Question

I am trying to intercept event_object_create and event_object_destroy events through following code:

class NameChangeTracker
{
private const uint EVENT_OBJECT_CREATE = 0x00008000;
private const uint EVENT_OBJECT_DESTROY = 0x00008001;
private const uint WINEVENT_OUTOFCONTEXT = 0;

//DLL imports

private static WinEventDelegate procDelegate = new WinEventDelegate(NameChangeTracker.WinEventProc);

private delegate void WinEventDelegate(IntPtr hWinEventHook, uint eventType, IntPtr hwnd, int idObject, int idChild, uint dwEventThread, uint dwmsEventTime);

private static void WinEventProc(IntPtr hWinEventHook, uint eventType, IntPtr hwnd, int idObject, int idChild, uint dwEventThread, uint dwmsEventTime)
{
  if(idObject==0 && idChild==0)
  {
    if(hwnd.ToInt32() == getspotify().ToInt32())
    {
      switch(eventType)
      {
        case EVENT_OBJECT_CREATE:
        Console.WriteLine("inside create case"); 
        break;
        case EVENT_OBJECT_DESTROY:
        Console.WriteLine("inside destroy case"); 
        break;
      }
    }
  }

}

Inside main method

public static void Main()
{
   NameChangeTracker tracker = new NameChangeTracker();
   IntPtr hwnd = tracker.getspotify(); // returns hwnd using "FindWindow()" method.
   int num = tracker.getprocessid(hwnd); //returns processid using "GetWindowThreadProcessId()" method.

   IntPtr hWinEventHook = SetWinEventHook(0x00008000,0x00008001,IntPtr.Zero, procDelegate, 0, 0, 0);

   Message msg = new Message();
   while(GetMessage(ref msg,hwnd,0,0))

   UnhookWinEvent(hWinEventHook);
}
}

My above code captures the event when I manually close my application(Spotify) and prints a combination of inside create case and inside destroy case but when I restart my application it prints nothing in the console.

So, how do i make sure that my program continously listen for create & destroy events fired from Application(Spotify) and is the above mentioned approach correct approach.

Here is my ConsoleOutput.

EDIT-1

So, I changed idProcess paramater to listen to events from all process. But my program now only prints inside create case when I start my application it prints nothing when I manually close it.

Answer 1

What’s likely happening here is that when you restart the target app (Spotify), it gets a new Process ID – so your code, which is still listening to the old process ID – ignores it.

You can’t change the PID you’re listening to events from, so you basically have two choices:

• listen to events from all processes, all the time, or

• listen to events from a specific process, and when it dies, listen to create events from all processes, checking to see if any if any of the Create events are for a top-level HWND that’s from the process you care about – and then listen to just that one. (Be careful, as there’s a potential race condition here; after you get the destroy event that tells you that the old instance has disappeared, a new instance could get created before you start listening to events from all processes, so you should do a sweep of all top-level HWNDs after you start listening to be on the safe side.)

If this is just a utility for personal use, the simplest thing might be to always just listen to events from all processes – but still only listen to the few types of events you care about, and then see if there’s actually any performance issues. If not, and it runs fine without any apparent effect on system performance, you’re done!

(For a more professional approach, you might want to measure just how many surplus messages you’re getting that you’re ignoring and otehrwise get more data to determine if it could potentially be a performance issue or not. Create events don’t happen all that often when the UI is in steady-state, so it may not be all that of an issue – but you can get a flurry of them when an app is opened.)