Window or Handle creation time?

Posted on 2009-02-23
Last Modified: 2013-12-03

I particurlarly need to know when a window was created or displayed. This is essential for various "MessageBox"es that popup from random programs with a text in it but without any timecode saying when this message popped up. This is especially annoying on long-time tasks where nobody is in front of the system.

So - is there any way to get the creation time of a window? I don't mean the creation time of a whole process (and to be clear: I don't mean the startup time of Windows itself, too). And sadly it seems that MessageBoxes also won't create a thread (which definitly has a creation time that can be read with ProcExp).

My problem would be indirectly solved if somebody can guarantee that the WinAPI (or else) was never meant to know the creation time of a handle. In this case it can't be helped of course.

Thanks for reading and thinking :-)
Question by:AmigoJack
    LVL 30

    Accepted Solution

    HI AmigoJack,

    I don't think there's a possibility to find the creation time of a HANDLE - at least I never heard or read about something to do so.

    But, maybe you could implement a system wide hook which can log all window creation/deletion times you need - to do so you would need a WH_CBT-hook proc.

    LVL 12

    Author Comment

    Hi ZOPPO,

    yes it's obvious to write an own helper app which logs all window creations if nothing helpful exists. However - isn't there any other chance? Running hooks for this little purpose is like shooting sparrows with canons ;-)
    LVL 30

    Expert Comment

    Sorry, I don't know any other method. AFAIK handles in windows are just 32-bit values handled by the OS. I guess these handles are stored/used in a way that they can be created/accessed/destroyed with maximum performance since every system object is represanted by a handle. Storing a time-stamp or something similar with a handle would be a overhead.
    LVL 86

    Assisted Solution

    There indeed is no such thing as a creation time for a handle - but I'd rather go for a WH_GETMESSAGE hook, so you can intercept WM_CREATE messages sent to a MessageBox by identifying their Window Class name using 'GetClassName()' and the MSG::time parameter. See e.g. ("Win32 Hooks")
    LVL 12

    Author Comment

    Thanks for contributing :)

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    After several hours of googling I could not gather any information on this topic. There are several ways of controlling the USB port connected to any storage device. The best example of that is by changing the registry value of "HKEY_LOCAL_MACHINE\S…
    The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
    The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
    With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now