C / C++ / MFC

LVFINDINFO info = {0};
int iIndex = 0;
TCHAR sTxt[MAX_PATH] = {0};
SIZE_T nByte = 0;
wcscpy(sTxt, _T("Speaker"));

info.flags = LVFI_PARTIAL | LVFI_STRING;

TCHAR* pBuffer = (TCHAR*)::VirtualAllocEx(m_hCplProcess, NULL, MAX_PATH, MEM_RESERVE, PAGE_READWRITE);
if(!WriteProcessMemory(m_hCplProcess, pBuffer, sTxt, MAX_PATH, &nByte)) {
    return;
}
info.psz = pBuffer;

if((iIndex = Ctrl.FindItem(&info)) != -1) {
    OutputDebugString(_T("Speaker-like entry is found."));
}

VirtualFreeEx(m_hCplProcess, pBuffer, MAX_PATH, MEM_RELEASE);

Maxwell Chen wrote:

TCHAR* pBuffer = (TCHAR*)::VirtualAllocEx(m_hCplProcess, NULL, MAX_PATH, MEM_RESERVE, PAGE_READWRITE);

Naveen wrote:

You have to pass flAllocationType as MEM_COMMIT|MEM_RESERVE

TCHAR* pBuffer = NULL;
pBuffer = (TCHAR*)::VirtualAllocEx(m_hCplProcess, NULL, MAX_PATH, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if(!pBuffer) {
    return;
}

LVFINDINFO* pInfo = NULL;
// Do VirtualAllocEx for pInfo  ...
pInfo->flags = LVFI_PARTIAL | LVFI_STRING; // <-- crash.

Maxwell Chen wrote:

I also tried to VirtualAllocEx a LVFINDINFO object to replace the local one. It crashed too but at different line. Not at FindItem call but at the line

Naveen wrote:

3. create local object of LVFINDINFO.
4. Set the flags and psz as the memory of the remote process
5. Allocate another memory in the remote process, who's size = sizeof( LVFINDINFO).

class A
{
    CDialog* m_pDlg;

public:
    A()
    {
        m_pDlg = new CDialog(IDD_MYDLG);
        m_pDlg->Create(IDD_MYDLG);
    }

    ~A()
    {
        delete m_pDlg;
    }

    void One()
    {
        // Can access m_pDlg here.
    }

    void Two()
    {
        // Can access m_pDlg here.
    }
};