c# - Spy++: WM_ACTIVATEAPP gives a thread-id that does not exist, why?

Question

I am trying to develop an app that can bring another app to foreground, so I analyze the behaviour of Windows Explorer (Alt-Tab) using Spy++, for me it is interesting which app or which threis actually activated, so I monitor the message WM_ACTIVATEAPP.

WM_ACTIVATEAPP, when wparam=false, according to the MSDN documentation, lparam represents the threadid of the thread being activated.

Here is an example from my Spy++ log: <00037> 00030DD6 S WM_ACTIVATEAPP fActive:False dwThreadID:000008F0

My problem is: the given dwThreadID 8F0 should be the application that gets activated. But: when I switch to the thread-view in Spy++, and search for a thread 8F0, I find nothing. That thread seems not to exist at all. So how do I translate this thread-ID to a process ID?

Answer 1

Lots of reasons for this, but the most common one is that Spy++ does not give you a live view of the machine state. It makes a snapshot when you start it, that snapshot can rapidly become stale. Refreshing a window like Spy + Threads is something you have to do by hand. Use Window + Refresh or press F5.

While that sounds like a pretty nasty flaw, it is actually intentional. Iterating all of the threads and (especially) all of the windows that exist on the machine is a pretty expensive operation. A debugging tool that has too much of an impact on what's being observed is not a trustworthy tool.

Just get in the habit of pressing F5 when you can't see what you think should be there.