Cheat Engine

[Ultraplayer]

Many games such as Fallout 4 have a handler that monitors when the user switches a task and pauses the game. Any ideas how to find this handler?

[sbryzl]

Find what the window handle is (hwnd). All programs including games have many ops and variables that track the hwnd. For instance it might call GetWindowInfo which requires the hwnd.
Once you know the handle, search for it in memory and find what accesses it when the window is active and inactive and it should become apparent how to distinguish them.

[daspamer]

Any specific reason?
You could hook wndproc if you are doing something externally.

Otherwise you could just check if there anything that is being toggled(1 or 0) whenever window get deactivated/activated.
Attach to game, set in cheatengine hotkeys, pause/unpack hotkey.
Go to game, press hotkey (to pause), go back to ce, scan 1, un-pause game, scan 0 and repeat...

[atom0s]

This is generally done in the games WNDPROC. You can breakpoint on things like:
- DefWindowProcA / DefWindowProcW
- CallWindowProcA / CallWindowProcW

And trace back from there. Generally, this will probably be handled via the WM_ACTIVATE message or the WM_KILLFOCUS/WM_SETFOCUS messages.

[Ultraplayer]