正如您在 Spy++ 中看到的,写字板中的控件是 Rich Edit:

根据Unsupported Edit Control Functionality :EM_GETCHARFORMAT
应该使用而不是WM_GETFONT
.
首先,您需要获取 Rich Edit 句柄(直接使用 Spy++ 或WindowFromPoint
,FindWindowEx
等EnumChildWindows
。但GetDesktopWindow
您使用的只会返回桌面窗口的句柄,并SendMessage
接收窗口句柄而不是设备上下文句柄)
另外,还需要注意的是,EM_GETCHARFORMAT
在另一个进程中发送消息时,需要申请一块内存,用于在窗口进程中读写一个CHARFORMAT2
结构体,以便与两个进程进行交互。
C++ 示例(删除错误检查):
#include <iostream>
#include <windows.h>
#include <Richedit.h>
int main(int argc, char** argv)
{
HWND hwnd = (HWND)0x00090BF0;
DWORD pid = 0;
GetWindowThreadProcessId(hwnd,&pid);
HANDLE hProcess = OpenProcess(PROCESS_VM_OPERATION| PROCESS_VM_READ | PROCESS_VM_WRITE,false, pid);//7784
CHARFORMAT2 cp;
cp.cbSize = sizeof(CHARFORMAT2);
cp.dwMask = CFM_FACE;
CHARFORMAT2* lf = (CHARFORMAT2*)VirtualAllocEx(hProcess,NULL,sizeof(CHARFORMAT2), MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
BOOL ret = WriteProcessMemory(hProcess,lf,&cp, sizeof(CHARFORMAT2),NULL);
//ZeroMemory(&lf,sizeof(lf));
LRESULT lr = SendMessage(hwnd, EM_GETCHARFORMAT, SCF_SELECTION, (LPARAM)lf);
ret = ReadProcessMemory(hProcess, lf, &cp, sizeof(CHARFORMAT2), NULL);
std::cout << cp.szFaceName << std::endl;
VirtualFreeEx(hProcess,lf, 0, MEM_RELEASE);
return 0;
}
结果:
快递新