3

I'm trying to reverse functionality of scrollbars in comctrl32.dll and I keep witnessing them calling GetWindowLongPtr function with undocumented index -1 as such:

enter image description here

Does anybody know what that function returns in that case?

5

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32:

enter image description here

I'd define it as such:

struct WF{
    WF_STATE state;
    WF_STATE2 state2;
    DWORD ExStyles;     //With additional bits
    DWORD Styles;
    HMODULE hModule;
    USHORT reserved;
    USHORT fnid;        // ?
};

So we can do:

WF* p_wf = (WF*)::GetWindowLongPtr(hWnd, -1);

Where WF_STATE is a bitfield:

enum WF_STATE{
    WNDS_HASMENU                 = 0x00000001,
    WNDS_HASVERTICALSCROOLLBAR   = 0x00000002,
    WNDS_HASHORIZONTALSCROLLBAR  = 0x00000004,
    WNDS_HASCAPTION              = 0x00000008,
    WNDS_SENDSIZEMOVEMSGS        = 0x00000010,
    WNDS_MSGBOX                  = 0x00000020,
    WNDS_ACTIVEFRAME             = 0x00000040,
    WNDS_HASSPB                  = 0x00000080,
    WNDS_NONCPAINT               = 0x00000100,
    WNDS_SENDERASEBACKGROUND     = 0x00000200,
    WNDS_ERASEBACKGROUND         = 0x00000400,
    WNDS_SENDNCPAINT             = 0x00000800,
    WNDS_INTERNALPAINT           = 0x00001000,
    WNDS_UPDATEDIRTY             = 0x00002000,
    WNDS_HIDDENPOPUP             = 0x00004000,
    WNDS_FORCEMENUDRAW           = 0x00008000,
    WNDS_DIALOGWINDOW            = 0x00010000,
    WNDS_HASCREATESTRUCTNAME     = 0x00020000,
    WNDS_SERVERSIDEWINDOWPROC    = 0x00040000,      //WndProc is in win32k.sys
    WNDS_ANSIWINDOWPROC          = 0x00080000,
    WNDS_BEINGACTIVATED          = 0x00100000,
    WNDS_HASPALETTE              = 0x00200000,
    WNDS_PAINTNOTPROCESSED       = 0x00400000,
    WNDS_SYNCPAINTPENDING        = 0x00800000,
    WNDS_RECEIVEDQUERYSUSPENDMSG = 0x01000000,
    WNDS_RECEIVEDSUSPENDMSG      = 0x02000000,
    WNDS_TOGGLETOPMOST           = 0x04000000,
    WNDS_REDRAWIFHUNG            = 0x08000000,
    WNDS_REDRAWFRAMEIFHUNG       = 0x10000000,
    WNDS_ANSICREATOR             = 0x20000000,
    WNDS_MAXIMIZESTOMONITOR      = 0x40000000,
    WNDS_DESTROYED               = 0x80000000,
};

and WF_STATE2 is another bitfield:

enum WF_STATE2{
    WNDS2_WMPAINTSENT               = 0x00000001,
    WNDS2_ENDPAINTINVALIDATE        = 0x00000002,
    WNDS2_STARTPAINT                = 0x00000004,
    WNDS2_OLDUI                     = 0x00000008,
    WNDS2_HASCLIENTEDGE             = 0x00000010,
    WNDS2_BOTTOMMOST                = 0x00000020,
    WNDS2_FULLSCREEN                = 0x00000040,
    WNDS2_INDESTROY                 = 0x00000080,
    WNDS2_WIN31COMPAT               = 0x00000100,
    WNDS2_WIN40COMPAT               = 0x00000200,
    WNDS2_WIN50COMPAT               = 0x00000400,
    WNDS2_MAXIMIZEDMONITORREGION    = 0x00000800,
    WNDS2_CLOSEBUTTONDOWN           = 0x00001000,
    WNDS2_MAXIMIZEBUTTONDOWN        = 0x00002000,
    WNDS2_MINIMIZEBUTTONDOWN        = 0x00004000,
    WNDS2_HELPBUTTONDOWN            = 0x00008000,
    WNDS2_SCROLLBARLINEUPBTNDOWN    = 0x00010000,
    WNDS2_SCROLLBARPAGEUPBTNDOWN    = 0x00020000,
    WNDS2_SCROLLBARPAGEDOWNBTNDOWN  = 0x00040000,
    WNDS2_SCROLLBARLINEDOWNBTNDOWN  = 0x00080000,
    WNDS2_ANYSCROLLBUTTONDOWN       = 0x00100000,
    WNDS2_SCROLLBARVERTICALTRACKING = 0x00200000,
    WNDS2_FORCENCPAINT              = 0x00400000,
    WNDS2_FORCEFULLNCPAINTCLIPRGN   = 0x00800000,
    WNDS2_FULLSCREENMODE            = 0x01000000,
    WNDS2_CAPTIONTEXTTRUNCATED      = 0x08000000,
    WNDS2_NOMINMAXANIMATERECTS      = 0x10000000,
    WNDS2_SMALLICONFROMWMQUERYDRAG  = 0x20000000,
    WNDS2_SHELLHOOKREGISTERED       = 0x40000000,
    WNDS2_WMCREATEMSGPROCESSED      = 0x80000000,
};

The Styles and ExStyles members seem to closely resemble documented window styles (and extended styles) but have their own undocumented bits as well.

fnid might be this, but I could not verify it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.