This test works for me on Windows 10 22H2 in a C++/Win32 app :
(declarations adapted from Process Hacker source code)
#include <windows.h>
#include <tchar.h>
#pragma comment(linker,"\"/manifestdependency:type='win32' \
name='Microsoft.Windows.Common-Controls' version='6.0.0.0' \
processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"")
HINSTANCE hInst;
LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
int nWidth = 300, nHeight = 100;
#define IDC_STATIC 10
#define IDC_STATIC1 11
typedef ULONG WNF_CHANGE_STAMP, * PWNF_CHANGE_STAMP;
typedef struct _WNF_STATE_NAME
{
ULONG Data[2];
} WNF_STATE_NAME, * PWNF_STATE_NAME;
typedef struct _WNF_TYPE_ID
{
GUID TypeId;
} WNF_TYPE_ID, * PWNF_TYPE_ID;
typedef const WNF_TYPE_ID* PCWNF_TYPE_ID;
typedef const WNF_STATE_NAME* PCWNF_STATE_NAME;
typedef NTSTATUS(WINAPI* PWNF_USER_CALLBACK)
(
_In_ WNF_STATE_NAME StateName,
_In_ WNF_CHANGE_STAMP ChangeStamp,
_In_opt_ PWNF_TYPE_ID TypeId,
_In_opt_ PVOID CallbackContext,
_In_reads_bytes_opt_(Length) const PVOID Buffer,
_In_ ULONG Length
);
typedef struct _WNF_CONTEXT_HEADER {
USHORT NodeTypeCode;
USHORT NodeByteSize;
} WNF_CONTEXT_HEADER, * PWNF_CONTEXT_HEADER;
typedef struct _WNF_STATE_NAME_INTERNAL
{
ULONG64 Version : 4;
ULONG64 NameLifetime : 2;
ULONG64 DataScope : 4;
ULONG64 PermanentData : 1;
ULONG64 Unique : 53;
} WNF_STATE_NAME_INTERNAL, * PWNF_STATE_NAME_INTERNAL;
typedef struct _WNF_DELIVERY_DESCRIPTOR
{
ULONG64 SubscriptionId;
WNF_STATE_NAME StateName;
WNF_CHANGE_STAMP ChangeStamp;
ULONG StateDataSize;
ULONG EventMask;
WNF_TYPE_ID TypeId;
ULONG StateDataOffset;
} WNF_DELIVERY_DESCRIPTOR, * PWNF_DELIVERY_DESCRIPTOR;
typedef struct _WNF_NAME_SUBSCRIPTION {
WNF_CONTEXT_HEADER Header;
ULONG64 SubscriptionId;
WNF_STATE_NAME_INTERNAL StateName;
WNF_CHANGE_STAMP CurrentChangeStamp;
LIST_ENTRY NamesTableEntry;
PWNF_TYPE_ID TypeId;
SRWLOCK SubscriptionLock;
LIST_ENTRY SubscriptionsListHead;
ULONG NormalDeliverySubscriptions;
ULONG NotificationTypeCount[5];
PWNF_DELIVERY_DESCRIPTOR RetryDescriptor;
ULONG DeliveryState;
ULONG64 ReliableRetryTime;
} WNF_NAME_SUBSCRIPTION, *PWNF_NAME_SUBSCRIPTION;
typedef struct _WNF_SERIALIZATION_GROUP
{
WNF_CONTEXT_HEADER Header;
ULONG GroupId;
LIST_ENTRY SerializationGroupList;
ULONG64 SerializationGroupValue;
ULONG64 SerializationGroupMemberCount;
} WNF_SERIALIZATION_GROUP, *PWNF_SERIALIZATION_GROUP;
typedef struct _WNF_USER_SUBSCRIPTION
{
WNF_CONTEXT_HEADER Header;
LIST_ENTRY SubscriptionsListEntry;
PWNF_NAME_SUBSCRIPTION NameSubscription;
PWNF_USER_CALLBACK Callback;
PVOID CallbackContext;
ULONG64 SubProcessTag;
ULONG CurrentChangeStamp;
ULONG DeliveryOptions;
ULONG SubscribedEventSet;
PWNF_SERIALIZATION_GROUP SerializationGroup;
ULONG UserSubscriptionCount;
ULONG64 Unknown[10];
}
WNF_USER_SUBSCRIPTION, *PWNF_USER_SUBSCRIPTION;
typedef NTSTATUS(WINAPI* RtlQueryWnfStateData)
(
_Out_ PWNF_CHANGE_STAMP ChangeStamp,
_In_ WNF_STATE_NAME StateName,
_In_ PWNF_USER_CALLBACK Callback,
_In_opt_ PVOID CallbackContext,
_In_opt_ PWNF_TYPE_ID TypeId
);
typedef NTSTATUS(WINAPI* RtlSubscribeWnfStateChangeNotification)
(
_Outptr_ WNF_USER_SUBSCRIPTION* SubscriptionHandle,
_In_ WNF_STATE_NAME StateName,
_In_ WNF_CHANGE_STAMP ChangeStamp,
_In_ PWNF_USER_CALLBACK,
_In_opt_ PVOID CallbackContext,
_In_opt_ PCWNF_TYPE_ID TypeId,
_In_opt_ ULONG SerializationGroup,
_Reserved_ ULONG Flags
);
WNF_STATE_NAME WNF_SHEL_QUIETHOURS_ACTIVE_PROFILE_CHANGED{ 0xA3BF1C75, 0xD83063E };
typedef struct {
int FocusAssist;
//...
} FOCUSASSIST;
HWND _hWnd = NULL;
NTSTATUS WINAPI NotificationCallback(
_In_ WNF_STATE_NAME StateName,
_In_ WNF_CHANGE_STAMP ChangeStamp,
_In_opt_ PWNF_TYPE_ID TypeId,
_In_opt_ PVOID CallbackContext,
_In_reads_bytes_opt_(Length) const PVOID Buffer,
_In_ ULONG Length)
{
Beep(5000, 10);
PVOID pData = (PVOID)CoTaskMemAlloc(Length);
CopyMemory(pData, Buffer, Length);
auto FocusAssist = (FOCUSASSIST*)pData;
// On Windows 10 : 0 : Off, 1 : Priority Only, 2 : Alarm Only
TCHAR wsText[255];
HWND hWnsStatic = GetDlgItem(_hWnd, IDC_STATIC1);
switch (FocusAssist->FocusAssist)
{
case 0:
wsprintf(wsText, TEXT("Off (%d)"), FocusAssist->FocusAssist);
break;
case 1:
wsprintf(wsText, TEXT("Priority Only (%d)"), FocusAssist->FocusAssist);
break;
case 2:
wsprintf(wsText, TEXT("Alarm Only (%d)"), FocusAssist->FocusAssist);
break;
default:
wsprintf(wsText, TEXT("Other (%d)"), FocusAssist->FocusAssist);
}
SetWindowText(hWnsStatic, wsText);
/*
wsprintf(wsText, TEXT("Focus Assist : %d\r\n"), FocusAssist->FocusAssist);
OutputDebugString(wsText);*/
CoTaskMemFree(pData);
return 0;
}
int APIENTRY wWinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPWSTR lpCmdLine, _In_ int nCmdShow)
{
hInst = hInstance;
WNDCLASSEX wcex =
{
sizeof(WNDCLASSEX), CS_HREDRAW | CS_VREDRAW, WndProc, 0, 0, hInst, LoadIcon(NULL, IDI_APPLICATION),
LoadCursor(NULL, IDC_ARROW), (HBRUSH)(COLOR_WINDOW + 1), NULL, TEXT("WindowClass"), NULL,
};
if (!RegisterClassEx(&wcex))
return MessageBox(NULL, TEXT("Cannot register class !"), TEXT("Error"), MB_ICONERROR | MB_OK);
int nX = (GetSystemMetrics(SM_CXSCREEN) - nWidth) / 2, nY = (GetSystemMetrics(SM_CYSCREEN) - nHeight) / 2;
_hWnd = CreateWindowEx(0, wcex.lpszClassName, TEXT("Test"), WS_OVERLAPPEDWINDOW, nX, nY, nWidth, nHeight, NULL, NULL, hInst, NULL);
if (!_hWnd)
return MessageBox(NULL, TEXT("Cannot create window !"), TEXT("Error"), MB_ICONERROR | MB_OK);
ShowWindow(_hWnd, SW_SHOWNORMAL);
UpdateWindow(_hWnd);
MSG msg;
while (GetMessage(&msg, NULL, 0, 0))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
return (int)msg.wParam;
}
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
static HWND hWndStatic = NULL, hWndStatic1 = NULL;
int wmId, wmEvent;
switch (message)
{
case WM_CREATE:
{
hWndStatic = CreateWindowEx(0, TEXT("Static"), TEXT("Focus Assist : "), WS_CHILD | WS_VISIBLE, 10, 10, 100, 32, hWnd, (HMENU)IDC_STATIC, hInst, NULL);
hWndStatic1 = CreateWindowEx(0, TEXT("Static"), TEXT(""), WS_CHILD | WS_VISIBLE, 120, 10, 200, 32, hWnd, (HMENU)IDC_STATIC1, hInst, NULL);
HINSTANCE hDLL = LoadLibrary(TEXT("NtDll.dll"));
if (hDLL)
{
RtlSubscribeWnfStateChangeNotification pSubscribe = (RtlSubscribeWnfStateChangeNotification)GetProcAddress(hDLL, "RtlSubscribeWnfStateChangeNotification");
RtlQueryWnfStateData pQuery = (RtlQueryWnfStateData)GetProcAddress(hDLL, "RtlQueryWnfStateData");
if (pSubscribe && pQuery)
{
WNF_USER_SUBSCRIPTION userSubscription{};
WNF_CHANGE_STAMP changeStamp = 0;
NTSTATUS ntStatus = pSubscribe(&userSubscription,
WNF_SHEL_QUIETHOURS_ACTIVE_PROFILE_CHANGED,
changeStamp,
NotificationCallback, 0, 0, 0, 0);
}
}
return 0;
}
break;
case WM_PAINT:
{
PAINTSTRUCT ps;
HDC hDC = BeginPaint(hWnd, &ps);
EndPaint(hWnd, &ps);
}
break;
case WM_DESTROY:
{
PostQuitMessage(0);
return 0;
}
break;
default:
return DefWindowProc(hWnd, message, wParam, lParam);
}
return 0;
}