8.2.1 Monitoring String-Handle Data

The DDEML uses the MONHSZSTRUCT structure to pass string-handle data. DDESpy displays the following information from this structure:

Task (application instance)

Time, in milliseconds, since you started Windows

Activity type (create, destroy, or increment)

String handle

String contents

The following example shows a typical DDESpy display of string-handle data:

Task:0x94f, Time:519700, String Handle Created: c4a4(this is a test)
Task:0x94f, Time:526126, String Handle Created: c4aa(another test)