I am trying to develop an app that can bring another app to foreground, so I analyze the behaviour of Windows Explorer (Alt-Tab) using Spy++, for me it is interesting which app or which threis actually activated, so I monitor the message WM_ACTIVATEAPP.
WM_ACTIVATEAPP, when wparam=false, according to the MSDN documentation, lparam represents the threadid of the thread being activated.
Here is an example from my Spy++ log: <00037> 00030DD6 S WM_ACTIVATEAPP fActive:False dwThreadID:000008F0
My problem is: the given dwThreadID 8F0 should be the application that gets activated. But: when I switch to the thread-view in Spy++, and search for a thread 8F0, I find nothing. That thread seems not to exist at all. So how do I translate this thread-ID to a process ID?
Lots of reasons for this, but the most common one is that Spy++ does not give you a live view of the machine state. It makes a snapshot when you start it, that snapshot can rapidly become stale. Refreshing a window like Spy + Threads is something you have to do by hand. Use Window + Refresh or press F5.
While that sounds like a pretty nasty flaw, it is actually intentional. Iterating all of the threads and (especially) all of the windows that exist on the machine is a pretty expensive operation. A debugging tool that has too much of an impact on what's being observed is not a trustworthy tool.
Just get in the habit of pressing F5 when you can't see what you think should be there.