Hook SendMessage for background processes

[eclessiastes]

Hello
I successfully tested SetWindowsHookEx WH_CALLWNDPROC to hook any WM_SETTEXT in the system, it works perfect but WM_SETTEXT doesn't capture messages that are sent through processes in background, for example a program tries to write in a file and i want to capture that text. What kind of WM_WHAT should i use ? I tried WM_GETTEXT, SETTEXT they capture the text but not the text that goes through processes. Any though\idea ? Thank you very much!

[OReubens]

WM_SETTEXT (and many other windows messages) do NOT send data such as strings, structures, ... THey only send pointers to data.

Pointers from one process have no meaning in another process. So you can't typically send messages to other programs that send "data" and expect this to work.

For a number of cases, Windows itself will do process-to-process marshalling of the data.
for all other cases, you will have to do this marshalling of the data yourself. This typically involves either injecting a "receiver" handler in the target process, or the "sender" allocating memory in the receiver process (VirtualAllocEx), filling that memory in (WriteProcessMemory), then sending the message with the correct receiver pointer value.

[eclessiastes]

Thank you OReubens for answer! I will try that and see if it works, i am also thinking about WM_COPYDATA

[Arjay]

You can also use memory mapped files.

[eclessiastes]

You can also use memory mapped files.

Thanks for idea Arjay! Could you please elaborate about memory mapped files ? For example i have a string = goodday, then any song or file name, anything that contain this string if its used then i should intercept it, do you think with memory mapped files its possible ? I was thinking about WM_COPYDATA but not sure it works

[OReubens]

memory mapped files won't do you any good unless you create both programs or you inject code in the process that isn't yours.

even in that case you still need to rebase any pointers because the memory may not be mapped at the exact same location in both processes.

[Arjay]

memory mapped files won't do you any good unless you create both programs or you inject code in the process that isn't yours.

Yes, you need to be able to inject a dll into the target process that creates the memory mapped file and then access the mapped file from the second process.

even in that case you still need to rebase any pointers because the memory may not be mapped at the exact same location in both processes.

Yes, but you would use a memory mapped file to pass data, not pointers (but the trick would be to extract the data in the target process from the pointers).

5 years I wrote a GC article about memory mapped file wrapper classes - C++ Programming: Memory Mapped Files using RAII

Not sure if the class will help you but it sure makes working with memory mapped files easier.

[VladimirF]

...for example a program tries to write in a file and i want to capture that text

Is that what you are trying to do? This has nothing to do with hooking window procedure, and even less - with WM_SETTEXT message.