Problem sending LVN_COLUMNCLICK notification to a window

[VictorN]

1. When did you do these snapshot?
2. Please, next time attach the images to your posts!
...
3. Good night!

[AlexA2]

1. What do you mean? It gets the correct PID, though.[I've checked it]
2. I will do that next time.
3. Good Morning!

[VictorN]

1. When did you do these snapshot?

1. What do you mean?

I mean: "after execution of which line of your code"?

[AlexA2]

2 more screenshots, before and after OpenProcess is executed.

[AlexA2]

I've managed with this code, but sometimes it crashes when I close the buffer [ VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE ); ]. Any ideas why?

void thrd_try(){

	NMHEADER nmh; 
	ZeroMemory(&nmh, sizeof(NMHEADER));
	nmh.hdr.hwndFrom = HWND(0x000706AC);
	nmh.hdr.code = HDN_ITEMCLICKW; 
	nmh.iItem = 13;
      
HWND hWnd=HWND(0x00070704);

        DWORD pid = 0;
GetWindowThreadProcessId( hWnd, &pid );
        HANDLE hProcHnd = OpenProcess( PROCESS_VM_OPERATION |
			PROCESS_VM_READ |
      PROCESS_VM_WRITE, FALSE, pid );
        LPVOID pLVI = VirtualAllocEx( hProcHnd, NULL, sizeof( LVITEM ), 
                       MEM_RESERVE |   MEM_COMMIT, PAGE_READWRITE);
        DWORD copied = 0;

WriteProcessMemory( hProcHnd, pLVI, &nmh, sizeof( NMHEADER ), &copied );    

	PostMessage( hWnd,WM_NOTIFY, 0, (LPARAM)pLVI);

       VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE );

}

[VictorN]

I've managed with this code, but sometimes it crashes when I close the buffer [ VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE ); ]. Any ideas why?

1. For code snippets you should use Code tags, not Quote.
2. Define "crashes".
3. I never used WriteProcessMemory nor VirtualFreeEx, so I'm not sure I could help you with it...

[AlexA2]

1. Fixed.

2. My bad, I wanted to say that the application that receives the notification crashes. A window related to VS2008 appears, and asks if I want to debug the application.

Another thing that I want to mention is that SendMessage doesn't work, I have to use PostMessage instead.

[VictorN]

Another thing that I want to mention is that SendMessage doesn't work, I have to use PostMessage instead.

I would guess that it could be caused by VirtualFreeEx being processed before the message posted to the target application will be handled.

[AlexA2]

I'd want to be able to use SendMessage instead, so that I'd avoid this possible cause.

The application doesn't sort the whole list correctly, so I'd have to click like 50 times on that header in order to have the whole list sorted. This is why I'm trying to write this program.

Funny thing, in Perl, it works with LVN_COLUMNCLICK but not with HDN_ITEMCLICKW.

[AlexA2]

Again, I have this problem that I have in Perl with LVN_COLUMNCLICK, too.

The C++ code that I've posted, works fine on WinXP x86 and WinXP x64, but ti doesn't work on Win7 x64.
How do I discover the cause of this?

Again, this is the code:

void thrd_try(){

	NMHEADER nmh; 
	ZeroMemory(&nmh, sizeof(NMHEADER));
	nmh.hdr.hwndFrom = HWND(0x000706AC);
	nmh.hdr.code = HDN_ITEMCLICKW; 
	nmh.iItem = 13;
      
HWND hWnd=HWND(0x00070704);

        DWORD pid = 0;

        GetWindowThreadProcessId( hWnd, &pid );

        HANDLE hProcHnd = OpenProcess( PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, pid );

        LPVOID pLVI = VirtualAllocEx( hProcHnd, NULL, sizeof( LVITEM ),  MEM_RESERVE |   MEM_COMMIT, PAGE_READWRITE);

        DWORD copied = 0;

        WriteProcessMemory( hProcHnd, pLVI, &nmh, sizeof( NMHEADER ), &copied );    

	PostMessage( hWnd,WM_NOTIFY, 0, (LPARAM)pLVI);
 
        VirtualFreeEx( hProcHnd, pLVI, 0, MEM_RELEASE );

}

[VictorN]

Why don't your check the results of all your API calls?

[AlexA2]

Winspector did not intercept the WM_NOTIFY message under Win7 x64.

I think that the application might be personalised for Windows Vista/7 and that it might use different notifications.
Is it plausible?

[ovidiucucu]

Can be a matter of User Interface Privilege Isolation (UIPI).
But that cannot be clearly seen in my crystal ball. As Victor already said, first check yourself if (and why) your API calls fail.
See also: How to get the reason for a failure of a SDK function?

[AlexA2]

This is what I have done, and the function returns "Access is denied".

You can also find the code here: http://pastebin.com/M6Yv9yYA

#include <stdio.h>
#include <windows.h>
#include <commctrl.h>
#include <tchar.h>
struct MyStruct
{
HANDLE hProcHnd;
LPVOID pLVI;
};

void ReportLastError()
{
  LPCTSTR pszCaption = _TEXT("Windows SDK Error Report");
  DWORD dwError      = GetLastError();

  if(NOERROR == dwError)
  {
    MessageBox(NULL, _T("No error"), pszCaption, MB_OK);
  }
  else
  {
    const DWORD dwFormatControl = FORMAT_MESSAGE_ALLOCATE_BUFFER |
                                  FORMAT_MESSAGE_IGNORE_INSERTS |
                                  FORMAT_MESSAGE_FROM_SYSTEM;

    LPVOID pTextBuffer = NULL;
    DWORD dwCount = FormatMessage(dwFormatControl,
                                  NULL,
                                  dwError,
                                  0,
                                  (LPTSTR) &pTextBuffer,
                                  0,
                                  NULL);
    if(0 != dwCount)
    {
      MessageBox(NULL, (LPCSTR)pTextBuffer, pszCaption, MB_OK|MB_ICONERROR);
      LocalFree(pTextBuffer);
    }
    else
    {
      MessageBox(NULL, _T("Unknown error"), pszCaption, MB_OK|MB_ICONERROR);
    }
  }
}

void sort_listview(HWND hWnd_listview,HWND hWnd_header, MyStruct x){

     NMHEADER nmh;
	 ZeroMemory(&nmh, sizeof(NMHEADER));
     nmh.hdr.hwndFrom = hWnd_header;
 	 nmh.hdr.code = HDN_ITEMCLICKW;
	 nmh.iItem = 13;



        DWORD copied = 0;

        WriteProcessMemory( x.hProcHnd, x.pLVI, &nmh, sizeof( NMHEADER ), &copied );

BOOL bRet =	    PostMessage( hWnd_listview,WM_NOTIFY, 0, (LPARAM)x.pLVI);
if(!bRet)
{
  ReportLastError();

}
}

void close_buffer(MyStruct x)
{
VirtualFreeEx( x.hProcHnd, x.pLVI, 0, MEM_RELEASE );
}

MyStruct open_buffer(HWND hWnd)
{
/////////////
MyStruct x;
/////////////
DWORD pid = 0;
GetWindowThreadProcessId( hWnd, &pid );
x.hProcHnd = OpenProcess( PROCESS_VM_OPERATION |	PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, pid );
x.pLVI = VirtualAllocEx( x.hProcHnd, NULL, sizeof( LVITEM ), MEM_RESERVE |   MEM_COMMIT, PAGE_READWRITE);

return x;
}



int main()
{

HWND hWnd_listview=HWND(0x00021F0E);
HWND hWnd_header=HWND(0x00021F46);

MyStruct x=open_buffer(hWnd_listview);
//for(int i=0;i<100;i++)
	//{
 sort_listview(hWnd_listview,hWnd_header, x);

	Sleep(100);
	//}
//wait a period here
Sleep(10000);
close_buffer(x);
////////////////////

printf( "Done\n"  );

return 0;
}

[AlexA2]

How do I solve this problem?

On WinXP x86 and x64, the code works perfect.
On Win7 x64 and x86, it doesn't work at all. I've tested it with fresh installs, UAC off, no firewall, no AV, no aditional software.

I've doublechecked and it Win7 the application uses WM_NOTIFY and HDN_ITEMCLICKW, same as on WinXP. So, my assumptions were wrong[at some point I thought that the app used different messages for Win7].
Other messages work fine on Win7, tough. For example, TCM_GETITEM, TCM_GETCURSEL, etc.

I've inspected with Winspector, and the WM_NOTIFY message that I'm trying to send isn't received by the ListView Window.

Windows SDK Error report returns: Access is denied. on both Win7 x64 and x86.