What actually handles the drawing of the Windows Wallpaper?

Question

I'm trying to work on a project where I can animate the windows 7 wallpaper, either with opengl/directx, or GDI. I looked into how the windows desktop windows are laid out, and i figured out the whole

"Progman" -> "SHELLDLL_DefView" -> "SysListView32"

hierarchy. I tried hooking the SysListView32's WndProc and tried messing around with the messages using an injected c# dll so I could prevent the desktop from drawing the wallpaper when I forced it to change using the Control Panel -> Personalize menu. None of this actually stopped the wallpaper from being updated, so I figured that explorer.exe does not actually handle drawing the wallpaper.

To confirm this, I killed explorer.exe and set up a little c# program that changes the wallpaper on a 10 second timer to a random one. As I expected, the wallpaper kept changing, leading me to believe that explorer.exe does not actually handle the drawing of the wallpaper!

Unfortunately, this is where i'm completely lost. I have no idea what else is responsible for drawing the wallpaper, and how I can take over it's drawing so I can handle the drawing. I've tried to google this for a few days now, with little progress. I'm hoping someone here can guide me in the right direction.

Answer 1

The Desktop (including the Bitmap on it) is actually drawn by the window system itself. So that is basically quite deep and old, too. So according to the changes that happened since NT4 I suppose that the painting is actually done in win32k.sys . The driver was created to replace win32.dll which would have done everything in user-mode with context switching.

This said, it goes conform with what erykson commented to your question: win32k!xxxInternalPaintDesktop is the bad guy.

However it should be possible to acquire the DC of the Desktop HWND (0 afaik) and attach it to your own drawing. Not sure if you can turn it into a DirectX DC but this is up to you to try.

BTW. It is possible to re-parent and to capture foreign windows (HWNDs) and associated device contexts (DCs). However you might need to be privileged or an administrator. (security checked)