{ "id": "e6fc25b9-6b98-4bcb-8b6f-ed997e235ebd", "created_at": "2026-04-06T00:19:55.265682Z", "updated_at": "2026-04-10T03:23:51.025079Z", "deleted_at": null, "sha1_hash": "390eea93ff8ea3b596402c9b8bf26d5937f9c2da", "title": "GetWindowLongA function (winuser.h) - Win32 apps", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 58127, "plain_text": "GetWindowLongA function (winuser.h) - Win32 apps\r\nBy jwmsft\r\nArchived: 2026-04-05 17:19:38 UTC\r\nRetrieves information about the specified window. The function also retrieves the 32-bit (DWORD) value at the\r\nspecified offset into the extra window memory.\r\nNote  If you are retrieving a pointer or a handle, this function has been superseded by the GetWindowLongPtr\r\nfunction. (Pointers and handles are 32 bits on 32-bit Windows and 64 bits on 64-bit Windows.) To write code that\r\nis compatible with both 32-bit and 64-bit versions of Windows, use GetWindowLongPtr.\r\nSyntax\r\nLONG GetWindowLongA(\r\n [in] HWND hWnd,\r\n [in] int nIndex\r\n);\r\nParameters\r\n[in] hWnd\r\nType: HWND\r\nA handle to the window and, indirectly, the class to which the window belongs.\r\n[in] nIndex\r\nType: int\r\nThe zero-based offset to the value to be retrieved. Valid values are in the range zero through the number of bytes\r\nof extra window memory, minus four; for example, if you specified 12 or more bytes of extra memory, a value of\r\n8 would be an index to the third 32-bit integer. To retrieve any other value, specify one of the following values.\r\nValue Meaning\r\nGWL_EXSTYLE\r\n-20\r\nRetrieves the extended window styles.\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms633584.aspx\r\nPage 1 of 4\n\nGWL_HINSTANCE\r\n-6\r\nRetrieves a handle to the application instance.\r\nGWL_HWNDPARENT\r\n-8\r\nRetrieves a handle to the parent window, if any.\r\nGWL_ID\r\n-12\r\nRetrieves the identifier of the window.\r\nGWL_STYLE\r\n-16\r\nRetrieves the window styles.\r\nGWL_USERDATA\r\n-21\r\nRetrieves the user data associated with the window. This data is intended for use\r\nby the application that created the window. Its value is initially zero.\r\nGWL_WNDPROC\r\n-4\r\nRetrieves the address of the window procedure, or a handle representing the\r\naddress of the window procedure. You must use the CallWindowProc function to\r\ncall the window procedure.\r\n \r\nThe following values are also available when the hWnd parameter identifies a dialog box.\r\nValue Meaning\r\nDWL_DLGPROC\r\nDWLP_MSGRESULT +\r\nsizeof(LRESULT)\r\nRetrieves the address of the dialog box procedure, or a handle representing\r\nthe address of the dialog box procedure. You must use the CallWindowProc\r\nfunction to call the dialog box procedure.\r\nDWL_MSGRESULT\r\n0\r\nRetrieves the return value of a message processed in the dialog box\r\nprocedure.\r\nDWL_USER\r\nDWLP_DLGPROC +\r\nsizeof(DLGPROC)\r\nRetrieves extra information private to the application, such as handles or\r\npointers.\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms633584.aspx\r\nPage 2 of 4\n\nReturn value\r\nType: LONG\r\nIf the function succeeds, the return value is the requested value.\r\nIf the function fails, the return value is zero. To get extended error information, call GetLastError.\r\nIf SetWindowLong has not been called previously, GetWindowLong returns zero for values in the extra window\r\nor class memory.\r\nReserve extra window memory by specifying a nonzero value in the cbWndExtra member of the\r\nWNDCLASSEX structure used with the RegisterClassEx function.\r\nExamples\r\nFor an example, see Creating, Enumerating, and Sizing Child Windows.\r\nNote\r\nThe winuser.h header defines GetWindowLong as an alias that automatically selects the ANSI or Unicode version\r\nof this function based on the definition of the UNICODE preprocessor constant. Mixing usage of the encoding-neutral alias with code that is not encoding-neutral can lead to mismatches that result in compilation or runtime\r\nerrors. For more information, see Conventions for Function Prototypes.\r\nRequirements\r\nRequirement Value\r\nMinimum supported client Windows 2000 Professional [desktop apps only]\r\nMinimum supported server Windows 2000 Server [desktop apps only]\r\nTarget Platform Windows\r\nHeader winuser.h (include Windows.h)\r\nLibrary User32.lib\r\nDLL User32.dll\r\nAPI set ext-ms-win-ntuser-windowclass-l1-1-0 (introduced in Windows 8)\r\nSee also\r\nCallWindowProc\r\nConceptual\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms633584.aspx\r\nPage 3 of 4\n\nGetWindowLongPtr\r\nReference\r\nRegisterClassEx\r\nSetParent\r\nSetWindowLong\r\nWNDCLASS\r\nWindow Classes\r\nSource: https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms633584.aspx\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "references": [ "https://msdn.microsoft.com/library/windows/desktop/ms633584.aspx" ], "report_names": [ "ms633584.aspx" ], "threat_actors": [ { "id": "d90307b6-14a9-4d0b-9156-89e453d6eb13", "created_at": "2022-10-25T16:07:23.773944Z", "updated_at": "2026-04-10T02:00:04.746188Z", "deleted_at": null, "main_name": "Lead", "aliases": [ "Casper", "TG-3279" ], "source_name": "ETDA:Lead", "tools": [ "Agentemis", "BleDoor", "Cobalt Strike", "CobaltStrike", "RbDoor", "RibDoor", "Winnti", "cobeacon" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434795, "ts_updated_at": 1775791431, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/390eea93ff8ea3b596402c9b8bf26d5937f9c2da.pdf", "text": "https://archive.orkl.eu/390eea93ff8ea3b596402c9b8bf26d5937f9c2da.txt", "img": "https://archive.orkl.eu/390eea93ff8ea3b596402c9b8bf26d5937f9c2da.jpg" } }