Unauthorized Windows 95 Update -- WALKWIN

• WALKWIN.C -- Source code for a Win32 Console app that does a recursive walk of the Windows 95 window list, showing that all windows (even Win32 windows) have Win16 underpinnings.
  Unauthorized Windows 95 (IDG Books, 1994), pp. 453-454, includes a Win16 version of this program. Since the goal of the program is to show that every Win32 window in Win95 has Win16 underpinnings, it's more useful to make it a Win32 program.
  The print_hwnd function in this new Win32 version calls GetWindowTask, which returns an obfuscated Ring 3 thread handle. TIDToTDB from UNOBFUSC.C turns this into a pointer to a Ring 3 Thread Control Block (THCB), from which print_hwnd pulls out a selector to the underlying Win16 Task Data Block (TDB; see Undocumented Windows, chapter 5). This selector must then be turned into a flat pointer; this file includes a Win32 version of GetSelectorBase to do this. GetSelectorBase uses the undocumented VxDCall Win32 API to call DPMI function 6 (it gets at VxDCall using GetK32ProcAddress in K32EXP.C.). Armed with a flat pointer to the Win16 TDB corresponding to the Win32 THCB corresponding to the HWND, print_hwnd figures out if this is a Win16 or Win32 window. Whew!
• WALKWIN.EXE -- Win32 Console app that walks the Windows 95 window list, showing that even Win32 windows have Win16 underpinnings. For example, in the sample WALKWIN output below, 1C1Eh is the 16-bit Task Database (TDB) of the Explorer, 0A96h is the TDB of the Internet Explorer, and 1CEEh is the TDB of MS Exchange.

32 02FCh  8153E520h 1C1Eh 'CabinetWClass'  "My Computer"
  32 02E8h  8153E520h 1C1Eh 'msctls_statusbar32'  
  32 02B0h  8153E520h 1C1Eh 'ToolbarWindow32'  
    32 02B8h  8153E520h 1C1Eh 'ComboBox'  
  32 02C0h  8153E520h 1C1Eh 'SHELLDLL_DefView'  
    32 02C4h  8153E520h 1C1Eh 'SysListView32'  
      32 02C8h  8153E520h 1C1Eh 'SysHeader32'  
32 0A08h  8153AD68h 1C1Eh 'CabinetWClass'  "Network Neighborhood"
...
32 0534h  81546724h 0A96h 'Internet Explorer_Frame'  "WALKWIN"
  32 06E0h  81546724h 0A96h 'Internet Explorer_HTML'  
  32 04B4h  81546724h 0A96h 'ToolbarWindow32'  
...
32 01A8h  81521240h 1CEEh 'Microsoft Exchange 4.0 Viewer'  "Inbox..."
  32 01C4h  81521240h 1CEEh 'MailViewBrowser'  
    32 01C8h  81521240h 1CEEh 'SysHeader32'  
    32 01CCh  81521240h 1CEEh 'WMSUIVLB'  
...

The O'Reilly Windows Center

Unauthorized Windows 95 Update