How to look for incomprehensible Windows message codes?

Question

I get a message with code 1092 (0x444) and I don't know what it is. It is higher than WM_USER, but I searched our code base and didn’t find the link, so I don’t think this is one of ours ... does Windows use custom messages above 0x400, and if so, how can I see it?

Answer 1

From the documentation document WM_USER :

Message numbers in the second range (WM_USER through 0x7FFF) can be determined and used by the application to send messages in a private class window. These values ​​cannot be used to define messages that make sense throughout the application, because some predefined window classes already define values ​​in this range. For example, predefined control classes such as BUTTON, EDIT, LISTBOX and COMBOBOX can use these values. Messages in this range should not be sent to other applications, unless the applications were designed for messaging and have the same value for message numbers.

So, this message can be any.
A quick look at the source code of MFC, for example, shows these definitions.

// COMMCTRL.H #define TB_ADDBUTTONSW (WM_USER + 68) // RICHEDIT.H #define EM_SETCHARFORMAT (WM_USER + 68) 

I searched 68 because 0x444 = 0x400 + 0x44 = WM_USER + 68

Answer 2

You can search in Windows headers for strings such as 0x444 , 0x0444 , 0x00000444 , etc.

It could also be a rogue app sending messages that it shouldn't.

Answer 3

Any application can use messages above WM_USER or WM_APP. Windows itself even uses messages above WM_USER. Since any application can translate these message values ​​(and some because they are written by idiots), you should always use registered messages for private messages.

You can use Spy ++ to try and track these messages, but you cannot guarantee that they will stop, so it's best to avoid them with RegisterWindowMessage.