This week I worked on a DLL injection to dump all possible client interface elements with their name, IDs, length kind and handler pointer, I'll post my findings later, maybe this weekend.
For the DEV realm, I don't remember trying this, but I don't really know how I can choose this...