Getfocus Windows 11

NTDEV
1

Hi all,
I'm investigating the function GetFocus in Windows 11 which unlike win10 does not involve a syscall anymore.

I've disassembled the function and that's the pesudo code of it:
HWND GetFocus(void)

{
/* 0x21180 1851 GetFocus */
if (Win32ClientInfo[12] != (void *)0x0) {
return *(HWND *)((longlong)Win32ClientInfo[12] + 0x20);
}
return (HWND)Win32ClientInfo[12];
}

After some digging and looking at the assembly code, I've realized that instead of doing a syscall it reads the value from the TEB.

Out of curiosity, I tried to figure out how the focus works in windows 11 and realized what set this value and if it can be manipulated in some way.

Does anyone have any idea or investigated this function in windows 11 maybe?

Thanks!

2

the implementation of thread input processing has been moved around a few times in different versions of windows, but the logic is basically the same as it has always been. With a few important exceptions, each thread that wants to show windows, runs a loop called a message pump and dispatches them - performing default or custom actions accordingly. User input triggers the system to add messages to the queue. As do functions like SetFocus.

It is important to note that the focus is not a system wide concept at this level. It is the focus among all of the windows owned by this thread. And yes, controls like text or combo boxes are windows too.

Its quite a broad question. You can find out a lot by looking at DefWindowProc. If you have a more specific question, we can probably provide a better answer

5

Let me explain myself better, My final goal is to manipulate a thread to think one of its windows is in focus even tho it's not.
In Windows 10 I was able to do it by hooking NtUserGetThreadState but in Windows 11 GetFocus is no longer calling NtUserGetThreadState but instead reads the focused hwnd from the TEB, so that solution isn't possible anymore.
so instead of hooking NtUserGetThreadState, I'm looking for the function that modifies that TEB value and prevents it from writing anything else than a specific window that I wish the thread to keep thinking it's in focus

I hope this is more clear and easy to understand.
Thanks in advanced!!!

6

If you want the focus to be on some other window, why don't you just set it to that window? If you only want the focus to be modified some of the time, then detour GetFocus?

All of this presumes that you have a legitimate reason for mucking with the focus