The main test which AJ suggested would be to 'force' native user32 to call RegisterClassNameW. There would be a dummy dll containing a RegisterClassNameW to which lets say the Button control would be redirected using a manifest.
If I got it right you're talking about a dummy dll with compiled in (or separate doesn't matter) manifest with 'windowclass' entry (and without to check it's actually used) to Button, after that we trigger test application reload and dump this RegisterClassNameW call someway?
Yeah that's the idea. I'm quite certain that this mechanism is used to register the class. I just searched some more this morning and found stuff I didn't fnd before about subclassing. Read this http://msdn.microsoft.com/en-us/library/bb773183%28VS.85%29.aspx It talks about four new subclassing related functions which were introduced in XP, so it might mean that the controls are subclassed after all?
Roderick