Win32- Getting ListView Control content from another application

Question

I am trying to access the ListView control (located within an Dialog) in another application, and get the data from within the control. Here is the Win32 code (with appropiate comments) that I am writing :

        HWND hListView32 = hRoot;   //HANDLE to the ListView control within the Dialog, having class name - "SysListView32"
        int cnt = (int) ::SendMessage(hListView32, LVM_GETITEMCOUNT, 0, 0L); //returns CORRECT item count of the ListView Control
        int nItem=0,nRes;

        for(int nItem=0;nItem<cnt;nItem++)
        {
            LVITEM LvItem;  // ListView Item struct
              char Text[255]={0};  
              char Temp[255]={0};
              char Temp1[255]={0};

                memset(&LvItem,0,sizeof(LvItem));
          LvItem.mask=LVIF_TEXT;
              LvItem.iSubItem=1;    //Trying to get the 2nd Colomn text

              LvItem.pszText=Text;  //Does not returns any Text, after the below SendMessage is executed???

              LvItem.cchTextMax=256;
              LvItem.iItem=nItem;
              nRes  = (int)::SendMessage(hListView32,LVM_GETITEMTEXT, nItem, (LPARAM)&LvItem);
              DWORD dd = ::GetLastError();  //returns 0
        }

Though the code is executing, I am not getting any data from within the control. However, I am able to retrieve the correct Item count from within the control, but no data.

Another approach maybe would be to use an MSAA hook to get the data. But that would be a very long and cumbersome process. Running out of ideas here. Pls help.

Thanks,

`LVM_GETITEMTEXT` only works within the same process. See e.g. David Heffernans comments to [this SO question](http://stackoverflow.com/questions/4857411/listview-getitem-macro-lv-getitemtext-returns-empty-string-while-getting-ano). — user786653, Oct 01 '12 at 19:48

Serge · Answer 1 · 2012-10-01T21:06:10.180

1

There a few possibilities.

DLL Injection Using windows hooks. Pros: simple and straight forward. Cons: many processes get this dll loaded.
DLL Injection Making process to load library by opening it for debugging, allocating a chunc of virtual memory using VallocEx in the context of this process, writing it's memory with WriteProcessMemory and creating a remote thread with start address of LoadLibrary function. Pros: a single process is affected. Cons: A bit more complex than hooks solution.
Read of process memory. Same as option 2 but instead of writing this memory and executing the code remotely, send the message LVM_GETITEMTEXT to the window in question providing a valid known memory location and then read that location with ReadProcessMemory.

edited Oct 01 '12 at 21:06

answered Oct 01 '12 at 20:03

Serge

6,088
17
27

DLL injection isn't the *only* approach. It is also possible to allocate memory in the target application and have it process the `LVM_GETITEMTEXT` message. – user786653 Oct 01 '12 at 20:26
@user786653 But as far as you managed to open the process to allocate & read memory - one step to load a dll. – Serge Oct 01 '12 at 20:30
My main objection is your first sentence, which is wrong. I don't claim to know the best approach. If you edit your answer I'll gladly retract my downvote. – user786653 Oct 01 '12 at 20:50
@user786653 I understood you. The downvote itself is not a problem. The missing reasons and overload of homework questions put me in doubt that I am spending my time properly. I will fix the answer with your permission. – Serge Oct 01 '12 at 20:56

score 1 · Answer 2 · answered Oct 02 '12 at 00:49

ListView messages that pass around buffers only work within the address space of the process that owns the ListView. You will have to use VirtualAllocEx() to allocate a memory block within that same process, then you can write to it with WriteProcessMemory() and have the ListView fill it as needed, then you can read it with ReadProcessMemory() and deallocate it with VirtualFreeEx().

Try this (error handling omitted for brevity):

HWND hListView32 = hRoot;

int cnt = (int) ::SendMessage(hListView32, LVM_GETITEMCOUNT, 0, 0);
if (cnt > 0)
{
    DWORD dwProcessId;
    GetWindowThreadProcessId(hListView32, &dwProcessId);

    HANDLE hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, dwProcessId);

    LVITEM *pLvItem = (LVITEM*) VirtualAllocEx(hProcess, NULL, sizeof(LVITEM), MEM_COMMIT, PAGE_READWRITE);
    LPTSTR pText = (LPTSTR) VirtualAllocEx(hProcess, NULL, sizeof(TCHAR)*256, MEM_COMMIT, PAGE_READWRITE);

    for(int nItem = 0; nItem < cnt; ++nItem) 
    { 
        TCHAR Text[256] = {0};

        LVITEM LvItem = {0}; 
        LvItem.mask = LVIF_TEXT; 
        LvItem.iSubItem = 1;
        LvItem.pszText = pText;
        LvItem.cchTextMax = 256; 
        LvItem.iItem = nItem; 

        WriteProcessMemory(hProcess, pLvItem, &LvItem, sizeof(LVITEM), NULL);

        int nRes = (int) ::SendMessage(hListView32, LVM_GETITEMTEXT, nItem, (LPARAM)pLvItem);
        if (nRes > 0)
            ReadProcessMemory(hProcess, pText, &Text[0], sizeof(TCHAR)*nRes, NULL);

        // use Text as needed...
    }

    VirtualFreeEx(hProcess, pText, 0, MEM_RELEASE);
    VirtualFreeEx(hProcess, pLvItem, 0, MEM_RELEASE);
    CloseHandle(hProcess);
}

score 0 · Answer 3 · edited Apr 08 '16 at 12:55

I copypasted code by Remy Lebeau, but it is working very strange in my particular case. The number of elements is retreived correctly via SendMessage(listview, LVM_GETITEMCOUNT, 0, 0) , but the cycle reads jast the same element every time! It is not the first or last element, not the selected, but seems to be random. Here is my code:

HWND win=FindWindowEx(NULL, NULL, _("TEventLogView"), NULL);
HWND listview=FindWindowEx(win, NULL, _("TListView"), NULL);
int cnt = (int) ::SendMessage(listview, LVM_GETITEMCOUNT, 0, 0);
if (cnt > 0)
{
    DWORD dwProcessId;
    GetWindowThreadProcessId(listview, &dwProcessId);
    int n = grdEvents->GetNumberRows();
    HANDLE hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION, FALSE, dwProcessId);
    LVITEM *pLvItem = (LVITEM*) VirtualAllocEx(hProcess, NULL, sizeof(LVITEM), MEM_COMMIT, PAGE_READWRITE);
    LPTSTR pText = (LPTSTR) VirtualAllocEx(hProcess, NULL, sizeof(TCHAR)*255, MEM_COMMIT, PAGE_READWRITE);
   for(int nItem = 0; nItem < cnt; ++nItem)
   {
      // need to read 1 - 3 subitems
      for (int j = 1; j < 4; j++)
      {
         TCHAR Text[255] = {0};
         LVITEM LvItem = {0};
         LvItem.mask = LVIF_STATE | LVIF_TEXT;
         LvItem.pszText = pText;
         LvItem.cchTextMax = sizeof(TCHAR)*255;
         LvItem.iItem = nItem;
         LvItem.iSubItem = j;
         int nRes1 = WriteProcessMemory(hProcess, pLvItem, &LvItem, sizeof(LVITEM), NULL);
         int nRes2 = (int) ::SendMessage(listview, LVM_GETITEMTEXT, (WPARAM)nItem, (LPARAM)pLvItem);
         if (nRes2 > 0)
         {
             ReadProcessMemory(hProcess, pText, &Text[0], sizeof(TCHAR)*nRes2, NULL);
             // insert into wxWidgets grid
             grdEvents->SetCellValue(nItem, j - 1, Text);
        }
      }
      VirtualFreeEx(hProcess, pText, 0, MEM_RELEASE);
      VirtualFreeEx(hProcess, pLvItem, 0, MEM_RELEASE);
      CloseHandle(hProcess);
   }
}

Win32- Getting ListView Control content from another application

3 Answers3