ANTICHAT — форум по информационной безопасности, OSINT и технологиям

// find Windows Taskbar (Note: works under XP and 2k3)
HWND hwndTaskbar = FindWindow("Shell_TrayWnd", NULL);
hwndTaskbar = FindWindowEx(hwndTaskbar, NULL, "ReBarWindow32", NULL);
hwndTaskbar = FindWindowEx(hwndTaskbar, NULL, "MSTaskSwWClass", NULL);
hwndTaskbar = FindWindowEx(hwndTaskbar, NULL, "ToolbarWindow32", NULL);

// variables that needed to open taskbar (explorer) process
DWORD taskbarProcessID;
const int BUFFER_SIZE = 0x1000;

// obtain taskbar process id - by window
GetWindowThreadProcessId(hwndTaskbar, &taskbarProcessID);
// open taskbar process
HANDLE taskbarProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, 0, taskbarProcessID);

// variable that helds pointer to a remote buffer in taskbar process
DWORD_PTR taskbarProcessBuffer;

// allocate space for remote buffer in taskbar process
taskbarProcessBuffer = (DWORD_PTR)VirtualAllocEx(taskbarProcessHandle, NULL, BUFFER_SIZE, MEM_COMMIT, PAGE_READWRITE);
				
// declare and prepare variables that will held data
// about PRESSED button in a taskbar
TBBUTTON tbButton;
TBBUTTON* pTBButton = &tbButton;
DWORD_PTR lpTBButton = (DWORD_PTR)pTBButton;

// Now, retrieve information about the PRESSED button in a taskbar
// Note: data is placed in remote buffer
SendMessage(hwndTaskbar, TB_GETBUTTON, i, taskbarProcessBuffer);

// And now, the remote data about PRESSED button is transferred to a local variable
DWORD dwBytesRead = 0;
ReadProcessMemory(taskbarProcessHandle, (LPVOID)taskbarProcessBuffer, (LPVOID)lpTBButton, sizeof(TBBUTTON), &dwBytesRead);

// ------------------------------------------------------------------
// Where is keeped the window handle?
// It is in dwData field of TBBUTTON structure (the first 4 bytes) :))
// MSDN doesn't specify anything about this!
// ------------------------------------------------------------------
				
// Retrieve window handle of pressed btn
BYTE localBuffer[BUFFER_SIZE];
BYTE* pLocalBuffer = localBuffer;
DWORD_PTR ipLocalBuffer = (DWORD_PTR)pLocalBuffer;

// window handle
pLocalBuffer = localBuffer;
ipLocalBuffer = (DWORD_PTR)pLocalBuffer;

// initialize remote buffer
DWORD_PTR lpRemoteData = (DWORD_PTR)tbButton.dwData;
	
// and read the dwData fields of a TBBUTTON from remote process
ReadProcessMemory(taskbarProcessHandle, (LPVOID)lpRemoteData, (LPVOID)ipLocalBuffer, sizeof(DWORD_PTR), &dwBytesRead);

// obtain window handle
// copy first 4 bytes
HWND windowHandle;
memcpy(&windowHandle, (void *)ipLocalBuffer, 4);