In this lesson, you will learn how to use Spy++, another Visual C++ utility. This useful, popular utility can display information about all current processes, their threads, and all open windows—even hidden windows.
After this lesson, you will be able to:Estimated lesson time: 15 minutes
- Execute the Spy++ utility and use it to display a graphical tree of relationships among system objects, including processes, threads, and windows.
- Use Spy++ to search for specified windows, threads, processes, or messages.
- View the properties of selected windows, threads, and processes.
- Use the Spy++ Finder tool to select a window for monitoring.
- View a real-time record of messages that a window sends and receives.
Start Spy++ the same way as you would the Dependency Walker, by selecting it from the Microsoft Visual Studio 6.0 Tools menu. The utility displays four main views:
These four views are activated by commands in the Spy menu, or by the first four buttons on the toolbar. Each time a command is invoked, it creates a view as a new child window, so the tool buttons do not toggle between existing views. Instead, you should create a view only once, and thereafter switch between views by making a selection in the Window menu. Like the Dependency Walker, Spy++ is an MDI program, so you can tile views within the client area.
Figure 13.10 shows how the Windows and Processes views might look when arranged in the Spy++ window. The views show that Visual C++ is currently running (named MSDEV in the Processes view) and has created several child windows.
Figure 13.10 Windows and Processes views in the Spy++ window
A Spy++ view represents a snapshot, so applications that begin running after Spy++ are not automatically added to the lists. Similarly, applications that terminate while Spy++ is executing are not automatically removed from the list. To update a view, give the view focus and click the Refresh command on the Window menu.
The Windows view displays a list of all windows currently open. It does not matter if the window is hidden or not; many open windows in a typical Windows session are invisible, serving their various applications only as message receivers. When Spy++ begins or when the view is refreshed, the utility compiles a list of all windows and displays the list in the Windows view.
The list is a normal tree view with small plus and minus icons that collapse or expand the list into levels. The tree's hierarchy indicates window parentage—that is, the relation between windows in which one window can create others as child windows. Click any plus icon adjacent to a window to expand the list to include that window's children. If the plus icon does not appear next to a window, it means that the window does not have any children.
A typical list in the Windows view can include many windows, so it's sometimes difficult to locate the entry for a particular window. In these cases, use the Window Finder tool.
Figure 13.11 The Finder Tool icon
Each process running in the Windows multitasking environment creates one or more threads; each thread can create any number of windows. Use the Processes view to examine a particular process, which usually corresponds to an executing program. Processes are identified by module names, or are designated system processes.
The Threads view lists all currently executing threads along with the names of their owner processes. Expand a thread entry to see a list of its associated windows.
For debugging purposes, the message log is perhaps the most useful of Spy++'s capabilities. It keeps a record in real-time of all messages that a window sends or receives. This allows you to examine a list of messages to see in what order they arrive, which is particularly useful for capturing window initialization messages.
A convenient way to begin message logging for a window is by using the Window Finder tool described earlier.
As you work in the target window, Spy++ compiles a list of messages the window sends and receives, as shown in Figure 13.12.
Figure 13.12 Spy++ message log
The Spy++ message log is divided into four columns, which are described in Table 13.6.
Table 13.6 The Four Columns of the Spy++ Message Log
Column | Description |
---|---|
1 | Index number showing the message count |
2 | Window handle |
3 | Message code: either S (sent), R (received), P (posted), or s (message was sent, but security prevents access to the return value) |
4 | Message, parameters, and return values |
By default, the list includes all messages, including mouse movement and keystroke messages such as WM_KEYDOWN and WM_KEYUP. This means the list can get crowded in a hurry, but Spy++ can filter the log to only those messages that interest you most.
In this practice exercise, you will launch the Spy++ utility and use it to spy on another application. By turning on the utility's message logging feature, you can view in real time the messages belonging to a selected window.
This lesson described Spy++, a Visual C++ utility that reports information about executing programs. Spy++ can provide invaluable insight into an application's behavior that is not available through the Visual C++ debugger.
Spy++ displays four main views that show a list of windows, processes, threads, and messages pertaining to a particular window. The Window Finder tool aids in associating any exposed window with the list of windows that Spy++ displays. The message tracking feature intercepts and logs all messages that enter and leave a window, showing chronological order and the values of message parameters. The message log can be filtered to monitor messages of particular interest only.