How to lookup obscure windows message codes?

Question

I'm receiving a windows message with code 1092 (0x444) and I don't know what it is. It's higher than WM_USER but I searched our code base and found no reference so I don't think it's one of ours... does Windows use custom messages above 0x400 and if so how can I look this up?

Answer 1

You could search around in the Windows headers for strings like 0x444, 0x0444, 0x00000444, etc.

It might also be a rogue application sending around messages that it shouldn't.

Answer 2

From the documentanion of WM_USER:

Message numbers in the second range (WM_USER through 0x7FFF) can be defined and used by an application to send messages within a private window class. These values cannot be used to define messages that are meaningful throughout an application, because some predefined window classes already define values in this range. For example, predefined control classes such as BUTTON, EDIT, LISTBOX, and COMBOBOX may use these values. Messages in this range should not be sent to other applications unless the applications have been designed to exchange messages and to attach the same meaning to the message numbers.

So, that message can be anything.
A quick look in the MFC source code, for example, reveals these definitions

// COMMCTRL.H
#define TB_ADDBUTTONSW        (WM_USER + 68)

// RICHEDIT.H
#define EM_SETCHARFORMAT      (WM_USER + 68)

I searched for 68 because 0x444 = 0x400 + 0x44 = WM_USER + 68

Answer 3

Any application can use messages above WM_USER or WM_APP. Windows itself even uses messages above WM_USER. Because any application can broadcast these message values (and some do, because they're written by idiots), you should always use registered messages for private comms.

You could use Spy++ to try and track these messages down, but you can't guarantee ever stopping them all, so it's best to avoid them by using RegisterWindowMessage.