DLL Injection: DrawText and TextOut doesn't return all text

Question

I successfully inject my DLL into the program. However I would like to get the information from a ListBox. WM_GETTEXT is not working so I had to do the dll injection. I am receiving a lof of text but from the desired control I have got nothing.

Here is my code:

#include <Windows.h>
#include "detours.h"
#include <tchar.h>
#include <stdio.h>
// Function pointer to the original (un-detoured) DrawText API
int (WINAPI * Real_DrawText)(HDC a0, LPCWSTR a1, int a2, LPRECT a3, UINT a4) = DrawTextW;
int (WINAPI * Real_TextOut)(HDC hdc, int nXStart, int nYStart, LPCTSTR lpString, int cchString) = TextOutW;


void writeToFile(LPCWSTR text)
{
    FILE *out;

    if (!(out = fopen("C:\\OUTPUT\\out.txt", "a+"))) {
        MessageBox (0,  TEXT("ERROR FILE"),  TEXT("ERROR FILE"), MB_ICONINFORMATION);
        return;
    }
    fwprintf(out, text);
    fclose(out);
}
// Our custom version of DrawText
int WINAPI Mine_DrawText(HDC hdc, LPCWSTR text,  int nCount, LPRECT lpRect, UINT uOptions)
{

    int rv = Real_DrawText(hdc, text, nCount, lpRect, uOptions);


    WideCharToMultiByte(CP_ACP, WC_DEFAULTCHAR, text, -1, txt, 0, NULL, NULL);
    writeToFile(text);
    return rv;
}

int WINAPI Mine_TextOut(HDC hdc, int nXStart, int nYStart, LPCTSTR lpString, int cchString) {

    int rv = Real_TextOut(hdc, nXStart, nYStart, lpString, cchString);

    writeToFile(lpString);

    return rv;
}

// Install the DrawText detour whenever this DLL is loaded into any process...
BOOL APIENTRY DllMain( HANDLE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved  )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBox (0,  TEXT("From DLL\n"),  TEXT("Process Attach"), MB_ICONINFORMATION);
        DetourTransactionBegin(); 
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)Real_DrawText, Mine_DrawText); // <- magic
        DetourAttach(&(PVOID&)Real_TextOut, Mine_TextOut);
        DetourTransactionCommit();
        break;

    case DLL_PROCESS_DETACH:
        MessageBox (0,  TEXT("From DLL\n"),  TEXT("Process Detach"), MB_ICONINFORMATION);
        DetourTransactionBegin(); 
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)Real_DrawText, Mine_DrawText);
        DetourTransactionCommit();
        break;
    }

    return TRUE;
}

My question is: Is there something that I missing? I mean is there other ways to get text from an application? Because as I did my research this should give me all the text from the program.

Thank you very much for your help!

Applications expose their contents programmatically via the accessibility interfaces (MSAA, UI Automation). Those interfaces will also provide much better context for the text you retrieve. Specific application may have custom automation models as well. — Raymond Chen, Aug 31 '12 at 16:30
Can you give me some more details about it? How can I implement to retreive them? — stomseven, Aug 31 '12 at 16:48
This is a very large topic. I would suggest that you read the copious documentation on MSDN on [Active Accessibility](http://msdn.microsoft.com/en-us/library/dd373592(VS.85).aspx) and [UI Automation](http://msdn.microsoft.com/en-us/library/windows/desktop/ee684009(v=vs.85).aspx). — Raymond Chen, Aug 31 '12 at 16:52

score 1 · Answer 1 · answered Aug 31 '12 at 16:24

1

What are your really trying to do? It seems like you want to scrape the contents of a list box running in another program. Have you tried simply sending LB_GETTEXT messages to the list box?

answered Aug 31 '12 at 16:24

Adrian McCarthy

45,555
16
123
175

DLL Injection: DrawText and TextOut doesn't return all text

1 Answers1