Check if LPCWSTR is an atom or not?

[inbugable]

I have a hook on the function CreateWindowExW. I tried to call wcscmp on the lpClassName parameter to see what class I am created, but when lpClassName is an atom it crashes. How can I check whether or not lpClassName is an atom or LPCWSTR?

Thanks,
inbugable

[wildfrog]

From MSDN on CreateWindowEx:

lpClassName
[in] Long pointer to a null-terminated string or an integer atom. If this parameter is an atom, it must be a global atom created by a previous call to the RegisterClass function. The atom, a 16-bit value less than 0xC000, must be in the low-order word of lpClassName; the high-order word must be zero.

Maybe you can make a check to see if the lpClassName argument meets the criteria of an atom.

- petter

[inbugable]

Thanks but its not working. Could you post some sample code plz?

Thanks

[ovidiucucu]

Thanks but its not working.

First, please show us what did you try and it's not working.

[inbugable]

I tried:

if(HIWORD((ATOM)lpClassName) == 0){

and

if((ATOM)lpClassName < 0xC000){

[TheCPUWizard]

Wildfrogs posting is correct so....

1) What is the actual 32 bit hex value you are testing (a debugger and a breakpoint makes this trivial).

2) Why do you think the value is (or is not) an Atom. What is the code that generates the value? [please dont forget code tags - like you forgot them in your previous post !]

[ovidiucucu]

Just to quote this

if(HIWORD((ATOM)lpClassName) == 0)

As already said above, ATOM is a 16-bit (WORD) value so

HIWORD((ATOM)someting)

will be always 0.

[inbugable]

1) The class is 0xC038 but casted to a LPCWSTR
2) I dont know the code that generates the value because im running injected code in another process

[wildfrog]

I'm sorry, the quote from MSDN was for Windows CE. I'll try again:

lpClassName
[in] Pointer to a null-terminated string or a class atom created by a previous call to the RegisterClass or RegisterClassEx function. The atom must be in the low-order word of lpClassName; the high-order word must be zero. If lpClassName is a string, it specifies the window class name. The class name can be any name registered with RegisterClass or RegisterClassEx, provided that the module that registers the class is also the module that creates the window. The class name can also be any of the predefined system class names.

What if you try this:

if (HIWORD(lpClassName) == 0)
{
    // atom
} else
{
    // class name
}

- petter