-1

Basically I created a simple Dll injection code with a basic Dll that shows a message box and my question is how can I now use the Dll file to make it write text into the Notepad while its running and it hasn't been saved/is temporary? Is there a way to find a path to the file? (i don't think so because its still writing into the ram and is untitled so doesn't have a save on any drives) Or is there a stream i can write into?

tameer kenaan
  • 15
  • 6
  • I don't think there is any temporary file in notepad for unsaved changes. You could try to get the windows handle of notepad and send your text input commands. – Timo Mar 16 '20 at 08:27
  • @Timo can you please elaborate on how can i use the handle of the notepad to write text into it in my code i get its Pid if that helps in anyway – tameer kenaan Mar 16 '20 at 08:45
  • Is your primary question how to inject? Or remote process automation in general? Or about how to preload Notepad with text? Because they are very different questions, and DLL injection is not likely to be the best way to automate Notepad. – tenfour Mar 18 '20 at 15:19

1 Answers1

0

Like Timo said in the comment, you can get the handle to the Notepad's Window, and then use it to write text into it, and it even wouldn't require from you to inject your DLL into the Notepad Process.

In Windows, every window is receiving messages from the Operating System (or from other programs, like what you're going to try out), those messages tell the window what action was made, for instance - Pressing down a key, or pressing a mouse button. That way, the program controlling the Window will know what kind of action it's supposed to do.

You can use the Spy++ Tool (spyxx.exe, comes builtin in every Visual Studio) to track what Windows does when you press a key down the keyboard into the Notepad's Window. You can read further about the topic of window messages here: https://learn.microsoft.com/en-us/windows/win32/learnwin32/window-messages

And working with Spy++ here: https://learn.microsoft.com/en-us/visualstudio/debugger/introducing-spy-increment?view=vs-2019

Opening Spy++, we can see all the Windows in the our session, and we look for the Notepad's: how it looks

Small POC I made for searching the appropriate Window, according to what found by Spy++ (forgive me for the globals, and make sure you are aware of what I did here): 

HWND notepad_window;
HWND notepad_edit;

BOOL CALLBACK GetEditWindow(HWND hWnd, LPARAM lParam)
{
    wchar_t window_text[MAX_PATH] = { 0 };
    if (0 != GetClassNameW(hWnd, window_text, MAX_PATH))
    {
        std::wstring text(window_text);
        if (std::wstring::npos != text.find(L"Edit"))
        {
            std::wcout << "Found it" << text << std::endl;
            notepad_edit = hWnd;
            return false;
        }
    }
    return true;
}

BOOL CALLBACK GetNotepadWindow(HWND hWnd, LPARAM lParam)
{
    wchar_t window_text[MAX_PATH] = { 0 };
    // Fun fact - The GetWindowTextW also posts a window message to the window, the WM_GETTEXT message
    if (0 != GetWindowTextW(hWnd, window_text, MAX_PATH))
    {
        std::wstring text(window_text);
        if (std::wstring::npos != text.find(L"Notepad"))
        {
            std::wcout << "Found it" << text << std::endl;
            notepad_window = hWnd;
            return false;
        }
    }
    return true;
}

int wmain()
{
    EnumWindows(GetNotepadWindow, 0);
    EnumChildWindows(notepad_window, GetEditWindow, 0);
}

After you have the HWND, you can start dealing with the message posting. You can use Spy++ again to 'tap' on the Notepad's Edit Window, and see every Window Message sent when pressing down a key, you will see the WM_KEYDOWN, followed by a WM_KEYUP most likely.

Then, you can use the PostMessage WinAPI function to post your own WM_KEYDOWN/KEYUP messages to the Notepad Window, hence controlling the input it gets.

Nimrod M
  • 1
  • 1