# WinMsg Tester v1.0.0

**Test Windows message delivery to any application window.**  
Free tool from [wireandbrain.com](https://wireandbrain.com)

---

## What it does

Helps you answer: *"Can I inject text or keystrokes into this window programmatically?"*

WinMsg Tester lets you pick any open window on your desktop and fire text at it using
three different Windows injection methods. The log tells you exactly what was sent and
whether it landed. Useful for UI automation, testing, and understanding why your
automation script isn't working.

---

## Requirements

- Windows 10 or 11
- Python 3.9 or newer (standard library only — no pip installs needed)

---

## Quick start

```
python winmsg_tester.py
```

1. Click **⊕ Pick Window** — hover your cursor over the target app — left-click to lock it
2. Type your message in the text field
3. Try **Method A** first. If nothing appears, try B, then C.
4. The log shows what was sent and how many events were injected.

---

## The three send methods

| Method | How it works | Best for |
|--------|-------------|----------|
| **A: SendInput** | Injects at OS level, below the Win32 message queue | Modern apps, .NET, WPF |
| **B: PostMessage WM_CHAR** | Classic Win32 message posting | Native Edit controls, legacy apps |
| **C: WM_SETTEXT** | Sets the text content of a control directly | Simple read/write of field contents |

**Enter key:** Method A sends Enter reliably. Method B sends Enter via WM_KEYDOWN
(works on most native controls). Method C does not simulate keystrokes.

---

## Why won't it work on Chrome / Electron / elevated apps?

This is Windows protecting you, not a bug in this tool.

**User Interface Privilege Isolation (UIPI)** — introduced in Windows Vista — prevents
lower-integrity processes from sending messages to higher-integrity windows. Specifically:

- **Chrome, Electron apps** (like VS Code, Slack, Discord): These run in a sandboxed
  renderer process. Even at the same integrity level, Chromium's input handling deliberately
  ignores synthesized messages as a security measure. SendInput (Method A) partially bypasses
  this by injecting at the hardware-input level, but the Chromium security layer can still
  filter it.

- **Elevated apps** (running as Administrator): If the target app is elevated and this tool
  is not, all three methods will silently fail. Run this tool as Administrator to test
  elevated targets.

- **System processes**: Cannot receive injected messages at all by design.

If all three methods fail on your target, the answer is: that window is intentionally
protected from external injection. This is the correct and expected behavior for security-
sensitive applications.

---

## File verification

Before running any downloaded script, verify the SHA-256 hash matches the published value
in `winmsg_tester.sha256`. On Windows PowerShell:

```powershell
Get-FileHash winmsg_tester.py -Algorithm SHA256
```

Compare the output to the hash in `winmsg_tester.sha256`. If they don't match, do not run
the file — download it again from wireandbrain.com.

---

## License

MIT License. Free to use, modify, and distribute.  
Attribution appreciated but not required.

---

## Version history

| Version | Date | Notes |
|---------|------|-------|
| 1.0.0 | 2026-06-28 | Initial release |

---

*Wire & Brain — from the bench.*