Hi all,

In my continuing exploration of Windows memory and Volatility I'm current looking at Windows, literally, the GUI.

Looking at a notepad process, wintree shows me:

.Untitled - Notepad (visible) notepad.exe:100 Notepad

..#20128  notepad.exe:100 6.0.7601.17514!msctls_statusbar32

..#20126 (visible) notepad.exe:100 6.0.7601.17514!Edit

.Default IME  notepad.exe:100 IME

.MSCTFIME UI  notepad.exe:100 MSCTFIME UI

So, I'm assuming #20128 is the status bar at the bottom of the Notepad window, and #20126 is the edit control, that is, the textarea into which the user types.

This is the corresponding output from the windows plugin for the edit control:

Window Handle: #20126 at 0xfea0dc70, Name: 

ClassAtom: 0xc119, Class: 6.0.7601.17514!Edit

SuperClassAtom: 0xc018, SuperClass: Edit

pti: 0xfe2a4008, Tid: 1692 at 0x8550d368

ppi: 0xffa95550, Process: notepad.exe, Pid: 100

Visible: Yes

Left: 10, Top: 52, Bottom: 485, Right: 701

Style Flags: WS_VSCROLL,WS_CHILD,WS_OVERLAPPED,WS_VISIBLE,WS_HSCROLL

ExStyle Flags: WS_EX_CLIENTEDGE,WS_EX_LTRREADING,WS_EX_RIGHTSCROLLBAR,WS_EX_LEFT

Window procedure: 0x744399d0

Question 1:

Window Handle: #20126 at 0xfea0dc70 - what is the offset? Physical, virtual? Of what? The Edit control object?

(I'm guessing: physical, yes, of the edit control object.)

Question 2:

I can see that it's Window-esque properties (X, Y, width, height, style flags, et al) are all clearly present., but where can I find information specific to this control (in this instance, an 'Edit'). For example, maybe the text it contains?

(I'm guessing, take a look at 0xfea0dc70 and there'll be some kind of structure to parse.)

As always, many thanks. (This is all going towards a plugin that I'm hoping to write!)

Also as always, if I could've found this information on my own, please let me know where to look.

I've read the Command Reference and the associated MoVP posts.

Adam