不幸的是,当访问由另一个程序创建的窗口时,这并不容易,因为系统不会对指针进行必要的窗口消息编组。您需要从一个共享的 DLL 文件(在其中创建一些系统范围的 Windows Hook 以将其加载到其他进程)或使用其他 hack(如进程间内存访问)来执行此操作。
如果在同一个程序中访问 SysHeader32 窗口,就很简单:
发送消息HDM_GETITEMCOUNT
,它返回项目数。
将消息HDM_GETITEM
设置wParam
为要检索的项目的索引并lParam
设置为指向适当设置HDITEM
结构的指针。特别是设置mask
为HDI_TEXT
准备一个缓冲区pszText
并将其长度设置为cchTextMax
。
例子:
int count = SendMessage(hWnd, HDM_GETITEMCOUNT, 0, 0);
std::cout << "There are " << count << " items.\n";
for (int i = 0; i < count; i++) {
TCHAR name[260];
HDITEM hdi;
hdi.mask = HDI_TEXT;
hdi.pszText = name;
hdi.cchTextMax = 260;
SendMessage(hWnd, HDM_GETITEM, i, reinterpret_cast<LPARAM>(&hdi));
std::cout << " " << i << ") " << hdi.pszText << "\n";
}
因为我们需要将输入和输出内存存储在另一个程序的空间中,所以需要这样的东西(请根据您的喜好添加错误检查等):
struct InterProcessData {
HDITEM hdi;
TCHAR buffer[260];
};
// Open the owning process and allocate a buffer big enough for
// our inter-process communication
DWORD dwProcessId;
GetWindowThreadProcessId(hWnd, &dwProcessId);
HANDLE hProcess = OpenProcess(
PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE,
FALSE, dwProcessId);
InterProcessData* pRemoteData = reinterpret_cast<InterProcessData*>(
VirtualAllocEx(hProcess, NULL, sizeof(InterProcessData), MEM_COMMIT, PAGE_READWRITE));
int count = SendMessage(hWnd, HDM_GETITEMCOUNT, 0, 0);
std::cout << "There are " << count << " items.\n";
for (int i = 0; i < count; i++) {
InterProcessData data;
data.hdi.mask = HDI_TEXT;
data.hdi.pszText = pRemoteData->buffer;
data.hdi.cchTextMax = 260;
// Write the HDITEM structure to the space in the remote process
// (without the buffer, its contents are undefined anyway)
WriteProcessMemory(hProcess, pRemoteData, &data, sizeof(data.hdi), NULL);
// Send the message itself, passing the remote address in lParam
SendMessage(hWnd, HDM_GETITEM, i, reinterpret_cast<LPARAM>(&pRemoteData->hdi));
// Read the data back, HDITEM and the buffer
ReadProcessMemory(hProcess, pRemoteData, &data, sizeof(data), NULL);
// The documentation says that the pszText can point elsewhere -
// copy it to our buffer in that case
if (data.hdi.pszText != pRemoteData->buffer)
ReadProcessMemory(hProcess, data.hdi.pszText, data.buffer, data.hdi.cchTextMax * sizeof(TCHAR), NULL);
std::cout << " " << i << ") " << data.buffer << "\n";
}
// Cleanup
VirtualFreeEx(hProcess, pRemoteData, 0, MEM_RELEASE);
CloseHandle(hProcess);