Registered Window Message String

[Joseph M. Newcomer]

I'm looking for a way to convert the Registered Window Message back to the string that
created it. I thought it might be a GlobalAtom, but it isn't. There appears to also be
no "undocumented" API relating to retrieving the string.
joe
Joseph M. Newcomer [MVP]
email: newc...@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm

[Giovanni Dicanio]

"Joseph M. Newcomer" <newc...@flounder.com> ha scritto nel messaggio
news:i0o2e3dd5gifnff27...@4ax.com...

> I'm looking for a way to convert the Registered Window Message back to the
> string that
> created it. I thought it might be a GlobalAtom, but it isn't. There
> appears to also be
> no "undocumented" API relating to retrieving the string.

Joe: could it be possible that they use some kind of hashing string -->
integer function, from the input string to the message integer identifier,
and so the input string is lost once they built the message integer
identifier?

Maybe you might try to ask to the Platform SDK group (or the private
Platform SDK group, too), or try to step into the register window message
API implementation to do some reverse engineering and try to understand the
implementation...

Giovanni

[Joseph M. Newcomer]

Spy++ is able to retrieve the string, possibly by using some undocumented API. So the
string definitely exists.

I don't have access to private groups because all attempts to access them result in some
code attacking my computer (I do not allow any form of client-side scripting to pass
through my firewalls. Client-side scripting should be considered a hostile attack and I
consider its use in Web sites both unethical and immoral).
joe

[Giovanni Dicanio]

"Joseph M. Newcomer" <newc...@flounder.com> ha scritto nel messaggio

news:vmt2e3dto17khpt56...@4ax.com...

> Spy++ is able to retrieve the string, possibly by using some undocumented
> API. So the
> string definitely exists.

OK, so the string does exist.

> I don't have access to private groups because all attempts to access them
> result in some
> code attacking my computer (I do not allow any form of client-side
> scripting to pass
> through my firewalls. Client-side scripting should be considered a
> hostile attack and I
> consider its use in Web sites both unethical and immoral).

Joe: you can access the private newsgroup using just Outlook Express or
Gravity or Agent... no need for a web interface client (and the dangerous
script attacks you mention).
(For example, I'm using Outlook Express to access them.)

Giovanni

[Giovanni Dicanio]

"Joseph M. Newcomer" <newc...@flounder.com> ha scritto nel messaggio

news:vmt2e3dto17khpt56...@4ax.com...

> Spy++ is able to retrieve the string, possibly by using some undocumented
> API. So the
> string definitely exists.

Joe: I don't know about Spy++'s implementation, but it seems that
GetClipboardFormatName could help solving your problem, in fact it seems
that Windows uses the same algorithm for RegisterClipboardFormat and
RegisterWindowMessage! ?_?

Giovanni

[AliR (VC++ MVP)]

Nice catch, how did you figure that out?

AliR.

"Giovanni Dicanio" <giovanni...@invalid.it> wrote in message
news:u6X5N3W8...@TK2MSFTNGP06.phx.gbl...

[Joseph M. Newcomer]

Super! That was it!
joe

[Giovanni Dicanio]

"AliR (VC++ MVP)" <Al...@online.nospam> ha scritto nel messaggio
news:9hgEi.49180$Um6....@newssvr12.news.prodigy.net...

> Nice catch, how did you figure that out?

I don't know... maybe we could define it kind of "intuition" (even if I
don't know if it's the proper translation of the Italian word...), and
*lucky*, of course. :)

Joe wrote that he had investigated and it was not an atom.

OK, so think about a Windows API that gets a string as input and returns an
UINT. I don't know lots of Windows APIs, but one of them that follows this
pattern (string --> UINT) is RegisterClipboardFormat, of course. So, OK,
same signature: input string, returns UINT.
Then, you read the documentation of RegisterClipboardFormat and
RegisterWindowMessage APIs, and you find:

* RegisterWindowMessage:
[...]
If the message is successfully registered, the return value is a message
identifier in the range 0xC000 through 0xFFFF.

* RegisterClipboardFormat:
[...]
Registered clipboard formats are identified by values in the range 0xC000
through 0xFFFF.

So, you have also *same ranges*!

So you think that they could have a common algorithm to map a string into
such same ranges.

Then - as we say in Italy - you do "2+2" :)

Fortunately, there exists the "RegisterClipboardFormat ^ (-1)", which is
GetClipboardFormatName.

And you write about four lines of code and verify.

Giovanni

[Alexander Grigoriev]

I think they all go through GlobalAddAtom/GlobalGetAtomName.

"Joseph M. Newcomer" <newc...@flounder.com> wrote in message
news:q1b3e3dhm00nj8r97...@4ax.com...

[Joseph M. Newcomer]

Actually, they don't, because if you try to get the global atom name, you get an error and
an empty string. But the GetClipboardFormatName works correctly and gives the correct
string.
joe

[Alexander Grigoriev]

"For example, registered clipboard formats are stored in an internal atom
table used by the system. An application adds atoms to this atom table using
the RegisterClipboardFormat function."

So this table is not accessible through GlobalGetAtomNAme. But it happens to
be shared with registered messages.

"Joseph M. Newcomer" <newc...@flounder.com> wrote in message

news:5i24e3po2jshi07ba...@4ax.com...

[Giovanni Dicanio]

"Alexander Grigoriev" <al...@earthlink.net> ha scritto nel messaggio
news:%23uUuQyh...@TK2MSFTNGP05.phx.gbl...

> So this table is not accessible through GlobalGetAtomNAme. But it happens
> to be shared with registered messages.

Actually, it seems that RegisterWindowMessage and RegisterClipboardFormat
are the *same* function, or point to the same entry in user32.dll.

I've tried:

C:\WINDOWS\system32>dumpbin /EXPORTS user32.dll >c:\user32.txt

And then you can read in the output text file that RegisterWindowMessageA/W
have the *same* RVA of RegisterClipboardFormatA/W !

<partial dump result>
ordinal hint RVA name
552 227 00008E00 RegisterWindowMessageA
553 228 0000ADDE RegisterWindowMessageW

539 21A 00008E00 RegisterClipboardFormatA
540 21B 0000ADDE RegisterClipboardFormatW
</partial dump result>

So, basically, it seems that RegisterWindowMessage is an "alias" for
RegisterClipboardFormat...
And so it is shown why GetClipboardFormatName works as
RegisterWindowMessage^(-1).

Thanks to Igor Tandetnik for private communication to clarify this issue (he
also had thought about global atom, but after my point about
GetClipboardFormatName to solve the problem, he discovered that
RegisterClipboardFormat is aliased to RegisterWindowMessage by the .DEF
file).

Giovanni

[Joseph M. Newcomer]

Absolutely fascinating! (Too bad we had to discover things like this on our own, instead
of having decent documentation that states it explicitly!)
joe

[Giovanni Dicanio]

"Joseph M. Newcomer" <newc...@flounder.com> ha scritto nel messaggio
news:enh6e3tu4qe609qdk...@4ax.com...

> Absolutely fascinating! (Too bad we had to discover things like this on
> our own, instead
> of having decent documentation that states it explicitly!)

Joe: I agree with you.

Maybe all this is undocumented behavior that cannot be relied up for future
version of Windows...
I don't know.

I would have liked to make a post to TheOldNewThing blog, in the suggestion
box. But the suggestion box is closed.
(The author says that he would maybe reopen the suggestion box in 2010 :)
... but maybe in 2010 we will have WPF++, who knows... :) so this argument
could become obsolete and lacking of interest in that future.)

IMHO, a good design would have been that to provide just a
GetRegisteredWindowMessageName API.

Giovanni

[Joseph M. Newcomer]

Yes, that would have been Intelligent Design. But we know software actually evolves,
since there is rarely any evidence of intelligent design anywhere...
joe