevant details of a specific window. To view a window in detail, select the window in the window tree, select the [Spy | open detail] menu item from the main menu, or double-click the window in the window tree or press Enter. For example, the details of Windows Resource Manager are displayed.

As you can see, the detail window displays a large amount of information about the window.

2) follow focus

This option enables you to select a window in the application and make it an active window in the window tree. The window tree usually contains dozens of windows. It is not easy to find the window to be viewed in it. Therefore, follow focus can bring convenience to users.

To use this feature, select the [Spy | follow focus] menu item from the main menu and switch to the application that contains the window to be investigated, click a specific control (if needed) to be detected in the window. winsight automatically selects the control in the window tree. Select Start! From the main menu !] Menu to start window detection.

Tip

Once the follow focus option is enabled, it will remain open until the user closes it. When the user finds the window to be investigated in the application and does not view other windows or controls in the program, the follow focus option should be immediately disabled.

3) Find window)

Winsight's find window feature is opposite to follow focus: In the window tree, find the current window to be viewed, and then select the [Spy | find window] menu item from the main menu, winsight will display a rough border around the window and flash the border.

Click this window, or select another window from the window tree. The thick border disappears. The thick border is always displayed on top of all windows, so you can find any window on the screen, even if the window is hidden under other windows. The window found with the find window is not raised to the top, nor the input focus. It is identified only.

Note

The find window cannot be used to find an implicit window or a minimized window.

When the input focus leaves the window tree, the find window mode is closed. If you click on another application or another position in winsight, the find window mode is also disabled.

4) switch)

The switch to feature enables users to switch to a specific window in an application. To switch to a window, select the window in the window tree and select the [Spy | switch to] menu item from the main menu. The window will appear at the top of the screen, and has the input focus. If the window is a minimization window, it is restored to the previous position. Switch to does not work for implicit windows.

 

To understand every message and lease in winsight, it is not a matter of time. We need to take some events to actually use winsight, so that we can finally master it.