How to Spy on programs

All the parameters (window-class, wParam, lParam) can be found using Spy, which is designed to view messages being passed to a program through the operating system.

In the exercise that follows, we will spy on the MS Paint program to determine it's window-class, then setup Spy to examine just the WM_COMMAND messages and extract the wParam.

Configuring Spy correctly prevents having to re-configure the program later. As you will see, there are lots of messages that can be spied upon. Let's begin.

  1. Open the program you want to spy on. In this example we use Paint.

  2. Open Spy.

    To download a Spy-like program see I Spy

  3. On the menu, choose Spy: Messages.

     

  4. Drag the Finder Tool over the outside edge of the window you want to determine the window-class. It will form a bold outline around the window. Careful not to find the class of a toolbar, menu, or inside window. Make sure it is the outside edge of the window.

  5. In this case I dropped the Finder Tool on Paint and the Spy Message Options dialog reports among other things, the Class: MSPaintApp. This is the first parameter of the macro, the second parameter is simply the application's name: mspaint.EXE. You will have to determine the name of the program through some other means (the application name is not displayed here).

  6. Click the Messages tab. Don't worry if this list looks intimidating. Only one option is needed.

  7. Turn on Save Settings as Default.
    This setting saves your settings for the next time you use Spy.

  8. Click Clear All and scroll through the list and select WM_COMMAND. We are going to spy on the WM_COMMAND messages as they are executed in Paint.

  9. Click OK and a Messages window appears.

  10. Switch to Paint and choose Edit: Paste From on the menu.

  11. Close the dialog box in Paint and examine the message that was generated in Spy.

  12. Back in Spy, notice the Messages window.

  13. Double click the first item (some commands execute several messages).
    The wParam and the lParam are reported.

  14. In this case we want the wParam, but only the last four digits. In our macro we precede the four characters with 0x (zero & letter x), so your wParam will be 0x9320 as the hexadecimal equivalent to the Edit: Paste From command.

Next, Create the macro