CODEWITHSUNDEEP
c++dll-injectiondrawtexttextout
stomseven
stomseven

Reputation: 157

DLL Injection: DrawText and TextOut doesn't return all text

I successfully inject my DLL into the program. However I would like to get the information from a ListBox. WM_GETTEXT is not working so I had to do the dll injection. I am receiving a lof of text but from the desired control I have got nothing.

Here is my code:

#include <Windows.h>
#include "detours.h"
#include <tchar.h>
#include <stdio.h>
// Function pointer to the original (un-detoured) DrawText API
int (WINAPI * Real_DrawText)(HDC a0, LPCWSTR a1, int a2, LPRECT a3, UINT a4) = DrawTextW;
int (WINAPI * Real_TextOut)(HDC hdc, int nXStart, int nYStart, LPCTSTR lpString, int cchString) = TextOutW;


void writeToFile(LPCWSTR text)
{
    FILE *out;

    if (!(out = fopen("C:\\OUTPUT\\out.txt", "a+"))) {
        MessageBox (0,  TEXT("ERROR FILE"),  TEXT("ERROR FILE"), MB_ICONINFORMATION);
        return;
    }
    fwprintf(out, text);
    fclose(out);
}
// Our custom version of DrawText
int WINAPI Mine_DrawText(HDC hdc, LPCWSTR text,  int nCount, LPRECT lpRect, UINT uOptions)
{

    int rv = Real_DrawText(hdc, text, nCount, lpRect, uOptions);


    WideCharToMultiByte(CP_ACP, WC_DEFAULTCHAR, text, -1, txt, 0, NULL, NULL);
    writeToFile(text);
    return rv;
}

int WINAPI Mine_TextOut(HDC hdc, int nXStart, int nYStart, LPCTSTR lpString, int cchString) {

    int rv = Real_TextOut(hdc, nXStart, nYStart, lpString, cchString);

    writeToFile(lpString);

    return rv;
}

// Install the DrawText detour whenever this DLL is loaded into any process...
BOOL APIENTRY DllMain( HANDLE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved  )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        MessageBox (0,  TEXT("From DLL\n"),  TEXT("Process Attach"), MB_ICONINFORMATION);
        DetourTransactionBegin(); 
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)Real_DrawText, Mine_DrawText); // <- magic
        DetourAttach(&(PVOID&)Real_TextOut, Mine_TextOut);
        DetourTransactionCommit();
        break;

    case DLL_PROCESS_DETACH:
        MessageBox (0,  TEXT("From DLL\n"),  TEXT("Process Detach"), MB_ICONINFORMATION);
        DetourTransactionBegin(); 
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)Real_DrawText, Mine_DrawText);
        DetourTransactionCommit();
        break;
    }

    return TRUE;
}

My question is: Is there something that I missing? I mean is there other ways to get text from an application? Because as I did my research this should give me all the text from the program.

Thank you very much for your help!

Upvotes: 0

Views: 923

Answers (1)

Adrian McCarthy
Adrian McCarthy

Reputation: 48019

What are your really trying to do? It seems like you want to scrape the contents of a list box running in another program. Have you tried simply sending LB_GETTEXT messages to the list box?

Upvotes: 1

Related Questions