I use python inject dll into a thrid software, to get a replacedText, but i get a mess Messy code
hook.cpp
#include <windows.h>
#include <string>
#include <richedit.h>
#include <cstring> // 用于 strncpy
HHOOK g_hHook = NULL;
// 辅助函数：窄字符串(std::string) 转 宽字符串(std::wstring)（适配系统默认编码）
std::wstring MultiByteToWideString(const std::string& str)
{
if (str.empty()) return L"";
// 获取转换所需的宽字符长度（CP_ACP=系统默认ANSI编码）
int wideLen = MultiByteToWideChar(CP_ACP, 0, str.c_str(), -1, NULL, 0);
if (wideLen == 0) return L"";
// 分配缓冲区并执行转换
std::wstring wideStr(wideLen, 0);
MultiByteToWideChar(CP_ACP, 0, str.c_str(), -1, &wideStr[0], wideLen);
return wideStr;
}
std::string GetMessageText(WPARAM wParam, LPARAM lParam)
{
std::string text;
if (lParam)
{
char* pText = (char*)lParam;
if (pText)
{
const size_t maxLength = 1024;
char buffer[maxLength + 1] = {0};
strncpy(buffer, pText, maxLength); // 限制最大长度，避免缓冲区溢出
text = buffer;
}
}
return text;
}
extern "C" {
__declspec(dllexport) LRESULT CALLBACK CallWndProc(int nCode, WPARAM wParam, LPARAM lParam)
{
if (nCode == HC_ACTION)
{
CWPSTRUCT* pMsg = (CWPSTRUCT*)lParam;
if (pMsg->message == EM_REPLACESEL)
{
std::string replacedText = GetMessageText(pMsg->wParam, pMsg->lParam);
if (!replacedText.empty())
{
// 1. 窄字符串转宽字符串（适配 MessageBoxW）
std::wstring replacedTextWide = MultiByteToWideString(replacedText);
// 2. 拼接宽字符串消息（全程用 std::wstring + L"" 宽常量）
std::wstring message = L"检测到RichEdit文本替换操作:\n\n";
message += L"窗口句柄: " + std::to_wstring((intptr_t)pMsg->hwnd) + L"\n";
message += L"替换文本: " + replacedTextWide + L"\n";
message += L"文本长度: " + std::to_wstring(replacedTextWide.length()) + L" 字符";
// 3. 调用宽字符版本 MessageBoxW（参数均为宽字符串）
MessageBoxW(
NULL,
message.c_str(), // std::wstring::c_str() 返回 LPCWSTR
L"RichEdit监控", // 宽字符串标题（无乱码）
MB_OK | MB_ICONINFORMATION
);
}
}
}
return CallNextHookEx(g_hHook, nCode, wParam, lParam);
}
__declspec(dllexport) void TestFunction() {
// 空函数用于测试导出机制
}
}
BOOL APIENTRY DllMain(HINSTANCE hinstDll, DWORD dwReason, LPVOID lpvRevered)
{
switch (dwReason)
{
case DLL_PROCESS_ATTACH:
MessageBox(NULL, TEXT("Process Load Dll Success!"), TEXT("Tips"), MB_OK);
break;
case DLL_PROCESS_DETACH:
// MessageBox(NULL, TEXT("Process Unload Dll Success!"), TEXT("Tips"), MB_OK);
break;
case DLL_THREAD_ATTACH:
// MessageBox(NULL, TEXT("Thread load Dll Success!"), TEXT("Tips"), MB_OK);
break;
case DLL_THREAD_DETACH:
// MessageBox(NULL, TEXT("Thread Unload Dll Success!"), TEXT("Tips"), MB_OK);
break;
}
return TRUE;
}
use c++ inject: get a right msg on 'RichEdit监控' pop dialog
inject.cpp
#include <windows.h>
#include <iostream>
#include <string>
int main(int argc, char* argv[]) {
// 检查参数数量
if (argc != 2) {
std::cout << "Usage: " << argv[0] << " <window_handle>" << std::endl;
return 1;
}
// 获取目标窗口句柄
HWND targetHwnd = (HWND)strtoull(argv[1], nullptr, 0);
if (!IsWindow(targetHwnd)) {
std::cout << "Invalid window handle or window not found!" << std::endl;
return 1;
}
// 获取窗口所属的线程ID
DWORD targetThreadId = GetWindowThreadProcessId(targetHwnd, nullptr);
if (targetThreadId == 0) {
std::cout << "Failed to get thread ID from window handle! error code: " << GetLastError() << std::endl;
return 1;
}
// 获取当前目录并构建完整DLL路径
char dllPath[MAX_PATH];
GetCurrentDirectoryA(MAX_PATH, dllPath);
strcat_s(dllPath, "\\hook.dll");
std::cout << "loading DLL: " << dllPath << std::endl;
// 使用完整路径加载DLL
HMODULE hdll = LoadLibraryA(dllPath);
if (!hdll) {
std::cout << "DLL load failed! error code: " << GetLastError() << std::endl;
return 1;
}
// 获取钩子过程函数地址
HOOKPROC hproc = (HOOKPROC)GetProcAddress(hdll, "CallWndProc@12");
if (!hproc) {
std::cout << "get function address failed! error code: " << GetLastError() << std::endl;
FreeLibrary(hdll);
return 1;
}
// 安装线程特定钩子
HHOOK hook = SetWindowsHookEx(WH_CALLWNDPROC, hproc, hdll, targetThreadId);
if (!hook) {
std::cout << "install hook failed! error code: " << GetLastError() << std::endl;
FreeLibrary(hdll);
return 1;
}
std::cout << "install hook success for window handle: 0x" << std::hex << (ULONG_PTR)targetHwnd
<< ", thread ID: " << std::dec << targetThreadId << "! hook will uninstall wait 60 second..." << std::endl;
// 等待60秒（30次×2秒）
for (int i = 0; i < 30; i++) {
Sleep(2000);
}
// 卸载钩子
UnhookWindowsHookEx(hook);
FreeLibrary(hdll);
std::cout << "hook uninstall，exit。" << std::endl;
return 0;
}
use python inject: get a Messy code on 'RichEdit监控' pop dialog
inject.py
import sys
import ctypes
import threading
import time
from ctypes import wintypes
import os
from pipe import *
def main(hwnd):
try:
# 获取目标窗口句柄
target_hwnd = wintypes.HWND(hwnd)
if not ctypes.windll.user32.IsWindow(target_hwnd):
print("Invalid window handle or window not found!")
return 1
# 获取窗口所属的线程ID
target_thread_id = ctypes.windll.user32.GetWindowThreadProcessId(target_hwnd, None)
if target_thread_id == 0:
error_code = ctypes.windll.kernel32.GetLastError()
print(f"Failed to get thread ID from window handle! error code: {error_code}")
return 1
# 获取当前目录并构建完整DLL路径
dll_path = os.path.join(os.getcwd(), "hook.dll")
print(f"Loading DLL: {dll_path}")
# 使用完整路径加载DLL
hdll = ctypes.windll.kernel32.LoadLibraryW(dll_path)
if not hdll:
error_code = ctypes.windll.kernel32.GetLastError()
print(f"DLL load failed! error code: {error_code}")
return 1
# 获取钩子过程函数地址
hproc = ctypes.windll.kernel32.GetProcAddress(hdll, b"CallWndProc@12")
print(f"Function address: {hproc}")
if not hproc:
error_code = ctypes.windll.kernel32.GetLastError()
print(f"Get function address failed! error code: {error_code}")
ctypes.windll.kernel32.FreeLibrary(hdll)
return 1
# 安装线程特定钩子
hook = ctypes.windll.user32.SetWindowsHookExW(
4, # WH_CALLWNDPROC
hproc,
hdll,
target_thread_id
)
if not hook:
error_code = ctypes.windll.kernel32.GetLastError()
print(f"Install hook failed! error code: {error_code}")
ctypes.windll.kernel32.FreeLibrary(hdll)
return 1
else:
time.sleep(10000)
except Exception as e:
print(f"An error occurred: {e}")
return 1
if __name__ == "__main__":
main(723858)
enter image description here
what cause these different?
