如何识别Windows 10后台存储进程中具有以编程方式可见且可最小化的未显示窗口？ [英] How to identify Windows 10 background store processes that have non-displayed windows that are programmatically visible and minimizable?

问题描述

我有一个Win32应用程序，该应用程序确定是否显示了任何可见的，非图标化的，最小化的窗口。据我所知，从Win9x到Win8.1都可以正常工作，但是在Windows 10下，它经常会找到几个实际上在屏幕上不可见的窗口。

I have a Win32 application that determines whether there are any visible, non-iconic, minimizable windows being shown. To the best of my knowledge it's worked fine for Win9x through to Win8.1, but under Windows 10 it often finds several windows that aren't actually visible on the screen.

为了确定正在发生的事情，我编写了一个简单的测试应用程序，该应用程序枚举并记录了所有此类窗口。这是EnumWindows回调代码的本质：

To try to identify what's going on I've written a simple test application that enumerates and records all such windows. Here's the essence of the EnumWindows callback code:

BOOL CALLBACK EnumFunc( HWND hWnd, LPARAM lParam )
{
  if ( IsWindowVisible( hWnd ) )
  {
    if ( !IsIconic( hWnd ) )
    {
      const LONG style = GetWindowLong( hWnd, GWL_STYLE );

      if ( WS_MINIMIZEBOX & style )
      {
     //      record window info
      }
    }
   }
 return TRUE;
}

Windows 10下的大多数幻像窗口都属于后台存储应用程序进程，例如邮件，计算器和照片。这些列在任务管理器的后台进程部分下，如果我使用任务管理器结束这些后台任务，则我的测试应用程序将不再找到它们的幻影窗口。

Most of the phantom windows under Windows 10 belong to background store app processes such as Mail, Calculator, and Photos. These are listed under the Background processes section of Task Manager, and if I use Task Manager to end those background tasks, their phantom window is no longer found by my test application.

在我的测试应用程序的上述屏幕截图中，您可以看到除1个违规窗口之外的所有窗口均属于线程具有相同的进程ID 7768，即ApplicationFrameHost.exe。进程ID为11808的最后一个窗口是explorer.exe。

In the above screen shot from my test application you can see that all but 1 of the offending windows belong to threads of the same process id 7768, which is ApplicationFrameHost.exe. The final window with process id 11808 is explorer.exe.

我已经用Spy ++查看了幻影窗口，看不到任何特定的样式组合可以帮助

I've looked at the phantom windows with Spy++ and can't see any particular style combination that would help in uniquely identifying them.

我曾建议可能会涉及未记录的Windows带，但我尝试使用（未记录的，因此可能是错误）API：

I've had a suggestion that the undocumented Windows "bands" may be involved, but I've tried using the (undocumented, so this may be wrong) API:

BOOL WINAPI GetWindowBand (HWND hWnd, PDWORD pdwBand);

，但对于任何窗口它都返回1的带，因此不要区分这些幻像。

but it returns a band of 1 for any window, so doesn't differentiate these phantoms.

如何可靠地识别这些幻影窗口？

How to reliably identify these phantom windows?

推荐答案

检测这些幻影窗口是使用DwmGetWindowAttribute和DWMWA_CLOAKED。

The approved way of detecting these phantom windows is to use DwmGetWindowAttribute and DWMWA_CLOAKED.

这是我使用的代码：

static bool IsInvisibleWin10BackgroundAppWindow( HWND hWnd )
{
    int CloakedVal;
    HRESULT hRes = DwmGetWindowAttribute( hWnd, DWMWA_CLOAKED, &CloakedVal, sizeof( CloakedVal ) );
    if ( hRes != S_OK )
    {
        CloakedVal = 0;
    }
    return CloakedVal ? true : false;
}

感谢MS的Scot Br发布了答案此处

Thanks to Scot Br from MS for posting the answer here

这篇关于如何识别Windows 10后台存储进程中具有以编程方式可见且可最小化的未显示窗口？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！