GetShellWindow vs. GetDesktopWindow

From http://blogs.microsoft.co.il/pavely/2011/06/18/getshellwindow-vs-getdesktopwindow/

In his post about running a process as a standard user from an elevated process, Aaron Margosis uses a technique that gets the access token of the shell process (typically explorer.exe) and uses that token to launch the new process (Sasha Goldshtein also blogged about that).

The first thing his code does is try to locate the shell process id. One way is to look for “explorer.exe” in the list of processes, but that’s a bit limiting, as there may be a different shell, or it may have been renamed for whatever reason. His code calls GetShellWindow to get the shell window handle, followed by GetWindowThreadProcessId that returns the window’s creator thread (and optionally its parent process). A similar looking function is GetDesktopWindow, which seems at first glance as a better candidate, or at least an equivalent. Let’s test that:

HWND hShell = ::GetShellWindow();         
HWND hDesktop = ::GetDesktopWindow();         
cout << "Shell window: " << hShell << endl;         
cout << "Desktop window: " << hDesktop << endl;         

DWORD idShell, idDesktop;         
::GetWindowThreadProcessId(hShell, &idShell);         
::GetWindowThreadProcessId(hDesktop, &idDesktop);         

TCHAR filename[MAX_PATH];         
if(GetImageFileName(idShell, filename, MAX_PATH))         
    wcout << "Shell process: " << filename << endl;         

if(GetImageFileName(idDesktop, filename, MAX_PATH))         
    wcout << "Desktop process: " << filename << endl;

GetImageFileName is a simple helper for getting the process image name:

BOOL GetImageFileName(DWORD pid, TCHAR* name, DWORD size) {         
    HANDLE hProces = ::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);         
    if(!hProces) return FALSE;         
    DWORD sz = size;         
    BOOL success = ::QueryFullProcessImageName(hProces, 0, name, &sz);         
    ::CloseHandle(hProces);         
    return success;         
}

This is the result of running this code:

The difference is evident: GetShellWindow returns the “program manager” window created by explorer.exe, while GetDesktopWindow returns the window created by the Windows subsystem process (csrss.exe). This code requires running elevated, so that opening a handle to csrss.exe succeeds, as it runs (naturally) under the all powerful system account.

What’s the relation between these two Windows? We can find out using the Spy++ utility (spyxx.exe from the Visual Studio tools). Run Spy++ (by default elevated). You should see something like this:

 

If the Windows window is not shown, select Spy->Windows from the menu. Note that the root window handle is the same as the desktop window handle reported by our simple application. This window is owned by csrss.exe. That means it exists whether a shell process exists or not.

Now let’s find the shell window. Select Search->Find Window from the menu and type the handle reported by the application (1013A in this case) (hex is ok).

Click OK. The selected window is now this one:

This is the “Program Manager” of explorer.exe. How can we verify that? Right click the window and select Properties:

Click the Process tab:

Now click the shown process id:

This is indeed explorer.exe.

If we go back and look at the shell window again, and go up in the tree to its parent, we would find it to be the desktop window itself!