Advanced Windows Spy

Top  Previous  Next

Available in

Entrek ProcMan Standard Edition
Entrek ProcMan Professional Edition
Entrek ProcMan Professional+ Edition


Use Windows Spy to view window messages that are sent or posted to a window.  You must be connected to the target device.


Steps to spy on a window


1.Click on Processes tab on main application tab.
2.In the Processes View, find the owner process for the window you are interested in and click it.
3.Click the Windows tab in the lower panel.
4.Use the Windows treeview control to find the window you want to spy on.
5.Select the window and click the Spy application toolbar button Spy... toolbar button.  Alternatively right-click the window and choose Spy... from the context menu that appears.


For Windows CE 6.0 and higher, the Entrek ProcMan device DLL must be injected into each process to enable spying.  The first time you use Windows Spy will configure DLL injection by adding the Entrek  ProcMan DLL to the device registry key HKLM\System\Kernel\InjectDLL.  Once changed, you must restart the process that created the window you want to spy on. Entrek ProcMan will prompt you to restart the process.  When the process is restarted, the Entrek ProcMan DLL will be injected into the process allowing you to spy on it.  In fact, all processes that get started after the InjectDLL key is set will have the Entrek ProcMan DLL injected into its address space. Entrek ProcMan will restore the InjectDLL registry key when you disconnect Entrek ProcMan from the target device.


Windows Spy




Windows spy pause resume toolbar button Pause/resume: pauses and resumes spying.
Windows spy message filter toolbar button Message filtering: allows you to filter messages based on message ID.  Once filtered, the specified messages are not reported.  By default, WM_TIMER is filtered.
Windows spy post message toolbar button PostMessage: opens a dialog that allows you to post messages to the window.
Windows spy close window toolbar button Close window: posts WM_CLOSE to the window.



Text: the window's caption or text.
Class: the window's class.
Handle: the window's handle
Parent: the handle of the window's parent window.
Styles: the window's styles.
Extended Styles: the window's extended styles.
Client Rectangle: the coordinates of the window's client area.
Window: the coordinates of the window's bounding rectangle relative to the upper-left corner of the screen.
Thread ID: the ID of the thread that created the window.
Process ID: the ID of the process that created the window.
Process: the name of the window's owner process.




Time: timestamp of the message.
Type: indicates if the message is a result of PostMessage or SendMessage.  The text is indented to show the nesting level of the message.
uMsg: message identifier.  The name will be decoded for some common messages.  For other messages will have the hexadecimal value of the message identifier.
wParam: hexadecimal value of additional message-specific information.
lParam: hexadecimal value of additional message-specific information
lResult: if the message is a result of SendMessage then this will have the value returned from the Window procedure that processed the message.
Extended Information: displays decoded wParam and lParam for some common messages
Source: displays the source of keyboard messages.
Position: the x- and y-coordinates of the cursor's screen position when the message was sent or posted.