CLS

The CLS structure (formally tagCLS) is, perhaps unsurprisingly, how WIN32K.SYS—and before it, WINSRV.DLL—represents a window class.

Documentation Status

The CLS is not documented. Though symbol files for WIN32K.SYS in Windows 8 and higher name the CLS in the C++ decorations of internal routines, type information for the structure is present only in symbol files for Windows 7—not before and not since.

Variability

Among undocumented WIN32K structures that have more than just a handful of members, the CLS is striking for its stability. No variation is known since Windwos XP. The following changes of size are known:

Layout

It is well known that the CLS itself is not the whole of its size. Each CLS is followed in its allocation by a number of “extra” bytes that is specified as cbClsExtra in the WNDCLASS or WNDCLASSEX when registering the class.

CLS *pclsNext;

ATOM atomClassName;

ATOM atomNVClassName;

USHORT fnid;

HANDLE hheapDesktop;

DESKTOP *rpdeskParent;

DCE *pdce;

INT cWndReferenceCount;

USHORT hTaskWow;

USHORT flags;

USHORT CSF_flags;

PSTR lpszClientAnsiMenuName;

PWSTR lpszClientUnicodeMenuName;

DWORD adwWOW [2];

DWORD dwExpWinVer;

ULONG hTaskWow;

CALLPROCDATA *spcpdFirst;

CLS *pclsBase;

CLS *pclsClone;

<unknown-type> lpfnWorker;

INT cWndReferenceCount;

For its !dcls command, the USEREXTS debugger extension for Windows NT 3.51 has pDCE and just flags for what symbol files have later as pdce as CSF_flags. It also simplifies to lpszClientMenuName from lpszClientUnicodeMenuName. That said, if the !dso command in the update for Windows NT 4.0 does reliably reproduce names from Microsoft’s headers, then flags is what the CSF_flags actually were named.

More helpfully, these debugger extensions give the name adwWOW for what would otherwise be presented above as an unknown eight-byte structure. Later versions place it after the extra class data, if it is allowed for at all: it is meaningful only for classes that are registered by threads that double as 16-bit tasks.

Not only does the next run of members have the layout of the documented WNDCLASS structure but they are copied as a block from a WNDCLASS in version 3.10 and in later versions from that part of a WNDCLASSEX that follows the cbSize. The debugger extensions for Windows NT 4.0 confirm that they are formally a COMMON_WNDCLASS structure as an unnamed CLS member.

UINT style;

WNDPROC lpfnWndProc;

INT cbClsExtra;

INT cbWndExtra;

HINSTANCE hModule;

CURSOR *spicn;

CURSOR *spcur;

HBRUSH hbrBackground;

PWSTR lpszMenuName;

PSTR lpszAnsiClassName;

CURSOR *spicnSm;

Flags

Debugger extensions from early development kits helpfully have descriptive strings for the bits within the CSF_flags. It seems highly plausible that these are the macros that are used for the bits in the source code.