The Second Window State

In the WND structure, the state member’s bits were already all defined by version 3.51, if not earlier. A second set, prosaically named state2, was introduced for version 4.0. Demand was apparently very high: state2 was full too as early as version 5.0. Additions for version 5.0 redefined a few of the originals, but the assignment of bit fields in state2 has been stable ever since.

Microsoft’s names and definitions of bit fields in union with state2 as a ULONG are known from symbol files for WIN32K.SYS from Windows 7 only.

The USEREXTS and USERKDX debugger extensions, as supplied in the Device Driver Kit (DDK) for Windows NT 4.0 and then for Windows 2000 but apparently not since, have names that likely reproduce macros from Microsoft’s headers. These name a sort of index into the set of window flags that comprises the state, state2, ExStyle and style members considered as an array of bytes. The high byte in each such 16-bit index is the byte offset to the bit and the low byte is the bit mask within that byte. Where a name is known from this source, the versions in parentheses are of the debugger extension.

INT bWMPaintSent: 1;

INT bEndPaintInvalidate: 1;

INT bStartPaint: 1;

INT bOldUI: 1;

INT bHasClientEdge: 1;

INT bBottomMost: 1;

INT bFullScreen: 1;

INT bInDestroy: 1;

INT bWin31Compat: 1;

INT bWin40Compat: 1;

INT bWin50Compat: 1;

INT bMaximizeMonitorRegion: 1;

INT bCloseButtonDown: 1;

INT bMaximizeButtonDown: 1;

INT bMinimizeButtonDown: 1;

INT bHelpButtonDown: 1;

INT bScrollBarLineUpBtnDown: 1;

INT bScrollBarPageUpBtnDown: 1;

INT bScrollBarPageDownBtnDown: 1;

INT bScrollBarLineDownBtnDown: 1;

INT bAnyScrollButtonDown: 1;

INT bScrollBarVerticalTracking: 1;

INT bForceNCPaint: 1;

INT bForceFullNCPaintClipRgn: 1;

INT FullScreenMode : 3;

INT bCaptionTextTruncated: 1;

INT bNoMinmaxAnimatedRects: 1;

INT bSmallIconFromWMQueryDrag: 1;

INT bShellHookRegistered: 1;

INT bWMCreateMsgProcessed: 1;

The window flag that debugger extensions for Windows 2000 name as WFPIXIEHACK has a more descriptive (if less impish) name as a bit field in Windows 7. Whether the flag’s names ever were synchronised, or have become so, is not known. For all known versions, even as late as Windows 10, symbol files show that the internal routine that sets this flag is named PixieHack.