Control Content Saver

Developer Documentation

Usualy, we can retreive information by sending messages (using the SendMessage API) to desired control.
The only trouble here is that we want to get information from other processes, and some messages can't be send (sometimes, they just make process to crash) because the other process don't have access to memory pointers given throught parameters.
So the "easy to do jobs" begins to become quite harder : to send these messages, a solution is to allocate memory in the remote process and pass these memory pointers as arguments of the SendMessage API. Next we just have to read the process memory of our allocated pointers and we get results.

Password fields are quite different, because the 2 important messages to show or get text have to be sent inside the remote process.
To solve this, we have to do code injection in the remote process.

More Information depending controls:
   - Edit, Static or controls we currently not support
   - Password
   - Headers
   - Listview
   - Treeview
   - ComboBox
   - ListBox

Edit, Static or controls we currently not support

We just try to get displayed text by sending the following messages with our process pointers
WM_GETTEXTLENGTH : to retreive text length and allocate enough memory
WM_GETTEXT : to retreive text

Password fields

To reveal password we first retreive the char hiding data by sending EM_GETPASSWORDCHAR, to restore it after user have seen it.
Warning : we use the SendMessageW because password char for comtrl32 v6 is defined as Unicode.

Next we inject code for sending message EM_SETPASSWORDCHAR inside the remote process. To do this we use the CCodeInject class (given with source code).
What this class do is writing remote process memory to inject our code and a structure containing all requiered parameters (and results).
This class next calls CreateRemoteThread func giving it our remote allocated code pointer as start address, and our remote allocated structure pointer as thread func parameter.
So our defined function will be executed in remote process receiving the struct as parameter.
Warning all functions (api or dll) called inside your injected code must be called with their address in the remote process.
That means you have to use the GetProcAddress API inside the remote process.

To hide password again we just send EM_SETPASSWORDCHAR without injecting nothing : Microsoft allows it as the password char is 0.

Retreiving password text is quite similar to sending EM_SETPASSWORDCHAR.
First we retreive password length be directly sending WM_GETTEXTLENGTH message.
Next we allocate enough memory in remote process for storing password, and by the same way of code injection of EM_SETPASSWORDCHAR we send the WM_GETTEXT message inside remote process.
As we have split Password content retreival and password showing, we have to do this. Another solution is to directly send the WM_GETTEXT message when the password is revealed.

Extracts of source code:

 
typedef LRESULT (WINAPI *pfSendMessage)(HWND,UINT,WPARAM,LPARAM);
 
// First we define the structure that will be transmitted by the CreateRemoteThread func as parameter
typedef struct tagDataSendMessage
{
    // params we want to transmit (SendMessage parameters)
    HWND    Hwnd;
    UINT    Msg;
    WPARAM  Wparam;
    LPARAM  Lparam;
    LRESULT Lresult;
    pfSendMessage pSendMessage;// fonction pointer in remote process memory
}DATASENDMESSAGE,*PDATASENDMESSAGE;
 
 
// next write the code that will be injected
// warning all functions must use functions address of remote process
// that means you have to use GetProcAddress
 
//-----------------------------------------------------------------------------
// Name: SendMessageThreadProc
// Object: proc that will be injected in remote process (just will call SendMessageW)
// Parameters :
//     in  : CRemoteCtrlContentSaver::PDATASENDMESSAGE lpParameter, containing
//              SendMessageW address and SendMessageW parameters
//     out : 
//     return : 
//-----------------------------------------------------------------------------
static DWORD WINAPI SendMessageThreadProc (CRemoteCtrlContentSaver::PDATASENDMESSAGE lpParameter)
{
    lpParameter->Lresult=lpParameter->pSendMessage(lpParameter->Hwnd,lpParameter->Msg,lpParameter->Wparam,lpParameter->Lparam);
 	return 0;
}
// This function marks the memory address after ThreadProc.
static DWORD WINAPI  SendMessageAfterThreadProc (void) {return 0;}
 
 
BOOL GetPasswordContent()
{
    // allocate a remote buffer
    psz=(WCHAR*)VirtualAllocEx(hProcess, NULL, (dwSize+1)*sizeof(WCHAR), MEM_COMMIT, PAGE_READWRITE);
 
    pCodeInject=new CCodeInject(hProcess);
    // comput code size
    dwThreadProcCodeSize = ((LPBYTE) SendMessageAfterThreadProc - (LPBYTE) SendMessageThreadProc);
 
    // fill injdata struct infos
    DATASENDMESSAGE data;
    data.Hwnd=this->pSelectWindow->WindowHandle;
    data.pSendMessage=this->pSendMessage;
    data.Msg=WM_GETTEXT;
    data.Wparam=dwSize+1;
    data.Lparam=(LPARAM)psz;
    
    try
    {
        if (!pCodeInject->SetParameter(&data,sizeof(data)))
        {
            this->ShowError("Error injecting parameter in remote process");
            bRet=FALSE;
            throw;
        }
        if (!pCodeInject->SetCode((FARPROC)SendMessageThreadProc,dwThreadProcCodeSize))
        {
            this->ShowError("Error injecting code in remote process");
            bRet=FALSE;
            throw;
        }
        if (!pCodeInject->Execute())
        {
            this->ShowError("Error creating remote thread");
            bRet=FALSE;
            throw;
        }
    }
    catch(...)
    {
    }
 
    delete pCodeInject;
 
    if (bRet)
    {
        pszLocalText=new WCHAR[dwSize+1];
        bRet=ReadProcessMemory(hProcess,psz,pszLocalText,(dwSize+1)*sizeof(WCHAR),&ExchangedSize);
    }
 
    // free allocated memory
    VirtualFreeEx(hProcess,psz,0,MEM_RELEASE);
 
    CloseHandle(hProcess);
 
    if (pszLocalText)
        delete[] pszLocalText;
}

Headers

First we directly send the HDM_GETITEMCOUNT message to get number of items.
Next we allocate memory in remote process for an HDITEM struct and for the associated header text (HDITEM.pszText).
After, we have to make a loop calling
   - SendMessage(hHeader,(UINT)HDM_GETITEM,(WPARAM)Index,(LPARAM)pHDITEM)
    where Index is the column number, and pHDITEM our remote allocated pointer on HDITEM struct
for filling the remote allocated memory.
   - ReadProcessMemory with pHDITEM->pszText as base pointer
for copying result into local memory.

Extracts of source code:

    pHDITEM=(HDITEM*)VirtualAllocEx(hProcess, NULL, sizeof(HDITEM), MEM_COMMIT, PAGE_READWRITE);
    pszText=(char*)VirtualAllocEx(hProcess, NULL, MaxTextSize, MEM_COMMIT, PAGE_READWRITE);
 
    ///////////////////////////////////////////////////////////////////
    // Fill struct info in remote memory
    ///////////////////////////////////////////////////////////////////
 
    // memset(pHDITEM,0,sizeof(HDITEM))
    pb=new BYTE[sizeof(HDITEM)];
    memset(pb,0,sizeof(HDITEM));
    ExchangedSize=0;
    WriteProcessMemory(hProcess, pHDITEM,pb, sizeof(HDITEM), &ExchangedSize);
    delete[] pb;
 
    // pHDITEM->cchTextMax=Size;
    WriteProcessMemory(hProcess, &(pHDITEM->cchTextMax),(LPCVOID)&MaxTextSize, sizeof(int), &ExchangedSize);
 
    // pHDITEM->pszText=pszText;
    WriteProcessMemory(hProcess, &(pHDITEM->pszText),(LPCVOID)&pszText, sizeof(char*), &ExchangedSize);
 
    // pHDITEM->Mask HDI_TEXT
    UINT uiMask=HDI_TEXT;
    WriteProcessMemory(hProcess, &(pHDITEM->mask),(LPCVOID)&uiMask, sizeof(UINT), &ExchangedSize);
 
 
    // for each item index of header (Index)
        // send HDM_GETITEM message with remote pointer pHDITEM
        SendMessage(hHeader,(UINT)HDM_GETITEM,(WPARAM)Index,(LPARAM)pHDITEM)
 
        // copy data from the remote allocated text pointer to a local pointer (pcLocalText)
        ReadProcessMemory(hProcess,pszText,pcLocalText,MaxTextSize,&ExchangedSize)
 
        // now we can use pcLocalText to save data

Listview

First we try to get headers by sending LVM_GETHEADER message.
If headers exist, we retreive them by the previous explained way (see Headers). Next we get the number of items with LVM_GETITEMCOUNT message, and do a loop
If user only wants selected items, we send the LVM_GETITEMSTATE message to know if we have to get item informations.
Next we have to send the LVM_GETITEMTEXT message. As for headers, we allocate memory in remote process for an LVITEM struct and for its associated text (LVITEM.pszText) to give the SendMessage function remote pointers as parameters.

Extracts of source code:

    ///////////////////////////////////////////////////////////////////
    // allocate pointer requiered by LVM_GETITEMTEXT in other process memory
    ///////////////////////////////////////////////////////////////////
    pLVITEM=(LVITEM*)VirtualAllocEx(hProcess, NULL, sizeof(LVITEM), MEM_COMMIT, PAGE_READWRITE);
    pszText=(char*)VirtualAllocEx(hProcess, NULL, MaxTextSize, MEM_COMMIT, PAGE_READWRITE);
 
    ///////////////////////////////////////////////////////////////////
    // Fill struct info in remote memory
    ///////////////////////////////////////////////////////////////////
    // memset(pLVITEM,0,sizeof(LVITEM))
    pb=new BYTE[sizeof(LVITEM)];
    memset(pb,0,sizeof(LVITEM));
    ExchangedSize=0;
    WriteProcessMemory(hProcess, pLVITEM,pb, sizeof(LVITEM), &ExchangedSize);
    // pLVITEM->cchTextMax=Size;
    WriteProcessMemory(hProcess, &(pLVITEM->cchTextMax),(LPCVOID)&MaxTextSize, sizeof(int), &ExchangedSize);
    // pLVITEM->pszText=pszText;
    WriteProcessMemory(hProcess, &(pLVITEM->pszText),(LPCVOID)&pszText, sizeof(char*), &ExchangedSize);
 
    // for each Item (ItemIndex)
         // for each subitem (SubItemIndex)
 
            ///////////////////////////////////////////////////////////////////
            // Fill struct info (subitem index) in remote memory
            ///////////////////////////////////////////////////////////////////
            // pLVITEM->iSubItem=SubItemIndex;
            WriteProcessMemory(hProcess, &(pLVITEM->iSubItem),(LPCVOID)&SubItemIndex, sizeof(int), &ExchangedSize);
 
            ///////////////////////////////////////////////////////////////////
            // Send LVM_GETITEMTEXT message lResult will contain the size of char copied
            ///////////////////////////////////////////////////////////////////
            lResult = SendMessage((HWND) this->pSelectWindow->WindowHandle,      // handle to destination control
                                  (UINT) LVM_GETITEMTEXT,   // message ID
                                  (WPARAM) ItemIndex,       // = (WPARAM) (int) iItem;
                                  (LPARAM) pLVITEM          // = (LPARAM) (LPLVITEM) pitem;
                     );
 
            // copy data from the remote allocated text pointer to a local pointer (pcLocalText)
            ReadProcessMemory(hProcess,pszText,pcLocalText,lResult,&ExchangedSize)
 
            // now we can use pcLocalText to save data

Treeview

For Treeview, we use the same way as Listview. We first allocate memory in remote process for a TV_ITEM struct, and for its associated text (TV_ITEM.pszText). Next we use classical Treeview macro (TreeView_GetRoot, TreeView_GetNextSibling, TreeView_GetChild) to parse the TreeView.

ComboBox

For ComboBox, we first have to check if parent window is an ComboBoxEx control (as only ComboBoxEx control can be selected graphicaly). That's important because if we send a CB_GETLBTEXT to the ComboBox child of a ComboBoxEx control, only the first letter of the text will be retreived.
The second trouble with ComboBox is that some application fill ComboBox content only on user click or when ComboBox list is going to be shown.
So if CB_GETCOUNT message returns is 0 or 1, to force application filling the combo, we simulate a mouse click and ask the list of Combobox to be shown by the following messages :

// send messages to the combobox to assume items are filled because in some app,
// items are inserted only at the first left mouse boutton down
SendMessage(this->pSelectWindow->WindowHandle,WM_LBUTTONDOWN,MK_LBUTTON,0);
SendMessage(this->pSelectWindow->WindowHandle,WM_LBUTTONUP,0,0);
 
// send messages to the combobox to assume items are filled because in some app,
// items are inserted only at the first Drop down list showing
SendMessage(this->pSelectWindow->WindowHandle,CB_SHOWDROPDOWN,TRUE,0);
SendMessage(this->pSelectWindow->WindowHandle,CB_SHOWDROPDOWN,FALSE,0);

Next we just have to retreive text by sending messages CB_GETLBTEXTLEN and CB_GETLBTEXT

ListBox

Listboxes don't give us any troubles, we just have to send the following messages:
LB_GETSEL if user only wants to retreive selected items
LB_GETTEXTLEN and LB_GETTEXT to retreive text