4. Captured Shots

While WinID can retrieve all sorts of information from controls and display it in the Readout Pane, sometimes it is necessary to copy this information from the Readout or have it available for later review. WinID has a feature called Capturing Shots that allows you to capture condition of control underneath the mouse pointer upon a click on the keyboard button. This button is called Capture Shot button and is set to the Shift button by default.
 
INFORMATION: The Capture Shot button may be changed to any other button on a keyboard or set to two buttons in the WinID Settings window.
 
INFORMATION: By default WinID will recognize the Capture Shot button keystroke even when it does not have a keyboard focus (i.e. when you work with another program while WinID is running on the background). To disable this feature and have the Capture Shot button work only when WinID has focus unselect "Capture Shots only when WinID has keyboard focus" checkbox in the Settings window.
 
WinID will not recognize Capture Shot button in the following situations:

WARNING: When run on older systems (CPU family less than Pentium III + RAM less than 128 MB) with "Allow Capturing Dynamic Resources" option enabled, Capturing Shot of control that has "bulky" dynamic resource such as a long image list, or a big bitmap may slow computer for a few seconds. In this situation WinID will display the Wait Mouse Pointer. Simply wait for information to be collected.

To capture state of control underneath the mouse pointer simply press Capture Shot button while WinID is running. If WinID registers this keystroke and Captures Shot of control it also plays a sound to let you know that Shot was Captured. After that the Captured Shots button on the WinID toolbar will change its consecutive number to the next one up.
 
INFORMATION: You can disable sound played after Shot is Captured in the WinID Settings window.
 

The Captured Shots button on the toolbar in the top left corner of WinID window has two functions:

  1. It displays the number of the last Captured Shot. WinID is capable of storing up to 10 different Shots in its memory. When you attempt to make the 11th Shot and on, WinID will rewrite previously made Shots using the rule "first in, first out";
  2. If clicked will display a Captured Shots dialog box that allows you to view, copy and save your Captured Shots.
     

Captured Shots Dialog Window

This dialog window is displayed after a click on the Captured Shots button on the WinID toolbar, if selected from the Main Menu, or using Alt+S keyboard keys. This window allows you to view and copy data obtained via Capture Shot option.

 

There are ten buttons on the left side of the Captured Shots window. Each button represents an individual Shot. A button might be disabled if Shot it stands for was not made yet. A button highlighted with bright orange color stands for selected Shot, which information is displayed in the main area of the window. To navigate between different Shots you can do the following:

  • Click any of the enabled Shot buttons on the left side of the Captured Shots dialog window using a mouse;
  • Click Previous or Next buttons at the bottom of the Captured Shots dialog window.

WinID is capable of storing up to 10 Shots in its memory. After you make 11th and next Shots WinID will overwrite previous Shots using the rule "First in, first out". This means that Shot #1 will be overwritten by Shot #11 and Shot #2 by Shot #12, etc. When you open Captured Shots dialog window WinID sets the last made Shot as selected one. If all 10 Shot slots are taken, WinID also displays a small separator below the last Shot.
 

 

 
WARNING: WinID does not prompt you to save Captured Shots when you close its window, thus all the Shots are lost when WinID is closed.
 
"Save all Captured Shots" option is available to save all Captured Shots in files on the hard drive. You can access it after clicking on the camera icon in the top left corner of the Captured Shots window, or by going to the Main Menu in WinID.
 
INFORMATION: This option might be disabled if no Shots were captured.
 
After activating it WinID will display the Browse For Folder window that will allow you to pick the location on the hard drive, network, or on removable media where you would like to save all Captured Shots to. Click OK button to start saving.
 
INFORMATION: WinID will create a folder within selected folder and give it a name according to the following format: "WinID Captured Shots (MM-DD-YYYY, HH.MN.SS)", where MM=Month, DD=Day, YYYY=Year, HH=Hour, MN=Minute, SS=Second of the date & time of this operation. All Captured Shots will be placed in this folder into separate folders, each one corresponding to individual Shot, having a name in the following format: "Shot #N (HHMMSS)", where N=Shot number, HH=Hour, MM=Minute, SS=Second of operation in military format.
 
WARNING: In case folders with names described above existed before saving of All Captured Shots the data will be rewritten without prompt!
 
WinID will place each Shot into individual folder and break it down into separate files. Depending on the type of information stored in a Shot the following files may be created:

INFORMATION: Depending on the size of data being saved and the speed of the media you save it to, this operation may take some time to complete. WinID will display a small window that will let you know the progress of the saving operation.
 
INFORMATION: When all the Captured Shots are saved WinID will display a confirmation window that will show the location of created folder and number of Shots saved.
 

 
The main area of the Captured Shots dialog window contains tabs that display information for the currently selected Shot.
 

 

General Tab

This tab contains generic data in a text form retrieved from a window/control at the moment when Shot was Captured. It duplicates (and supersedes) data displayed in the Readout Pane of the WinID.

Captured Shots Dialog Window (General Tab)
Captured Shots Dialog Window (General Tab)


Time: field contains date and time when Shot was Captured in the following format: MM/DD/YYYY HH:MN:SS.MSC, where MM=Month, DD=Day, YYYY=Year, HH=Hour (military), MN=Minute, SS=Second, MSC=Millisecond;

Data field contains information about window/control at the time Shot was Captured. This information duplicates data displayed in the Readout Pane at the time of Shot and is presented in a text form and can be easily viewed or copied.
 
INFORMATION: The information presented in the data field is more accurate than the one displayed in the Readout Pane at the time Shot is captured due to size limitations of the Readout Pane. Besides that some additional information is added to the data field that is not available through the Readout Pane.
 
INFORMATION: Some lines in the data field might be omitted in your version of WinID if that information is not supported by the Operating System.
 
The description displayed in the table below could be referring to a window/control (later, the Control) located underneath the mouse pointer, and/or a main thread (later, the Thread), and/or a process (later, the Process) this window/control belonged to at the time Shot was captured.
 
INFORMATION: Each process may have variable number of threads running in its context. The main thread is the thread that was created at the time of process creation. It stays active until the process terminates.
 
For more information regarding values in this table check Readout Pane description.
 
<Title> Top part of the screen is occupied by the Control title (Note: Title text might take several lines if it contains Line Feed characters)
HWND: Handle to a window of the Control;
ID: ID of the Control;
Wnd Pos: Position and size of the Control in screen coordinates. Format: X, Y, W, H, where X=Horizontal position of the Control on the screen in pixels; Y=Vertical position of the Control on the screen in pixels; W=Width of the Control in pixels; H=Height of the Control in pixels;
Client Pos: Position and size of the Client Area of the Control in screen coordinates. Format: X, Y, W, H, where X=Horizontal position in pixels; Y=Vertical position in pixels; W=Width in pixels; H=Height in pixels. (INFORMATION: Client Area is the area inside the window of the Control that excludes title or system bar and borders. For some controls client area might coincide with window area.)
Wnd Brds: Width of window borders of the Control. Format: CX, CY, where CX=Width of the vertical border in pixels; CY=Height of the horizontal border in pixels;
Wnd Ver: The Microsoft Windows version of the application that created the Control;
Wnd Stat: Three status values for the Control, format: Enabled, Visible, Unicode. If value is equal to 1 it means that corresponding property is enabled, and disabled if 0;
Class: Window class name of the Control. If this is a system class, "(Sys Class)" is added at the end of the line;
Class C++: C++ #define variable standing for the window class of the Control if such exists. The real window class name is given in square brackets at the end of the line;
Class Desc: Human readable description of the Control class put into double-quotation marks;
HMODULE: Handle to the module the Control resides in;
Atom: Handle to the atom of the Control class;
WndProc: Handle to the window procedure of the Control's message handling routine;
Menu: or
Menu RSRC:
Handle to the menu associated with the Control, or menu name put into double-quotation marks;
Window DC: Handle to the window device context associated with the Control. If the Control contains window region, "(Region)" is added at the end of the line;
Client DC: Handle to the client area device context associated with the Control;
HICON: Handle to the icon associated with the Control;
HICON(sm): Handle to the small icon associated with the Control. Small icon is displayed on a title bar of a window;
HCURSOR: Handle to the cursor associated with the Control;
Brush: or
HBRUSH:
C++ #define variable for a color of a brush used to paint background of the Control, or handle to such brush;
Xtra [Cls, Wnd]: Two values of the size of extra space allocated for the Control class and window, accordingly;
Class Styles: Value of the class styles of the Control followed by C++ #define variables that combined together by Boolean OR operation represent this value;
Proc ID: ID value of the Process;
Proc Open Lvl: Process Open Level value (more info here);
Proc Ver: Version of the Process;
Wow64 If this value is equal to 1 this means that the Process is running under Windows on Windows64 emulator;
Priorty Class: Priority class of the Process specified as a hexadecimal value and as a C++ #define variable for it, if available. '(Boost On)' might be displayed at the end of this line if the Process boost is enabled;
Proc Crtd: Creation time of the Process. Format: mm/yy hh:mn:ss, where mm=Month, yy=Year, hh=Hour (military), mn=Minute, ss=Second;
Proc Krnl Time: Time interval the Process was executed in the KERNEL module. Format: mm:ss.ms, where mm=Minutes, ss=Seconds, ms=Milliseconds;
Proc Usr Time: Time interval the Process was executed in the USER module. Format: mm:ss.ms, where mm=Minutes, ss=Seconds, ms=Milliseconds;
Proc Affty Msk: Affinity mask for the Process;
Proc Hndls: Number of all handles the system allocated for the Process;
Proc GDI Hndls: Number of GDI module handles allocated for the Process;
Proc USER Hndls: Number of USER module handles allocated for the Process;
Mod Alloc Base: Load address of the Module;
Mod Entry Pnt: Entry point address of the Module;
Mod Sz: Size of the linear space the Module occupies in memory;
Proc WrkSet Sz: Current working set size of the Process in bytes;
Proc Min WrkSet Sz: Minimum working set size of the Process in bytes;
Proc Max WrkSet Sz: Maximum working set size of the Process in bytes;
Proc Pg Flts: Page fault count for the Process;
Proc Pk WrkSet Sz: Peak working set size of the Process in bytes;
Proc Qt Pk PgdPl Usg: Peak of the paged pool usage of the Process in bytes;
Proc Qt PgdPl Usg: Current paged pool usage of the Process in bytes;
Proc Qt Pk NPgdPl Usg: Peak of the nonpaged pool usage of the Process in bytes;
Proc Qt NPgdPl Usg: Current nonpaged pool usage of the Process in bytes;
Proc Pgfl Usg: Current space allocated in the page file for the Process in bytes;
Proc Pk Pgfl Usg: Peak space allocated in the page file for the Process in bytes;
Proc I/O Rd Nm: Number of I/O read operations performed by the Process;
Proc I/O Wt Nm: Number of I/O write operations performed by the Process;
Proc I/O Oth Nm: Number of I/O operations performed by the Process, other than read and write operations;
Proc I/O Rd: Number of bytes read by the Process through I/O operations;
Proc I/O Wt: Number of bytes written by the Process through I/O operations;
Proc I/O Oth: Number of bytes transferred during operations other than read and write I/O operations by the Process;
Proc Prvlgs: Enumeration of all active process privilege values for the Process along with their flags as hexadecimal values and C++ #define equivalents for flags grouped by Boolean OR operation;
Thrd ID: ID value of the Thread;
Priorty Lvl: Priority level of the Thread specified as a hexadecimal value and as a C++ #define variable for it, if available;
Thrd Priorty Boost: If this value is equal to 1 this means that the Thread boost is enabled;
Thrd Crtd: Creation time of the Thread. Format: mm/yy hh:mn:ss, where mm=Month, yy=Year, hh=Hour (military), mn=Minute, ss=Second;
Thrd Krnl Time: Time interval the Thread was executed in the KERNEL module. Format: mm:ss.ms, where mm=Minutes, ss=Seconds, ms=Milliseconds;
Thrd Usr Time: Time interval the Thread was executed in the USER module. Format: mm:ss.ms, where mm=Minutes, ss=Seconds, ms=Milliseconds;
Base Priorty (Bkgnd): Value of the base priority of the Thread when it is on the background; (INFORMATION: A thread is on the background when a window that belongs to it doesn't have a keyboard focus.)
Base Priorty (Frgnd): Value of the base priority of the Thread when it is on the foreground; (INFORMATION: A thread is on the foreground when a window that belongs to it has a keyboard focus.)
Img Path: Full path to the image file of the Process put into double-quotation marks;
Img Type: Type of executable file referred by the image file path of the Process; (For supported types see Readout Pane description)
Mod Path: Full path to the module file of the Control put into double-quotation marks;
Mod Type: Type of executable file referred by the module file path of the Control; (For supported types see Readout Pane description)
HINST: Handle to the instance of the Process;
ShtDn Priorty Lvl: Shut-down priority level for the Process;
ShtDn Flgs: Shut-down flags value for the Process (You can find more info about supported flags here);
ShtDn No Retry: If this value is equal to 1 this means that the Process does not require user confirmation to terminate after the system shut-down if it did not respond within specified timeout period;
Parent HWND: Handle to the parent window of the Control, if such exists;
Parent Class: Window class name of the parent window of the Control, if the it has a parent;
Wnd Styles: Value of the window styles of the Control followed by C++ #define variables combined together by Boolean OR operation that represent this value. Control styles specific for the Control are also included in this line;
Wnd ExStyles: Value of the extended window styles of the Control followed by C++ #define variables combined together by Boolean OR operation that represent this value;
<Additional_info> Depending on the window class of the Control WinID may include some additional data at the bottom of this list.
 

In case Control belongs to a Console Application (later the Console) the following data will be added:
 
Console Specific: Signifies that the following section of data is console specific
HANDLE (STD_IN): Handle to the standard input device associated with the Console [more info];
HANDLE (STD_OUT): Handle to the standard output device associated with the Console [more info];
HANDLE (STD_ERROR): Handle to the standard error device associated with the Console [more info];
Scr Width: Width of the Console screen buffer in character columns [more info];
Scr Hght: Height of the Console screen buffer in character rows [more info];
Wnd: Coordinates of the display window of the Console, in the following format: {L; T; R; B}, where L=Left side of the display window, T=Top, R=Right, B=Bottom. These values are measured in console characters [more info];
Max Wnd Width: Maximum width of the Console window in character columns [more info];
Max Wnd Hght: Maximum height of the Console window in character rows [more info];
Cursor: The column and row coordinates of the cursor in the Console screen buffer, in the following format: X, Y, where X=Horizontal coordinate, and Y=Vertical. These values are measured in console characters [more info];
Last Write Attr: Attributes of last characters written to a screen buffer of the Console. The data is presented as a hexadecimal value followed by C++ #define variables combined using Boolean OR operation [more info];
Mode (STD_IN): Input mode of the Console's input buffer, presented as a hexadecimal value followed by C++ #define variables combined using Boolean OR operation [more info];
Mode (STD_OUT): Output mode of the Console's screen buffer, presented as a hexadecimal value followed by C++ #define variables combined using Boolean OR operation [more info];
Input Code Page: Input code page used by the Console, in the format: Code Page Number = Code Page Description [more info];
Output Code Page: Output code page used by the Console, in the format: Code Page Number = Code Page Description [more info];
Attached Proc IDs: Comma-separated list of IDs of processes attached to the Console [more info];
Attached Proc: Comma-separated list of processes attached to the Console, each presented by its image file path [more info];
 

In case Control has a window region associated with it the following data will be added:
 
Window Region Type: Type of window region specified here. The following values could be used: COMPLEXREGION, SIMPLEREGION, NULLREGION [more info];
Bounding Region Box: Coordinates of rectangle bounding the window region. Format: {L, T, R, B}, where L=Left coordinate in pixels; T=Top, R=Right, and B=Bottom [more info];
Window Region: Array of rectangles that make up the window region, represented by structures in the following format: {L, T, R, B}, where L=Left coordinate in pixels; T=Top, R=Right, and B=Bottom. The number of these structures depends on complexity of the window region and could be from one (for Simple Region) to several hundred.
 

Copy button copies information in the Data field to the Windows Clipboard as text.
 
INFORMATION: After being copied the information is available for other Microsoft Windows applications by means of the Paste option.
 
Menu... button when clicked shows a pop-up menu that allows to perform some additional tasks:

 

Params Tab

This tab contains Command Line and Environment Strings data retrieved from the process that the window/control belongs to at the time when Shot was Captured.

Captured Shots Dialog Window (Params Tab)
Captured Shots Dialog Window (Params Tab)

Command Line field contains the command line of a process that a window/control in the Captured Shot belongs to. Command line represents the way a process was started and normally consists of an image file path to a process followed by optional command line parameters at the end.
 
INFORMATION: The length of a command line information that WinID can retrieve from the Process should not exceed 520 characters, including punctuation marks and spaces. If a command line is longer than 520 characters, it is abbreviated and '>>>' symbols are put at the end.
 
Environment Strings
field contains the environment variables of a process that a window/control in the Captured Shot belongs to. Environment variables specify search paths for files, directories for temporary files, application-specific options, and other similar information
[more info].
 
INFORMATION: Command Line and Environment Strings could be unavailable for certain processes. WinID must have Hooking and Dll Injection enabled in the Settings window for this information to be retrievable.
 
INFORMATION: The length of an environment strings information that WinID can retrieve from the Process should not exceed 4096 characters, including punctuation marks and spaces. If length of environment strings is greater than 4096 characters, it is abbreviated and '>>>' symbols are put at the end.
 
 

Files Tab

This tab contains information about image and module files associated with a window/control at the time when Shot was Captured.

Captured Shots Dialog Window (Files Tab)
Captured Shots Dialog Window (Files Tab)

Image File field contains a full path to an image file associated with a process that a window/control in the Captured Shot belongs to;
 
INFORMATION: To get more information about image files check Readout Pane description.
 
Find Target... button opens file specified in the Image File field in the Windows Explorer window when clicked. This option is useful to locate image file for the Process in the file system;

Created: field contains time the image file was created. Format: mm/dd/yy hh:mn:ss, where mm=Month, dd=Day, yy=Year, hh=Hour in military format, mn=Minute, ss=Second;
 
INFORMATION: The Created field could be also interpreted as the time the application was first created (or installed) in the file system.
INFORMATION: The accuracy of the time given in this field depends on the Operating System and the file system.

 
Modified: field contains time the image file was modified. Format: mm/dd/yy hh:mn:ss, where mm=Month, dd=Day, yy=Year, hh=Hour in military format, mn=Minute, ss=Second;
 
INFORMATION: The accuracy of the time given in this field depends on the Operating System and the file system.
 
Accessed: field contains time the image file was last accessed. Format: mm/dd/yy hh:mn:ss, where mm=Month, dd=Day, yy=Year, hh=Hour in military format, mn=Minute, ss=Second;
 
INFORMATION: The Accessed field may contain incorrect information when used on some file systems. As an example this field is updated each time WinID attempts to read attributes from the file.
INFORMATION: The accuracy of the time given in this field depends on the Operating System and the file system.
 
Attrs: field contains attributes of a file specified in the Image File field. All attributes are separated by the Boolean OR symbol
[more info];

Accs: field contains access rights flags for a file specified in the Image File field separated by the Boolean OR symbol [more info];


Module File field contains a full path to a module file associated with a window/control in the Captured Shot;
 
INFORMATION: To get more information about module files check Readout Pane description.
 
Find Target... button opens file specified in the Module File field in the Windows Explorer window when clicked. This option is useful to locate module file for a window/control in the file system;

Created: field contains time the module file was created. Format: mm/dd/yy hh:mn:ss, where mm=Month, dd=Day, yy=Year, hh=Hour in military format, mn=Minute, ss=Second;
 
INFORMATION: The accuracy of the time given in this field depends on the Operating System and the file system.
 
Modified: field contains time the module file was modified. Format: mm/dd/yy hh:mn:ss, where mm=Month, dd=Day, yy=Year, hh=Hour in military format, mn=Minute, ss=Second;
 
INFORMATION: The accuracy of the time given in this field depends on the Operating System and the file system.
 
Accessed: field contains time the module file was last accessed. Format: mm/dd/yy hh:mn:ss, where mm=Month, dd=Day, yy=Year, hh=Hour in military format, mn=Minute, ss=Second;
 
INFORMATION: The Accessed field may contain incorrect information when used on some file systems. As an example this field is updated each time WinID attempts to read attributes from the file.
INFORMATION: The accuracy of the time given in this field depends on the Operating System and the file system.
 
Attrs: field contains attributes of a file specified in the Module File field. All attributes are separated by the Boolean OR symbol
[more info];

Accs: field contains access rights flags for a file specified in the Module File field separated by the Boolean OR symbol [more info].

 
 

Modules Tab

This tab contains information about all modules loaded, or later updated for the process that control/window belongs to at the time Shot was Captured.

Captured Shots Dialog Window (Modules Tab)
Captured Shots Dialog Window (Modules Tab)

The top line on this page contains basic information about the process (later, the Process) that control/window from the Shot belongs to. A small icon for the Process is displayed first, then the total number of modules loaded for the Process at the time Shot was captured, or later updated after a click on "Update" button, and the name of the image file associated with the Process.
 
Module List field contains all modules loaded for the Process at the time the Shot was Captured. The list has two columns, "Module" for the names of modules, and "Path" that specifies full paths to modules in the file system. If "Update" button was clicked afterwards, the list will contain updated (or current) information about modules loaded for the Process. All modules added to the list after click on "Update" button will have (*) added at the end of their names.
 
If Module List is right-clicked with the mouse, or if Menu keyboard key is hit WinID displays the menu with two options:

Sort list checkbox allows to specify if Module List should be sorted. If checked, WinID sorts modules by their names in ascending order. Uncheck this box to see modules in the order they were reported by the Operating System.
 
Update button lets you update Module List according to the current state of the Process.
 
INFORMATION: Once updated new modules information is stored in the Captured Shot and might be viewed or saved later.
 
Find... button opens files selected in the Module List in the Windows Explorer window when clicked. This option is useful to locate modules in the file system.
 
INFORMATION: This option is disabled if no modules or more than 6 are selected in the Module List.
 

 

Control Tab

This tab contains dynamic resources extracted from the control/window at the time Shot was Captured. Dynamic resource is the term used in WinID for any kind of dynamic data generated during control's operation, that may include bitmaps, icons, image lists, fonts, window properties, etc.

Captured Shots Dialog Window (Control Tab)

Dynamic Resources list contains icons for each dynamic resource that WinID was able to extract from control/window at the time Shot was Captured. The exact number and type of dynamic resources displayed in this list depends on control itself. In some cases WinID is not capable to extract any resources that makes this list empty.
 
INFORMATION: To be able to extract dynamic resources the "Allow Capturing Dynamic Resources" option must be enabled. You will still be able to view and save dynamic resources already captured if this option is disabled later.
 
INFORMATION: Dynamic resources obtained via WinID may be different than original "static" resources placed into control/window during compilation of the executable module. This is due to the fact that Operating System and control itself are processing and potentially altering dynamic resources before they are used by control and later extracted by WinID. This could mean that a bitmap captured as a dynamic resource on Windows XP machine might look different from the same bitmap extracted on Windows 95.
 
INFORMATION: Once captured dynamic resources stay in the WinID's memory, meaning that if control/window that originally hosted them changes or gets closed, WinID will retain the copy of original dynamic resources.
 
If you highlight any of the dynamic resource object in the list (by clicking on its icon) WinID will display it in the Preview window below. Depending on the type of dynamic resource object the following might be displayed:

INFORMATION: If dynamic resource is too big to generate timely preview WinID will display an error icon in the Preview window.
 
Properties window for dynamic resource object could be brought up after a double-click on its icon in the list, or by hitting spacebar on the keyboard. This window could be used to receive additional information about metrics of dynamic resource object.
 
The Properties window may look like this:

Depending on the type of dynamic resource object the following information may be available:

 
Saving Options: To display additional options for the dynamic resource object right-click its icon in the list, or press Menu keyboard key. After that WinID will show a menu with saving options for dynamic resource. Depending on the type of dynamic resource object the following options may be available:

 
Save button - gives you additional saving options besides those available through the right-click context menu (see above). When clicked, depending on the type of dynamic resource object currently selected in the list, the following may be available:

 

 

 

 

 

 


Main Page | Download WinID
(c) 1999-2006 www.dennisbabkin.com. All rights reserved.