Seeing as DWM has access to the hWND, it can get the device context ( ((PDCE)Wnd->pcls->pdce)->hDC), and then the surface from the _DC structure ( DC->dclevel.pSurface). Several messages are sent to DWM, including when the window is shown or hidden. The thread continually runs in CPortBase::PortThreadInternal, calling NtReplyWaitReceivePort on the ALPC port it created, and when it receives a message, it calls CPortBase::RoutePacket. LPC is now implemented internally using ALPC, and can be synchronous or asynchronous, but in this case, the message is sent asynchronously.ĭwm.exe has a port thread that waits on the port. Object is the DWM ALPC port, a2 is the window handle hWND, a3 is the thread desktop window handle. Win32k!DwmAsyncChildCreate constructs a LPC _PORT_MESSAGE message and inserts the parameters of the call into the message. Win32k!xxxCreateWindowEx then calls win32k!DwmAsyncChildCreate: This returns a handle integer into the global user handle table managed by win32k. It ends up calling win32k!xxxCreateWindowEx, which allocates a new window ( tagWND) on the user heap using win32k!HmAllocObject.

User32!CreateWindowExW eventually calls user32!NtUserCreateWindowEx, which is a win32k syscall.

Desktop manager windows 10