鼠标取词相关

序1撷取自WinObject.cs，针对部份输入文字型的控件，可使用WM_SETTEXT指定文字内容

//由类别名称识别是否为特定的文字输入控件对象

public bool IsEditControl

{

        get 

        {

               string cn=ClassName.ToUpper();

               return (cn=="EDIT" || cn=="THUNDERRT5TEXTBOX" || cn=="RICHCNTL" || cn=="RICHEDIT");

        }

}

const uint WM_GETTEXTLENGTH=0x0e;

const uint WM_GETTEXT=0x0d;

const uint WM_SETTEXT=0x0c;

//窗口对象的标题或控件的文字内容

public string Text

{

        get

        {

               if (IsEditControl) 

               {

                       int l=(int) SendMessage(hWnd,WM_GETTEXTLENGTH,0,0);

                       StringBuilder sb=new StringBuilder(l+1);

                       l=(int) SendMessage(hWnd,WM_GETTEXT,sb.Capacity,sb);

                       return sb.ToString();

               }

               else 

               {

                       int length = GetWindowTextLength(hWnd);

                       StringBuilder sb = new StringBuilder(length + 1);

                       GetWindowText(hWnd, sb, sb.Capacity);

                       return sb.ToString();                         

               }

        }

        set

        {

               if (IsEditControl) 

                       SendMessage(hWnd,WM_SETTEXT,0,value);

               else 

                       SetWindowText(hWnd, value);

        }

}

-----end-----

-----box-----

#程序2 与下拉选单互动的范例

[DllImport("USER32.DLL", SetLastError=true)]

public static extern long SendMessage(IntPtr hWnd, uint msg, int wparam, StringBuilder sb);

private void button2_Click(object sender, System.EventArgs e)

{

//由Spy++观察该下拉选单控件的从属关系，以FindChild方式锁定之。

//由于同一层有多个TadvCityCbBox控件，因此使用FindChildren再由数组中取出第2个(户籍地)。

//原理及细节说明请参见前期文章。

WinObject cb = (WinObject)

        WinObject.FindWindow("TBasicForm","财政部九十二年度综合所得税二维条形码结算申报系统")

        .FindChild("TNotebook","").FindChild("TPage","Basic").FindChild("TPanel","Panel2")

        .FindChild("TPanel","").FindChildren("TadvCityCbBox",null)[1];

int itemCount = (int) cb.SendMessage(0x0146,0,0); //CB_GETCOUNT=0x146

string[] itemValues=new string[itemCount];

Debug.Write("共有"+itemCount.ToString()+"个选项，包含有:");

int idxTaipei=-1;

for (int i=0; i<itemCount; i++) 

{

        //先取得字符串长度 CB_GETLBTEXTLEN 0x0149

        int len=(int) cb.SendMessage(0x0149,(uint) i,0);

        //取回字符串 CB_GETLBTEXT 0x0148

        StringBuilder sb=new StringBuilder(len);

        SendMessage(cb.Handle,0x0148, i, sb);

        itemValues[i]=sb.ToString();

        if (itemValues[i]=="台北市") idxTaipei=i;

        if (i % 10==0) Debug.WriteLine("");

        Debug.Write(itemValues[i]+" ");

}

Debug.WriteLine("");

//取得目前的选取索引值 CB_GETCURSEL 0x0147

int idxNow=(int) cb.SendMessage(0x0147,0,0);

Debug.WriteLine("目前的选取值="+idxNow.ToString()+"."+itemValues[idxNow]);

//改变选取索引值至台北市的选项，CB_SETCURSEL 0x014E

cb.SendMessage(0x014E,(uint) idxTaipei,0);

Debug.WriteLine("已设定为"+idxTaipei.ToString()+"."+itemValues[idxTaipei]);

}

-----end-----

-----box-----

#程序3 跨程序远程记忆体操作 RemoteMemory.cs

public class RemoteMemory

{

        private uint lpMem=0;

        private int size=0;

        private IntPtr hProcess;

        [DllImport("kernel32.dll")]

        public static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, uint dwProcessId);

        uint PROCESS_VM_OPERATION  = (0x0008);  

        uint PROCESS_VM_READ       = (0x0010);  

        uint PROCESS_VM_WRITE      = (0x0020);

        uint MEM_COMMIT           = 0x1000;

        uint MEM_RESERVE          = 0x2000;

        uint MEM_RELEASE          = 0x8000;

        uint PAGE_READWRITE       = 0x04;

        [DllImport("kernel32.dll")]

        public static extern uint VirtualAllocEx(IntPtr hProcess, uint lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll")]

        public static extern int WriteProcessMemory(IntPtr hProcess, uint lpBaseAddress, uint lpObject, uint nSize, ref uint lpNumberOfBytesWritten);

        [DllImport("kernel32.dll")]

        public static extern int ReadProcessMemory(IntPtr hProccess, uint lpBaseAddress, uint lpObject, uint nSize, ref uint lpNumberOfBytesRead);

        [DllImport("kernel32.dll")]

        public static extern int ReadProcessMemory(IntPtr hProcess, uint lpBaseAddress,[In, Out] byte[] buffer, uint nSize, ref uint lpNumberOfBytesRead);

        [DllImport("kernel32.dll")]

        public static extern int VirtualFreeEx(IntPtr hProcess, uint lpAddress, int dwSize, uint dwFreeType);

        [DllImport("USER32.DLL", SetLastError=true)]

        public static extern uint SendMessage(IntPtr hWnd, uint Msg, uint wParam, uint lParam);

        [DllImport("user32.dll")]

        static extern uint GetWindowThreadProcessId(IntPtr hWnd, ref uint processId);

        //在指定的Process中,取得一段指定大小的内存

        public RemoteMemory(IntPtr hWnd, int size)

        {

               uint dwProcessId=0;

               GetWindowThreadProcessId(hWnd,ref dwProcessId);

               hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, 0, dwProcessId);

               lpMem=VirtualAllocEx(hProcess, 0, (uint) size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);

               this.size=size;

        }

        //释放原先取得的内存

        public void Unallocate() 

        {

               VirtualFreeEx(hProcess, lpMem, 0, MEM_RELEASE);

        }

        //将对象的内容抄写到先前取得的内存中

        public void Write(object o) 

        {

               if (Marshal.SizeOf(o)>size) 

                       throw new ApplicationException("RemoteMemory.Write method error: allocated memory size is not enough!");

               GCHandle gc=GCHandle.Alloc(o,GCHandleType.Pinned);

               uint bytesWritten=0;

               int ret=WriteProcessMemory(hProcess, lpMem, (uint) gc.AddrOfPinnedObject(), (uint) Marshal.SizeOf(o), ref bytesWritten);

        }

        //将内存中的内容还原至对象

        public void Read(ref object o)  

        {

               GCHandle gc=GCHandle.Alloc(o,GCHandleType.Pinned);

               uint bytesRead=0;

              int ret=ReadProcessMemory(hProcess, lpMem, (uint) gc.AddrOfPinnedObject(), (uint) Marshal.SizeOf(o), ref bytesRead);

        }

        //将内存中的某一段解析成为字符串

        public string ReadCString(uint offset, int stringLen) 

        {

               uint bytesRead=0;

               byte[] buffer=new byte[stringLen];

               int ret=ReadProcessMemory(hProcess, lpMem+offset, buffer, (uint) stringLen, ref bytesRead);

               return szToString(buffer);

        }

        //将整块内存解析成为字符串

        public string ReadCString() 

        {

               return ReadCString(0,size);           

        }

        //将字节转成字符串

        private string szToString(byte[] byteArray) 

        {

               int length=0;

               for (int i=0; i<byteArray.Length; i++) 

               {

                       if (byteArray[i]==0) 

                       {

                               length=i;

                               break;

                       }

               }

               return System.Text.Encoding.GetEncoding("big5").GetString(byteArray,0,length);

        }

        //传回内存地址

        public uint MemoryAddress 

        {

               get { return lpMem; }

        }

}-----end-----

-----box-----

#程序4 将List View的Grid内容，转为DataTable: ListViewSpy.cs

public class ListViewSpy

{

        [StructLayout(LayoutKind.Sequential)]

               public struct LVITEM //List View的Item数据结构

        {

               public uint mask;

               public int iItem;

               public int iSubItem;

               public uint state;

               public uint stateMask;

               public IntPtr pszText; //struct中不可使用StringBuilder

               public int cchTextMax;

               public int iImage;

               public IntPtr lParam;

        }

        [StructLayout(LayoutKind.Sequential)]

               public struct HDITEM //List View的Header数据结构

        {

               public uint mask; 

               public int cxy; 

               public IntPtr pszText; 

               public uint hbm; 

               public int cchTextMax; 

               public int fmt; 

               public IntPtr lParam;

        }

        [DllImport("USER32.DLL", SetLastError=true)]

        public static extern uint SendMessage(IntPtr hWnd, uint msg, uint wparam, uint lparam);

        private IntPtr hWnd;

        private int columnCount,rowCount;

        private const int MAX_STR_SIZE=256;

        private DataTable table=new DataTable();

        public ListViewSpy(IntPtr hWnd)

        {

               this.hWnd=hWnd;

               //取得Header(SysHeader32)

               uint LVM_GETHEADER=0x1000+31;

               IntPtr header=new IntPtr(SendMessage(hWnd,LVM_GETHEADER,0,0));

               if (header==IntPtr.Zero) return;

               //取得Column数

               uint HDM_GETITEMCOUNT=0x1200+0;

               columnCount=(int) SendMessage(header,HDM_GETITEMCOUNT,0,0);

               //取得Column Header Text

               HDITEM hdi=new HDITEM();

               uint HDI_TEXT=0x0002;

               hdi.mask=HDI_TEXT;

               hdi.cchTextMax=MAX_STR_SIZE;

               int iStructSize=Marshal.SizeOf(hdi);

               //在目的地Process取得一块用来存放HDITEM的内存空间

               //并额外多要一些用来放字符串

               RemoteMemory rm=new RemoteMemory(hWnd,iStructSize+MAX_STR_SIZE);

               //指向额外的空间

               hdi.pszText=new IntPtr(rm.MemoryAddress+iStructSize);

               //将hdi的内容复制到目的地Process的内存上

               rm.Write(hdi);

               //SendMessage

               uint HDM_GETITEMA=0x1200+3;

               byte[] buffer=new byte[MAX_STR_SIZE];

               table=new DataTable();

               for (int i=0; i<columnCount; i++) 

               {

                       int r=(int) SendMessage(header,HDM_GETITEMA, (uint) i,rm.MemoryAddress);

                       //以字段名称建立DataTable的字段

                       table.Columns.Add(rm.ReadCString((uint) iStructSize,MAX_STR_SIZE),Type.GetType("System.String"));

               }

               rm.Unallocate();

               //取得ListView资料笔数

               uint LVM_GETITEMCOUNT=0x1000+4;

               rowCount=(int) SendMessage(hWnd,LVM_GETITEMCOUNT,0,0);

               LVITEM lvi=new LVITEM();

               uint LVIF_TEXT = 0x0001;

               lvi.mask=LVIF_TEXT;

               lvi.cchTextMax=MAX_STR_SIZE;

               //在目的地Process建立LVITEM，原理同HDITEM

               iStructSize=Marshal.SizeOf(lvi);

               rm=new RemoteMemory(hWnd,(int) iStructSize+MAX_STR_SIZE);

               lvi.pszText=new IntPtr(rm.MemoryAddress+iStructSize);

               //SendMessage

               uint LVM_GETITEMTEXTA=0x1000+45;

               for (int i=0; i<rowCount; i++) 

               {

                       lvi.iItem=i;

                       DataRow row=table.NewRow();

                       for (int j=0; j<columnCount; j++) 

                       {

                               lvi.iSubItem=j;

                               rm.Write(lvi);

                               int ret=(int) SendMessage(hWnd,LVM_GETITEMTEXTA, (uint) i,rm.MemoryAddress);

                               row[j]=rm.ReadCString((uint) iStructSize,MAX_STR_SIZE);

                       }

                       table.Rows.Add(row);

               }

               rm.Unallocate();

        }

        public DataTable Data 

        {

               get {   return table;}

        }

}

-----end-----

-----box-----

程序5 将Task Manager Processes List View的数据在DataGrid还原, 结果如图3

private void button1_Click(object sender, System.EventArgs e)

{

        //使用SPY++时，看到Task Manager的Class Name是#32770 (Dialog)

        //寻找时记得只要指定#32770即可，加上(Dialog)后会找不到

        WinObject lvProcesses=WinObject.FindWindow("#32770","Windows Task Manager")

               .FindChild("#32770","").FindChild("SysListView32","Processes");

        ListViewSpy lvs=new ListViewSpy(lvProcesses.Handle);

        dataGrid1.DataSource=lvs.Data;

        dataGrid1.Refresh();                          

}