2

I'm using the SetWinEventHook function to monitor windows as they appear and disappear, i.e. become visible and hidden, by using code similar to the one Raymond Chen provides in his article Using accessibility to monitoring windows as they come and go.

So far, this method worked for all windows, but I've stumbled upon a program which isn't being reported as shown. It is the Kuwo 2014 installer, which you can get here.

Why isn't it being reported? What's so special about it? What is the correct way to detect it?

Here's a sample project, with source code and binary. It's very similar to the one in the article of Raymond Chen, except that it captures only top level windows.

Here's a screenshot which demonstrates the issue:

demo

Paul
  • 6,061
  • 6
  • 39
  • 70
  • Is this specific to *this* installer, or to *any* installer (or elevated apps in general)? I suspect you might be running into some UIPI issues. – Eric Brown Feb 17 '14 at 02:11
  • @EricBrown, Looks like it's specific to _this_ installer (to its main window). Elevated apps get captured in the log. As you can see, the confirmation dialog is logged as being shown and hidden. The window is also being logged as hidden, but not as shown. – Paul Feb 17 '14 at 08:22
  • I checked your code, and this line `if (hwnd == GetAncestor(hwnd, GA_ROOT))` seems somewhat problematic; in particular, if the window is a popup, it might return the wrong value. What happens if you have `if (NULL == GetParent(hwnd))`? – Eric Brown Feb 17 '14 at 20:24
  • @EricBrown, the windows doesn't get shown in the list with that line removed, too. Its child controls appear, but the main window doesn't. – Paul Feb 17 '14 at 20:39
  • Hm. Which OS version is this? It's possible that the installer is using some other APIs that don't generate EVENT_OBJECT_SHOW (could be EVENT_OBJECT_UNCLOAK, for example); I'd look at all events and see what events are appearing. – Eric Brown Feb 17 '14 at 21:02
  • @EricBrown, I'm not sure that matters, but it's Windows 8. What is `EVENT_OBJECT_UNCLOAK`? It doesn't seem to be documented. – Paul Feb 17 '14 at 21:13
  • It's a new event type in Windows 8; you can see the def in winuser.h. I can't find out exactly what user-level actions result in the event being fired (I can see it from kernel mode, but it's not obvious how it gets there from user mode). – Eric Brown Feb 17 '14 at 21:42
  • @EricBrown, I've just tried `EVENT_OBJECT_UNCLOAK`, it doesn't work. Seems like the event gets fired only for metro apps, which is logical as it was introduced in Windows 8. – Paul Feb 17 '14 at 22:24
  • let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/47706/discussion-between-eric-brown-and-paul) – Eric Brown Feb 17 '14 at 23:38

0 Answers0