SendMessage TreeView TVM_GETITEM崩溃了该进程

Question

我正在尝试访问在另一个进程中运行的TreeView。许多树视图消息都能正常工作。但是，尝试使用TVM_GETITEM会导致其他进程崩溃。

下面的代码是一个简单的程序，用于说明崩溃。要使其运行，您将需要一些CHM帮助文件。我正在使用CHM帮助文件，因为hh.exe对目录使用TreeView控件。

目标是能够获取树节点的文本。

using System;
using System.Collections;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Windows.Forms;

namespace TreeViewTest {

public class TVForm : Form {

    String chmFile = @"C:\temp\QuickGuide.chm"; // change this to some help file on local computer

    Button btnOpenFile = new Button { Text = "Open File", AutoSize = true };
    Button btnDeleteSelected = new Button { Text = "Delete Selected", AutoSize = true };
    Button btnGetCount = new Button { Text = "Get Count", AutoSize = true };
    Button btnGetText = new Button { Text = "Get Text", AutoSize = true }; // causes hh.exe process to crash
    Button btnSelectNext = new Button { Text = "Select Next", AutoSize = true };
    Process process = null;
    IntPtr ptrTreeView = IntPtr.Zero;

    public TVForm() {
        FlowLayoutPanel p = new FlowLayoutPanel { FlowDirection = System.Windows.Forms.FlowDirection.TopDown, Dock = DockStyle.Fill };
        p.Controls.Add(btnOpenFile);
        p.Controls.Add(btnGetCount);
        p.Controls.Add(btnDeleteSelected);
        p.Controls.Add(btnGetText);
        p.Controls.Add(btnSelectNext);
        Controls.Add(p);

        btnOpenFile.Click += buttonClicked; // works fine
        btnDeleteSelected.Click += buttonClicked; // works fine
        btnGetCount.Click += buttonClicked;
        btnGetText.Click += buttonClicked;
        btnSelectNext.Click += buttonClicked;
    }

    void buttonClicked(object sender, EventArgs e) {
        if (!File.Exists(chmFile)) {
            MessageBox.Show("Cannot find CHM file: " + chmFile);
            return;
        }

        IntPtr hwndTreeView = GetTreeViewHandle();
        if (hwndTreeView == IntPtr.Zero) {
            MessageBox.Show("Cannot find TreeView handle.");
            return;
        }

        if (sender == btnDeleteSelected) {
            // get the handle to the selected node in the tree view
            IntPtr hwndItem = SendMessage(hwndTreeView, (int) TVM.TVM_GETNEXTITEM, (int) TVGN.TVGN_CARET, 0);
            if (hwndItem == IntPtr.Zero)
                MessageBox.Show("no item selected");
            else
                SendMessage(hwndTreeView, (int) TVM.TVM_DELETEITEM, IntPtr.Zero, hwndItem);
        }
        else if (sender == btnGetCount) {
            IntPtr count = SendMessage(hwndTreeView, (int) TVM.TVM_GETCOUNT, 0, 0);
            MessageBox.Show(String.Format("There are {0} nodes in the tree view.", count.ToInt32()));
        }
        else if (sender == btnSelectNext) {
            IntPtr hwndItem = SendMessage(hwndTreeView, (int) TVM.TVM_GETNEXTITEM, (int) TVGN.TVGN_CARET, 0);
            if (hwndItem == IntPtr.Zero) {
                MessageBox.Show("no item selected");
                return;
            }
            hwndItem = SendMessage(hwndTreeView, (int) TVM.TVM_GETNEXTITEM, new IntPtr((int) TVGN.TVGN_NEXT), hwndItem);
            if (hwndItem == IntPtr.Zero)
                MessageBox.Show("there is no next item");
            else
                SendMessage(hwndTreeView, (int) TVM.TVM_SELECTITEM, new IntPtr((int) TVGN.TVGN_CARET), hwndItem);
        }
        else if (sender == btnGetText) { // crashes hh.exe
            IntPtr hwndItem = SendMessage(hwndTreeView, (int) TVM.TVM_GETNEXTITEM, (int) TVGN.TVGN_CARET, 0);
            if (hwndItem == IntPtr.Zero) {
                MessageBox.Show("no item selected");
                return;
            }

            var item = new TVITEMEX(); // have tried both TVITEM and TVITEMEX
            item.hItem = hwndItem;
            item.mask = (int) (TVIF.TVIF_TEXT | TVIF.TVIF_HANDLE);
            item.cchTextMax = 260;
            item.pszText = Marshal.AllocHGlobal(item.cchTextMax);

            IntPtr ptr = Marshal.AllocHGlobal(Marshal.SizeOf(item));
            Marshal.StructureToPtr(item, ptr, false);

            // have tried TVM_GETITEM and TVM_GETITEMA
            SendMessage(hwndTreeView, (int) TVM.TVM_GETITEM, IntPtr.Zero, ptr); // this line crashes hh.exe

            String text = Marshal.PtrToStringAuto(item.pszText);
            MessageBox.Show(text);

            Marshal.FreeHGlobal(item.pszText);
            Marshal.FreeHGlobal(ptr);
        }
    }

    public Process GetProcess() {
        if (process != null && !process.HasExited)
            return process;

        ptrTreeView = IntPtr.Zero;
        process = Process.Start(chmFile);
        Thread.Sleep(1000); // sleep a little to give the process time to open (otherwise cannot find the TreeView control)
        return process;
    }

    public IntPtr GetTreeViewHandle() {
        if (ptrTreeView != IntPtr.Zero && !process.HasExited)
            return ptrTreeView;

        var list = new List<IntPtr>();
        Process p = GetProcess();
        FindSysTreeView(p.MainWindowHandle, new Hashtable(), list);
        if (list.Count == 0) {
            return IntPtr.Zero;
        }
        ptrTreeView = list[0];
        return ptrTreeView;
    }

    private static void FindSysTreeView(IntPtr p, Hashtable ht, List<IntPtr> list) {
        var cn = GetClassName(p);
        //var txt = GetWindowText(p);
        if (cn == "SysTreeView32") {
            if (!list.Contains(p))
                list.Add(p);
        }
        if (ht[p] == null) {
            ht[p] = p;
            foreach (var c in GetChildWindows(p))
                FindSysTreeView(c, ht, list);
        }
    }

    public static String GetClassName(IntPtr hWnd) {
        StringBuilder sb = new StringBuilder(256);
        GetClassName(hWnd, sb, sb.Capacity);
        return sb.ToString();
    }

    public static List<IntPtr> GetChildWindows(IntPtr parent) {
        List<IntPtr> result = new List<IntPtr>();
        GCHandle listHandle = GCHandle.Alloc(result);
        try {
            Win32Callback childProc = new Win32Callback(EnumWindow);
            EnumChildWindows(parent, childProc, GCHandle.ToIntPtr(listHandle));
        } finally {
            if (listHandle.IsAllocated)
                listHandle.Free();
        }
        return result;
    }

    private static bool EnumWindow(IntPtr handle, IntPtr pointer) {
        GCHandle gch = GCHandle.FromIntPtr(pointer);
        List<IntPtr> list = gch.Target as List<IntPtr>;
        if (list == null)
            throw new InvalidCastException("GCHandle Target could not be cast as List<IntPtr>");
        list.Add(handle);
        return true;
    }

    [DllImport("user32.dll")]
    static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount);

    [DllImport("user32.Dll")]
    private static extern bool EnumChildWindows(IntPtr parentHandle, Win32Callback callback, IntPtr lParam);
    private delegate bool Win32Callback(IntPtr hwnd, IntPtr lParam);

    [DllImport("user32.dll")]
    static extern IntPtr SendMessage(IntPtr hWnd, int Msg, IntPtr wParam, IntPtr lParam);

    [DllImport("user32.dll")]
    static extern IntPtr SendMessage(IntPtr hWnd, int Msg, int wParam, int lParam);

    private const int TV_FIRST = 0x1100;
    public enum TVM {
        TVM_GETNEXTITEM = (TV_FIRST + 10),
        TVM_GETITEMA = (TV_FIRST + 12),
        TVM_GETITEM = (TV_FIRST + 62),
        TVM_GETCOUNT = (TV_FIRST + 5),
        TVM_SELECTITEM = (TV_FIRST + 11),
        TVM_DELETEITEM = (TV_FIRST + 1),
        TVM_EXPAND = (TV_FIRST + 2),
        TVM_GETITEMRECT = (TV_FIRST + 4),
        TVM_GETINDENT = (TV_FIRST + 6),
        TVM_SETINDENT = (TV_FIRST + 7),
        TVM_GETIMAGELIST = (TV_FIRST + 8),
        TVM_SETIMAGELIST = (TV_FIRST + 9),
        TVM_GETISEARCHSTRING = (TV_FIRST + 64),
        TVM_HITTEST = (TV_FIRST + 17),
    }

    public enum TVGN {
        TVGN_ROOT = 0x0,
        TVGN_NEXT = 0x1,
        TVGN_PREVIOUS = 0x2,
        TVGN_PARENT = 0x3,
        TVGN_CHILD = 0x4,
        TVGN_FIRSTVISIBLE = 0x5,
        TVGN_NEXTVISIBLE = 0x6,
        TVGN_PREVIOUSVISIBLE = 0x7,
        TVGN_DROPHILITE = 0x8,
        TVGN_CARET = 0x9,
        TVGN_LASTVISIBLE = 0xA
    }

    [Flags]
    public enum TVIF {
        TVIF_TEXT = 1,
        TVIF_IMAGE = 2,
        TVIF_PARAM = 4,
        TVIF_STATE = 8,
        TVIF_HANDLE = 16,
        TVIF_SELECTEDIMAGE = 32,
        TVIF_CHILDREN = 64,
        TVIF_INTEGRAL = 0x0080,
        TVIF_DI_SETITEM = 0x1000
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct TVITEMEX {
        public uint mask;
        public IntPtr hItem;
        public uint state;
        public uint stateMask;
        public IntPtr pszText;
        public int cchTextMax;
        public int iImage;
        public int iSelectedImage;
        public int cChildren;
        public IntPtr lParam;
        public int iIntegral;
        public uint uStateEx;
        public IntPtr hwnd;
        public int iExpandedImage;
        public int iReserved;
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct TVITEM {
        public uint mask;
        public IntPtr hItem;
        public uint state;
        public uint stateMask;
        public IntPtr pszText;
        public int cchTextMax;
        public int iImage;
        public int iSelectedImage;
        public int cChildren;
        public IntPtr lParam;
    }

}
}

Answer 1

以下是用于从另一个进程中运行的TreeView访问节点文本的代码：

[DllImport("kernel32.dll")]
static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

[DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);

[DllImport("kernel32.dll", SetLastError = true)]
static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);

[DllImport("kernel32.dll", SetLastError = true)]
static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesRead);

[DllImport("kernel32.dll")]
public static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint dwFreeType);

// privileges
const int PROCESS_CREATE_THREAD = 0x0002;
const int PROCESS_QUERY_INFORMATION = 0x0400;
const int PROCESS_VM_OPERATION = 0x0008;
const int PROCESS_VM_WRITE = 0x0020;
const int PROCESS_VM_READ = 0x0010;

// used for memory allocation
const uint MEM_COMMIT = 0x00001000;
const int MEM_DECOMMIT = 0x4000;
const uint MEM_RESERVE = 0x00002000;
const uint PAGE_READWRITE = 4;

///<summary>Returns the tree node information from another process.</summary>
///<param name="hwndItem">Handle to a tree node item.</param>
///<param name="hwndTreeView">Handle to a tree view control.</param>
///<param name="process">Process hosting the tree view control.</param>
private static NodeData AllocTest(Process process, IntPtr hwndTreeView, IntPtr hwndItem) {
    // code based on article posted here: http://www.codingvision.net/miscellaneous/c-inject-a-dll-into-a-process-w-createremotethread

    // handle of the process with the required privileges
    IntPtr procHandle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, process.Id);

    // Write TVITEM to memory
    // Invoke TVM_GETITEM
    // Read TVITEM from memory

    var item = new TVITEMEX();
    item.hItem = hwndItem;
    item.mask = (int) (TVIF.TVIF_HANDLE | TVIF.TVIF_CHILDREN | TVIF.TVIF_TEXT);
    item.cchTextMax = 1024;
    item.pszText = VirtualAllocEx(procHandle, IntPtr.Zero, (uint) item.cchTextMax, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); // node text pointer

    byte[] data = getBytes(item);

    uint dwSize = (uint) data.Length;
    IntPtr allocMemAddress = VirtualAllocEx(procHandle, IntPtr.Zero, dwSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); // TVITEM pointer

    uint nSize = dwSize;
    UIntPtr bytesWritten;
    bool successWrite = WriteProcessMemory(procHandle, allocMemAddress, data, nSize, out bytesWritten);

    var sm = SendMessage(hwndTreeView, (int) TVM.TVM_GETITEM, IntPtr.Zero, allocMemAddress);

    UIntPtr bytesRead;
    bool successRead = ReadProcessMemory(procHandle, allocMemAddress, data, nSize, out bytesRead);

    UIntPtr bytesReadText;
    byte[] nodeText = new byte[item.cchTextMax];
    bool successReadText = ReadProcessMemory(procHandle, item.pszText, nodeText, (uint) item.cchTextMax, out bytesReadText);

    bool success1 = VirtualFreeEx(procHandle, allocMemAddress, dwSize, MEM_DECOMMIT);
    bool success2 = VirtualFreeEx(procHandle, item.pszText, (uint) item.cchTextMax, MEM_DECOMMIT);

    var item2 = fromBytes<TVITEMEX>(data);

    String name = Encoding.Unicode.GetString(nodeText);
    int x = name.IndexOf('\0');
    if (x >= 0)
        name = name.Substring(0, x);

    NodeData node = new NodeData();
    node.Text = name;
    node.HasChildren = (item2.cChildren == 1);

    return node;
}

public class NodeData {
    public String Text { get; set; }
    public bool HasChildren { get; set; }
}

private static byte[] getBytes(Object item) {
    int size = Marshal.SizeOf(item);
    byte[] arr = new byte[size];
    IntPtr ptr = Marshal.AllocHGlobal(size);

    Marshal.StructureToPtr(item, ptr, true);
    Marshal.Copy(ptr, arr, 0, size);
    Marshal.FreeHGlobal(ptr);

    return arr;
}

private static T fromBytes<T>(byte[] arr) {
    T item = default(T);
    int size = Marshal.SizeOf(item);
    IntPtr ptr = Marshal.AllocHGlobal(size);
    Marshal.Copy(arr, 0, ptr, size);
    item = (T) Marshal.PtrToStructure(ptr, typeof(T));
    Marshal.FreeHGlobal(ptr);
    return item;
}

// Note: different layouts required depending on OS versions.
// https://msdn.microsoft.com/en-us/library/windows/desktop/bb773459%28v=vs.85%29.aspx
[StructLayout(LayoutKind.Sequential)]
public struct TVITEMEX {
    public uint mask;
    public IntPtr hItem;
    public uint state;
    public uint stateMask;
    public IntPtr pszText;
    public int cchTextMax;
    public int iImage;
    public int iSelectedImage;
    public int cChildren;
    public IntPtr lParam;
    public int iIntegral;
    public uint uStateEx;
    public IntPtr hwnd;
    public int iExpandedImage;
    public int iReserved;
}