[python-win32] Accessing the Win32 GUI event system.

[Tim Roberts]

Colin Barnette wrote:
> I am working on the preliminary research on a pywin32 project.  I hope
> to have a utility that can enter a 'capture' mode, wherein after
> activating the mode, the user selects various open windows, and the
> utility logs their hwnds and various data concerning the windows. 

Have you seen the "spyxx" tool that ships with Visual Studio?  It does
exactly this.

> My problem lies in the mechanism for this capture method.  If Win32
> is anything like wxWidgets,...

wxWidgets is basically a relatively thin layer over the Win32 API.

> ...there is a event handler that should be able
> to be exposed, that would give information on what window had focus.
> My thinking is, if I can tail this event log during the capture mode,
> I can read the windows that have gained focus.

There is no central "log" of all of the window events that are sent to
the myriad windows in the typical system.  There are hundreds --
sometimes thousands -- of events per second, far more than any log could
keep up with.

The only way to do what you have described is to install a "Windows
hook".  Basically, you put code into a DLL that is then "injected" into
each and every process in the system.  Your DLL then intercepts all
messages being sent to the window procedures for the top-level windows. 
You can then send the data to some central collection process.

Unfortunately, you cannot implement such a hook in Python.  If you were
to install a Python DLL as a hook, you would also have to inject the
Python support DLLs, and the run-time libraries would collide.  You need
to use a small C DLL as the hook DLL, which then communicates with
Python code for data gathering.

> I have some code which
> plays with win32evtlog, using "System" as my source which doesn't
> contain that kind of UI information, as far as I can tell.

No, the event log tracks things like security events, logins and
logouts, service starts and stops, application failures, and things like
that.

-- 
Tim Roberts, timr at probo.com
Providenza & Boekelheide, Inc.