GetWindowLongPtr with undocumented nIndex of -1

Question

I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:

Does anybody know what that function returns in that case?

Answer 1

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32:

I'd define it as such:

struct WF{
    WF_STATE state;
    WF_STATE2 state2;
    DWORD ExStyles;     //With additional bits
    DWORD Styles;
    HMODULE hModule;
    USHORT reserved;
    USHORT fnid;        // ?
};

So we can do:

WF* p_wf = (WF*)::GetWindowLongPtr(hWnd, -1);

Where WF_STATE is a bitfield:

enum WF_STATE{
    WNDS_HASMENU                 = 0x00000001,
    WNDS_HASVERTICALSCROOLLBAR   = 0x00000002,
    WNDS_HASHORIZONTALSCROLLBAR  = 0x00000004,
    WNDS_HASCAPTION              = 0x00000008,
    WNDS_SENDSIZEMOVEMSGS        = 0x00000010,
    WNDS_MSGBOX                  = 0x00000020,
    WNDS_ACTIVEFRAME             = 0x00000040,
    WNDS_HASSPB                  = 0x00000080,
    WNDS_NONCPAINT               = 0x00000100,
    WNDS_SENDERASEBACKGROUND     = 0x00000200,
    WNDS_ERASEBACKGROUND         = 0x00000400,
    WNDS_SENDNCPAINT             = 0x00000800,
    WNDS_INTERNALPAINT           = 0x00001000,
    WNDS_UPDATEDIRTY             = 0x00002000,
    WNDS_HIDDENPOPUP             = 0x00004000,
    WNDS_FORCEMENUDRAW           = 0x00008000,
    WNDS_DIALOGWINDOW            = 0x00010000,
    WNDS_HASCREATESTRUCTNAME     = 0x00020000,
    WNDS_SERVERSIDEWINDOWPROC    = 0x00040000,      //WndProc is in win32k.sys
    WNDS_ANSIWINDOWPROC          = 0x00080000,
    WNDS_BEINGACTIVATED          = 0x00100000,
    WNDS_HASPALETTE              = 0x00200000,
    WNDS_PAINTNOTPROCESSED       = 0x00400000,
    WNDS_SYNCPAINTPENDING        = 0x00800000,
    WNDS_RECEIVEDQUERYSUSPENDMSG = 0x01000000,
    WNDS_RECEIVEDSUSPENDMSG      = 0x02000000,
    WNDS_TOGGLETOPMOST           = 0x04000000,
    WNDS_REDRAWIFHUNG            = 0x08000000,
    WNDS_REDRAWFRAMEIFHUNG       = 0x10000000,
    WNDS_ANSICREATOR             = 0x20000000,
    WNDS_MAXIMIZESTOMONITOR      = 0x40000000,
    WNDS_DESTROYED               = 0x80000000,
};

and WF_STATE2 is another bitfield:

enum WF_STATE2{
    WNDS2_WMPAINTSENT               = 0x00000001,
    WNDS2_ENDPAINTINVALIDATE        = 0x00000002,
    WNDS2_STARTPAINT                = 0x00000004,
    WNDS2_OLDUI                     = 0x00000008,
    WNDS2_HASCLIENTEDGE             = 0x00000010,
    WNDS2_BOTTOMMOST                = 0x00000020,
    WNDS2_FULLSCREEN                = 0x00000040,
    WNDS2_INDESTROY                 = 0x00000080,
    WNDS2_WIN31COMPAT               = 0x00000100,
    WNDS2_WIN40COMPAT               = 0x00000200,
    WNDS2_WIN50COMPAT               = 0x00000400,
    WNDS2_MAXIMIZEDMONITORREGION    = 0x00000800,
    WNDS2_CLOSEBUTTONDOWN           = 0x00001000,
    WNDS2_MAXIMIZEBUTTONDOWN        = 0x00002000,
    WNDS2_MINIMIZEBUTTONDOWN        = 0x00004000,
    WNDS2_HELPBUTTONDOWN            = 0x00008000,
    WNDS2_SCROLLBARLINEUPBTNDOWN    = 0x00010000,
    WNDS2_SCROLLBARPAGEUPBTNDOWN    = 0x00020000,
    WNDS2_SCROLLBARPAGEDOWNBTNDOWN  = 0x00040000,
    WNDS2_SCROLLBARLINEDOWNBTNDOWN  = 0x00080000,
    WNDS2_ANYSCROLLBUTTONDOWN       = 0x00100000,
    WNDS2_SCROLLBARVERTICALTRACKING = 0x00200000,
    WNDS2_FORCENCPAINT              = 0x00400000,
    WNDS2_FORCEFULLNCPAINTCLIPRGN   = 0x00800000,
    WNDS2_FULLSCREENMODE            = 0x01000000,
    WNDS2_CAPTIONTEXTTRUNCATED      = 0x08000000,
    WNDS2_NOMINMAXANIMATERECTS      = 0x10000000,
    WNDS2_SMALLICONFROMWMQUERYDRAG  = 0x20000000,
    WNDS2_SHELLHOOKREGISTERED       = 0x40000000,
    WNDS2_WMCREATEMSGPROCESSED      = 0x80000000,
};

The Styles and ExStyles members seem to closely resemble documented window styles (and extended styles) but have their own undocumented bits as well.

fnid might be this, but I could not verify it.