How can get font wordpad whit python win32

How do I find the current Word Pad application with Python and win32gui fonts? I was able to find Windows Handler and the child windows A sample application is below

import win32gui,win32api,win32con,win32ui

hwnd = win32gui.GetDesktopWindow()
dc = win32gui.GetWindowDC(hwnd)
hfont = win32gui.SendMessage(dc, win32con.WM_GETFONT, 0,0)
fnt_spc = {}
fnt_n = win32ui.CreateFont(fnt_spc)
lf = win32gui.SelectObject(hfont,fnt_n.GetSafeHandle())
print(lf.lfFaceName)

As you can see in the Spy++, the control in WordPad is Rich Edit:

According to the Unsupported Edit Control Functionality: EM_GETCHARFORMAT should be used instead of WM_GETFONT.

First, you need to get the Rich Edit handle(with Spy++ directly,or WindowFromPoint, FindWindowEx, EnumChildWindowsand etc. But GetDesktopWindow you used will just return a handle to the desktop window, and SendMessage receive a window handle but not a device context handle)

In addition, you still need to note that when sending EM_GETCHARFORMAT message in another process, you need to request a piece of memory for reading and writing a CHARFORMAT2 structure in the window process to interact with the two processes.

C++ Sample(remove the error checking):

#include <iostream>
#include <windows.h>
#include <Richedit.h>
int main(int argc, char** argv)
{
    HWND hwnd = (HWND)0x00090BF0;
    DWORD pid = 0;
    GetWindowThreadProcessId(hwnd,&pid);
    HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION| PROCESS_VM_READ | PROCESS_VM_WRITE,false, pid);//7784
    CHARFORMAT2 cp;
    cp.cbSize = sizeof(CHARFORMAT2);
    cp.dwMask = CFM_FACE;
    CHARFORMAT2* lf = (CHARFORMAT2*)VirtualAllocEx(hProcess,NULL,sizeof(CHARFORMAT2), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    BOOL ret = WriteProcessMemory(hProcess,lf,&cp, sizeof(CHARFORMAT2),NULL);
    //ZeroMemory(&lf,sizeof(lf));

    LRESULT lr = SendMessage(hwnd, EM_GETCHARFORMAT, SCF_SELECTION, (LPARAM)lf);

    ret = ReadProcessMemory(hProcess, lf, &cp, sizeof(CHARFORMAT2), NULL);
    std::cout << cp.szFaceName << std::endl;
    VirtualFreeEx(hProcess,lf, 0, MEM_RELEASE);
    return 0;
}

Result:

Courier New