Use Python to extract ListView items from another application
Question: I have an application with a ListView ('SysListView32') control, from which I
would like to extract data. The control has 4 columns, only textual data.

I have been playing around the following lines (found online somewhere):

    
    
    VALUE_LENGTH = 256
    bufferlength_int=struct.pack('i', VALUE_LENGTH)
    count = win32gui.SendMessage(TargetHwnd, commctrl.LVM_GETITEMCOUNT, 0, 0)
    for ItemIndex in range(count):
        valuebuffer = array.array('c',bufferlength_int + " " * (VALUE_LENGTH - len(bufferlength_int)))
        ListItems = win32gui.SendMessage(TargetHwnd, commctrl.LVM_GETITEMTEXT, ItemIndex, valuebuffer)
    

[The above code may not be entirely executable, as I stripped it from
irrelevant stuff. but the gist is certainly here.]

This seems to run ok but I must be doing something wrong - I get all sorts of
mostly-zeroed data buffers in return, and none of the actual text contents I
was looking for.

Any suggestions?

Thanks,  
Yonatan


Answer: Well, it turns out I was wrong on several points there. However it is possible
to do by allocating memory inside the target process, constructing the
required struct (LVITEM) there, sending the message and reading back the
result from the buffer allocated in said process.

For the sake of completeness, I attach a code example for reading
SysListView32 items from a foreign process, given a window handle of the
control.

    
    
    from win32con import PAGE_READWRITE, MEM_COMMIT, MEM_RESERVE, MEM_RELEASE,\
        PROCESS_ALL_ACCESS
    from commctrl import LVM_GETITEMTEXT, LVM_GETITEMCOUNT
    
    import struct
    import ctypes
    import win32api
    import win32gui
    
    GetWindowThreadProcessId = ctypes.windll.user32.GetWindowThreadProcessId
    VirtualAllocEx = ctypes.windll.kernel32.VirtualAllocEx
    VirtualFreeEx = ctypes.windll.kernel32.VirtualFreeEx
    OpenProcess = ctypes.windll.kernel32.OpenProcess
    WriteProcessMemory = ctypes.windll.kernel32.WriteProcessMemory
    ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory
    memcpy = ctypes.cdll.msvcrt.memcpy
    
    
    def readListViewItems(hwnd, column_index=0):
    
        # Allocate virtual memory inside target process
        pid = ctypes.create_string_buffer(4)
        p_pid = ctypes.addressof(pid)
        GetWindowThreadProcessId(hwnd, p_pid) # process owning the given hwnd
        hProcHnd = OpenProcess(PROCESS_ALL_ACCESS, False, struct.unpack("i",pid)[0])
        pLVI = VirtualAllocEx(hProcHnd, 0, 4096, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE)
        pBuffer = VirtualAllocEx(hProcHnd, 0, 4096, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE)
    
        # Prepare an LVITEM record and write it to target process memory
        lvitem_str = struct.pack('iiiiiiiii', *[0,0,column_index,0,0,pBuffer,4096,0,0])
        lvitem_buffer = ctypes.create_string_buffer(lvitem_str)
        copied = ctypes.create_string_buffer(4)
        p_copied = ctypes.addressof(copied)
        WriteProcessMemory(hProcHnd, pLVI, ctypes.addressof(lvitem_buffer), ctypes.sizeof(lvitem_buffer), p_copied)
    
        # iterate items in the SysListView32 control
        num_items = win32gui.SendMessage(hwnd, LVM_GETITEMCOUNT)
        item_texts = []
        for item_index in range(num_items):
            win32gui.SendMessage(hwnd, LVM_GETITEMTEXT, item_index, pLVI)
            target_buff = ctypes.create_string_buffer(4096)
            ReadProcessMemory(hProcHnd, pBuffer, ctypes.addressof(target_buff), 4096, p_copied)
            item_texts.append(target_buff.value)
    
        VirtualFreeEx(hProcHnd, pBuffer, 0, MEM_RELEASE)
        VirtualFreeEx(hProcHnd, pLVI, 0, MEM_RELEASE)
        win32api.CloseHandle(hProcHnd)
        return item_texts
    

