The function does not enumerate a child window that is destroyed before being enumerated or that is created during the enumeration process. If a child window has created child windows of its own, EnumChildWindows enumerates those windows as well.Ī child window that is moved or repositioned in the Z order during the enumeration process will be properly enumerated. For more information, see EnumChildProc.Īn application-defined value to be passed to the callback function.

If this parameter is NULL, this function is equivalent to EnumWindows.Ī pointer to an application-defined callback function. Syntax BOOL EnumChildWindows(Ī handle to the parent window whose child windows are to be enumerated. EnumChildWindows continues until the last child window is enumerated or the callback function returns FALSE. Hooked functions can check input arguments and modify the original function behavior.Enumerates the child windows that belong to the specified parent window by passing the handle to each child window, in turn, to an application-defined callback function. user32!NtUserBuildHwndList (for filtering EnumWindows output).It should not be possible for a hung application to clog up. Task-switching applications need to get window text so they can display the window title in the switcher window. FindWindow () needs to get window text in order to find a window. If you write an anti-anti-debug solution, all the following functions can be hooked: GetWindowText has a problem: Window text needs to be readily available without hanging.

#define EVENT_SELFDBG_EVENT_NAME L'SelfDebugging'īool IsDebugged () ĭuring debugging, it is better to skip suspicious function calls (e.g.

If the event is set, the first instance understands that a debugger is present. after calling the enumwindows application is freezing or hanging. If kenel32!DebugActiveProcess() finishes unsuccessfully, we set the named event which was created by the first instance. in 2nd dialog i am enumerating the windows using enumwindows api.

In the example below, we run the second instance of our process which tries to attach a debugger to its parent (the first instance of the process). There are at least three functions that can be used to attach as a debugger to a running process:Īs only one debugger can be attached to a process at a time, a failure to attach to the process might indicate the presence of another debugger. The following techniques let the running process manage a user interface or engage with its parent process to discover inconsistencies that are inherent for a debugged process.

Enumwindows getwindowtext hang