Problem sending LVN_COLUMNCLICK notification to a window

I'm trying to send a notification to a ListView, but I can't find what am I doing wrong.
This is the code:

Quote:

---

#include "stdafx.h"
#include <windows.h>
#include <commctrl.h>
#include <stdio.h>

int second_try(){

DWORD pid = 0;

HWND hWnd=HWND(0x00020756);

GetWindowThreadProcessId( hWnd, &pid );

HANDLE hProcHnd = OpenProcess( PROCESS_VM_OPERATION |PROCESS_VM_READ|PROCESS_VM_WRITE, FALSE, pid );

LPVOID pNMLV = VirtualAllocEx( hProcHnd, NULL, sizeof( NMLISTVIEW ),
MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);


NMLISTVIEW nmlvitem;

nmlvitem.hdr.code = LVN_COLUMNCLICK;
nmlvitem.hdr.hwndFrom = HWND(0x00020770);
nmlvitem.hdr.idFrom = 0;
nmlvitem.iItem=-1;
nmlvitem.iSubItem=2;
nmlvitem.lParam=0;
nmlvitem.ptAction.x=0;
nmlvitem.ptAction.y=0;
nmlvitem.uChanged=0;
nmlvitem.uNewState=0;
nmlvitem.uOldState=0;

DWORD copied = 0;

WriteProcessMemory( hProcHnd, pNMLV, &nmlvitem, sizeof( NMLISTVIEW ), &copied );

SendMessage( hWnd, WM_NOTIFY, (WPARAM)0, (LPARAM)pNMLV ) ;

VirtualFreeEx( hProcHnd, pNMLV, 0, MEM_RELEASE );
return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{
second_try();
return 0;
}

---

or you can see it here, too:
http://pastebin.com/MJyb4xib

What does not work?

According to Winpector, the application doesn't receive the WM_NOTIFY message.

Quote:

---

Originally Posted by AlexA2

According to Winpector, the application doesn't receive the WM_NOTIFY message.

---

*application * cannot receive any message. Only window can. Which window did you inspect? Is it the parent of the list control window?

hWnd belongs to the window that has the SysListView32 (Unicode) class.
And, yes, I used Winspector to inspect messages for this SysListView32 window.

Quote:

---

Originally Posted by AlexA2

And, yes, I used Winspector to inspect messages for this SysListView32 window.

---

But you (I guess!) want to send this WM_NOTIFY to the parent of SysListView32 window. Read the documentation of LVN_COLUMNCLICK notification!

Isn't SysHeader32 the child, and SysListView32 the parent that should receive the notification?

Quote:

---

Originally Posted by AlexA2

Isn't SysHeader32 the child, and SysListView32 the parent that should receive the notification?

---

If the notification is HDN_ITEMCLICK or some other HDN_... then yes, it's list view control window that receives all these notifications (because the list view control is the parent of its header control) but all LVN_... notifications are sent to (and supposed to received by) the parent of the list view control.

I understand now.

I've changed the hWnd to the parent's one and Winspector did not intercept any message. :(

Well, then:
1. Check if window handle (of the "parent") you are sending message to is the same as the actual one.
2. Try Spy++
3. BTW, did you debug your code to be sure it runs OK?

How should I do a proper debug? Please tell me what should I check, and I'll post back the values.

Set a break point at the beginning of you second_try function, then press F5 to start debugging... then use F10 to go step by step through your code to see what happens...

http://img254.imageshack.us/i/74380008.png/

http://img254.imageshack.us/img254/1614/74380008.png

Uploaded with ImageShack.us

It doesn't look very good, right?

Right.
The hProcHnd was not initialized...

Why does it say "unused"?
What should I do now?

1. When did you do these snapshot?
2. Please, next time attach the images to your posts!
...
3. Good night! ;)

1. What do you mean? It gets the correct PID, though.[I've checked it]
2. I will do that next time.
3. Good Morning! :)

Quote:

---

Originally Posted by VictorN

1. When did you do these snapshot?

---

Quote:

---

Originally Posted by AlexA2

1. What do you mean?

---

I mean: "after execution of which line of your code"?

2 more screenshots, before and after OpenProcess is executed.

I've managed with this code, but sometimes it crashes when I close the buffer [ VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE ); ]. Any ideas why?

Code:

---

void thrd_try(){

        NMHEADER nmh;
        ZeroMemory(&nmh, sizeof(NMHEADER));
        nmh.hdr.hwndFrom = HWND(0x000706AC);
        nmh.hdr.code = HDN_ITEMCLICKW;
        nmh.iItem = 13;
     
HWND hWnd=HWND(0x00070704);

        DWORD pid = 0;
GetWindowThreadProcessId( hWnd, &pid );
        HANDLE hProcHnd = OpenProcess( PROCESS_VM_OPERATION |
                        PROCESS_VM_READ |
      PROCESS_VM_WRITE, FALSE, pid );
        LPVOID pLVI = VirtualAllocEx( hProcHnd, NULL, sizeof( LVITEM ),
                      MEM_RESERVE |  MEM_COMMIT, PAGE_READWRITE);
        DWORD copied = 0;

WriteProcessMemory( hProcHnd, pLVI, &nmh, sizeof( NMHEADER ), &copied );   

        PostMessage( hWnd,WM_NOTIFY, 0, (LPARAM)pLVI);

      VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE );

}

---

Quote:

---

Originally Posted by AlexA2

I've managed with this code, but sometimes it crashes when I close the buffer [ VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE ); ]. Any ideas why?

---

1. For code snippets you should use Code tags, not Quote.
2. Define "crashes".
3. I never used WriteProcessMemory nor VirtualFreeEx, so I'm not sure I could help you with it...

1. Fixed.

2. My bad, I wanted to say that the application that receives the notification crashes. A window related to VS2008 appears, and asks if I want to debug the application.

Another thing that I want to mention is that SendMessage doesn't work, I have to use PostMessage instead.

Quote:

---

Originally Posted by AlexA2

Another thing that I want to mention is that SendMessage doesn't work, I have to use PostMessage instead.

---

I would guess that it could be caused by VirtualFreeEx being processed before the message posted to the target application will be handled.

I'd want to be able to use SendMessage instead, so that I'd avoid this possible cause.

The application doesn't sort the whole list correctly, so I'd have to click like 50 times on that header in order to have the whole list sorted. This is why I'm trying to write this program.

Funny thing, in Perl, it works with LVN_COLUMNCLICK but not with HDN_ITEMCLICKW.

Again, I have this problem that I have in Perl with LVN_COLUMNCLICK, too.

The C++ code that I've posted, works fine on WinXP x86 and WinXP x64, but ti doesn't work on Win7 x64.
How do I discover the cause of this?

Again, this is the code:

Code:

---

void thrd_try(){

        NMHEADER nmh;
        ZeroMemory(&nmh, sizeof(NMHEADER));
        nmh.hdr.hwndFrom = HWND(0x000706AC);
        nmh.hdr.code = HDN_ITEMCLICKW;
        nmh.iItem = 13;
     
HWND hWnd=HWND(0x00070704);

        DWORD pid = 0;

        GetWindowThreadProcessId( hWnd, &pid );

        HANDLE hProcHnd = OpenProcess( PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, pid );

        LPVOID pLVI = VirtualAllocEx( hProcHnd, NULL, sizeof( LVITEM ),  MEM_RESERVE |  MEM_COMMIT, PAGE_READWRITE);

        DWORD copied = 0;

        WriteProcessMemory( hProcHnd, pLVI, &nmh, sizeof( NMHEADER ), &copied );   

        PostMessage( hWnd,WM_NOTIFY, 0, (LPARAM)pLVI);
 
        VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE );

}

---

Why don't your check the results of all your API calls? :confused:

Winspector did not intercept the WM_NOTIFY message under Win7 x64.

I think that the application might be personalised for Windows Vista/7 and that it might use different notifications.
Is it plausible?

Can be a matter of User Interface Privilege Isolation (UIPI).
But that cannot be clearly seen in my crystal ball. As Victor already said, first check yourself if (and why) your API calls fail.
See also: How to get the reason for a failure of a SDK function?

This is what I have done, and the function returns "Access is denied".

You can also find the code here: http://pastebin.com/M6Yv9yYA

Code:

---

#include <stdio.h>
#include <windows.h>
#include <commctrl.h>
#include <tchar.h>
struct MyStruct
{
HANDLE hProcHnd;
LPVOID pLVI;
};

void ReportLastError()
{
  LPCTSTR pszCaption = _TEXT("Windows SDK Error Report");
  DWORD dwError      = GetLastError();

  if(NOERROR == dwError)
  {
    MessageBox(NULL, _T("No error"), pszCaption, MB_OK);
  }
  else
  {
    const DWORD dwFormatControl = FORMAT_MESSAGE_ALLOCATE_BUFFER |
                                  FORMAT_MESSAGE_IGNORE_INSERTS |
                                  FORMAT_MESSAGE_FROM_SYSTEM;

    LPVOID pTextBuffer = NULL;
    DWORD dwCount = FormatMessage(dwFormatControl,
                                  NULL,
                                  dwError,
                                  0,
                                  (LPTSTR) &pTextBuffer,
                                  0,
                                  NULL);
    if(0 != dwCount)
    {
      MessageBox(NULL, (LPCSTR)pTextBuffer, pszCaption, MB_OK|MB_ICONERROR);
      LocalFree(pTextBuffer);
    }
    else
    {
      MessageBox(NULL, _T("Unknown error"), pszCaption, MB_OK|MB_ICONERROR);
    }
  }
}

void sort_listview(HWND hWnd_listview,HWND hWnd_header, MyStruct x){

    NMHEADER nmh;
        ZeroMemory(&nmh, sizeof(NMHEADER));
    nmh.hdr.hwndFrom = hWnd_header;
          nmh.hdr.code = HDN_ITEMCLICKW;
        nmh.iItem = 13;



        DWORD copied = 0;

        WriteProcessMemory( x.hProcHnd, x.pLVI, &nmh, sizeof( NMHEADER ), &copied );

BOOL bRet =            PostMessage( hWnd_listview,WM_NOTIFY, 0, (LPARAM)x.pLVI);
if(!bRet)
{
  ReportLastError();

}
}

void close_buffer(MyStruct x)
{
VirtualFreeEx( x.hProcHnd, x.pLVI, 0, MEM_RELEASE );
}

MyStruct open_buffer(HWND hWnd)
{
/////////////
MyStruct x;
/////////////
DWORD pid = 0;
GetWindowThreadProcessId( hWnd, &pid );
x.hProcHnd = OpenProcess( PROCESS_VM_OPERATION |        PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, pid );
x.pLVI = VirtualAllocEx( x.hProcHnd, NULL, sizeof( LVITEM ), MEM_RESERVE |  MEM_COMMIT, PAGE_READWRITE);

return x;
}



int main()
{

HWND hWnd_listview=HWND(0x00021F0E);
HWND hWnd_header=HWND(0x00021F46);

MyStruct x=open_buffer(hWnd_listview);
//for(int i=0;i<100;i++)
        //{
 sort_listview(hWnd_listview,hWnd_header, x);

        Sleep(100);
        //}
//wait a period here
Sleep(10000);
close_buffer(x);
////////////////////

printf( "Done\n"  );

return 0;
}

---

How do I solve this problem?

On WinXP x86 and x64, the code works perfect.
On Win7 x64 and x86, it doesn't work at all. I've tested it with fresh installs, UAC off, no firewall, no AV, no aditional software.

I've doublechecked and it Win7 the application uses WM_NOTIFY and HDN_ITEMCLICKW, same as on WinXP. So, my assumptions were wrong[at some point I thought that the app used different messages for Win7].
Other messages work fine on Win7, tough. For example, TCM_GETITEM, TCM_GETCURSEL, etc.

I've inspected with Winspector, and the WM_NOTIFY message that I'm trying to send isn't received by the ListView Window.

Windows SDK Error report returns: Access is denied. on both Win7 x64 and x86.

Quote:

---

Originally Posted by AlexA2

How do I solve this problem?
...
Windows SDK Error report returns: Access is denied. on both Win7 x64 and x86.

---

Well, the only way to solve the "Access is denied" error is to assign the user the appropriate rights / privileges. Note that this mechanism in XP and Vista idiffers so much ... so a lot of old "hook" things does not wokk in Vista anymore...

I've ran the exe file of my compiled program as Administrator. Doesn't it give full privileges?

Quote:

---

Originally Posted by AlexA2

I've ran the exe file of my compiled program as Administrator. Doesn't it give full privileges?

---

Have you already read what Ovidiu recommended you?

Quote:

---

Originally Posted by ovidiucucu

Can be a matter of User Interface Privilege Isolation (UIPI).
But that cannot be clearly seen in my crystal ball.

---

I did but, I don't have VS2008SP1, and I can't modify the code on the application that is supposed to receive the WM_NOTIFY message.
From what I understand, those exercises modify the code on the app in order to receive messages with any privilege.