voidtools forum

Code: Select all

void get_lvitem(HWND everything_listview_hwnd,int index)
{
	wchar_t buf[MAX_PATH];
	DWORD dwProcessID;
	HANDLE hProcess;
	BYTE *lpRemoteBuffer;
	LVITEM lvItem = {0};

	// Get the process id owning the window
	GetWindowThreadProcessId( everything_listview_hwnd, &dwProcessID );

	// Open the process wih all access (You may not have the rights to do this)
	hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwProcessID );
	if (hProcess)
	{
		// Allocate a buffer in the remote process
		lpRemoteBuffer = (BYTE*)VirtualAllocEx( hProcess, NULL, sizeof(LVITEM) + (MAX_PATH * sizeof(wchar_t)),MEM_COMMIT, PAGE_READWRITE );
		if (lpRemoteBuffer)
		{
			SIZE_T num_bytes_written;
			
			// Fill in the LVITEM struct, this is in your own process
			// Set the pszText member to somewhere in the remote buffer,
			// For the example I used the address imediately following the LVITEM stuct
			lvItem.mask = LVIF_TEXT | LVIF_STATE | LVIF_STATE | LVIF_IMAGE;
			lvItem.stateMask = 0xffffffff;
			lvItem.iItem = index;
			lvItem.iSubItem = 0;
			lvItem.cchTextMax = MAX_PATH;

			// Point to after LVITEM in the remote buffer
			lvItem.pszText = (LPTSTR)(lpRemoteBuffer + sizeof( LVITEM )); 

			// Copy the local LVITEM to the remote buffer
			if (WriteProcessMemory( hProcess, (LPVOID)lpRemoteBuffer, &lvItem, sizeof(LVITEM), &num_bytes_written ))
			{
				if (num_bytes_written == sizeof(LVITEM))
				{
//					printf("lpRemoteBuffer %p %p\n",lpRemoteBuffer,lvItem.pszText);

					// Send the message
					if (SendMessage( everything_listview_hwnd, LVM_GETITEMW, 0, (LPARAM)lpRemoteBuffer))
					{
						// Read the struct back from the remote process into local buffer
						ReadProcessMemory( hProcess, (LPVOID)lpRemoteBuffer, &lvItem, sizeof(LVITEM), NULL );

						ReadProcessMemory( hProcess, (LPVOID)(lpRemoteBuffer + sizeof(LVITEM)), buf, (MAX_PATH * sizeof(wchar_t)), NULL );

						//Fix pszText to point to same offset in local buffer
						lvItem.pszText = buf;
						
						printf("Item %d: %08x %S\n",index,lvItem.state,lvItem.pszText);
					}
				}
				else
				{
					printf("WriteProcessMemory bad write %d\n",num_bytes_written);
				}
			}
			else
			{
				printf("WriteProcessMemory failed %d\n",GetLastError());
			}
			
			// Clean-up
			VirtualFreeEx( hProcess, (LPVOID)lpRemoteBuffer, 0, MEM_RELEASE ); 
		}
		else
		{
			printf("virtualalloc failed %d\n",GetLastError());
		}
		
		CloseHandle( hProcess );
	}
	else
	{
		printf("OpenProcess failed %d\n",GetLastError());
	}

}