EM_EXGETSEL crashes app

[Alexander]

I am trying to retrieve the selected text out of a richedit ctrl in
another app. The following code crashes WordPad (hwnd is a handle to
the control).

CHARRANGE chr = {0};

::SendMessage( hwnd, EM_EXGETSEL, 0, (LPARAM)(CHARRANGE FAR *)&chr );

RichEdit controls in other applications may crash or not but always
return 0 for both chr.cpMin and chr.cpMax despite there being selected
text.

Suggestions?

[David Lowndes]

The problem is that you're passing a pointer across processes. I think
you'll need to inject your code (in a DLL) into the other processes to
have your code run in the same process space.

Dave

[Alexander]

Thanks for the reply, Dave.

I will try that route.

[Joseph M. Newcomer]

Note that this cannot possibly work if sent to some other process! The reason is that you
are passing it the address of a block of memory in YOUR process, which is either
inaccessible in the target process or which will cause catastrophic failure in the target
process.

It doesn't return 0; it doesn't cause ANY value to be set. What it does is clobber some
piece of memory in the target process which happens to be at the same address as your
CHARRANGE value.

Also, please try to avoid using the word 'crash' unless it is followed by a phrase like
'with an access fault' or some similarly informative piece of information.

Bottom line: it is not possible to get the character range of a rich edit control in
another process unless you do something fairly complex. For example, you set a
system-wide message hook. You send it a user-defined Registered Window Message which has
as the WPARAM the HWND that you want to get the information from. When your hook is
activated, it checks the process ID of the HWND and its own process ID, and if they match,
it sends the EM_EXGETSEL message to that window, using a local variable in the hook
function to get the information. Then, you have put in the HWND the window you would
like to receive notification, and ;you send a DIFFERENT registered window message to the
specified LPARAM handle, in fact, one message which contains the HWND of the target and
the cpMin, and another message (yet a third code) which contains the HWND of the target
and the cpMax.

joe

Joseph M. Newcomer [MVP]
email: newc...@flounder.com
Web: http://www.flounder.com
MVP Tips: http://www.flounder.com/mvp_tips.htm

[David Ching]

"Alexander" <the4...@yahoo.com> wrote in message
news:1154126168.6...@s13g2000cwa.googlegroups.com...

As others have pointed out, the pointer in LPARAM needs to reside in the
same process as the thread that created hwnd (in the WordPad process). I
have created a SendMessageRemote() API which uses VirtualAlloc,
ReadProcessMemory, WriteProcessMemory, and CreateRemoteThread to do the
heavy lifting. It is supported in Win2K/XP only. The code works, but is
not yet ready to be submitted in an article. You can look at it at

http://www.dcsoft.com/private/sendmessageremote.h
http://www.dcsoft.com/private/sendmessageremote.cpp

It is based on a great CodeProject article:
http://www.codeproject.com/threads/winspy.asp.

If anyone can make it better, please feel free.

Thanks,
David