[RESOLVED] Empty squares reading from memory

[oprache]

I am trying to get the text in different panes of an msclts_statusbar32 status bar in another application.
I found some clever code from Arkadiy Olovyannikov that gets me to the point where I can get a string from each pane. Unfortunately, each string contains just empty squares, not the characters I am looking for.
This maybe a simple conversion issue but I do not know how to approach it.
The code below shows a test procedure. The application I am trying to get data from was written in NT.
There is no error when I run the form. All the API declarations appear to be in good order.
My problem is the content of the SBText(i) strings.
This is an example of what I get in the Watch window "


















"

Thanks for any insight.

Private Sub cmdRdSBr_Click()
'Gets the Status Bar handle and tries to extract the entire text in the different panels
Dim hwndStBr As Long
Dim hwndStBrChld As Long
Dim lpEnumFunc As Long
Dim lParam As Long
Dim nCount As Long
Dim pid As Long
Dim hProcess As Long
Dim lWritten As Long
Dim lpSysShared As Long, hFileMapping As Long, dwSize As Long
Dim lRet As Long
Dim sTemp As String
Dim i As Integer

'Find the status bar handle
hwndStBr = FindWindowEx(hwndPHD, 0&, "msctls_statusbar32", vbNullString)
Do While hwndStBr = 0
DoEvents
hwndStBr = FindWindowEx(hwndPHD, 0&, "msctls_statusbar32", vbNullString)
Loop
'Display the first panel
lblWinCaption.Caption = GetText(hwndStBr)

nCount = SendMessage(hwndStBr, SB_GETPARTS, 0, ByVal 0&) 'Ok, this works
lblWinCaption.Caption = nCount

ReDim SBText(nCount - 1)
dwSize = STRING_BUFFER_SIZE
sTemp = String(dwSize, 0)
If IsWindowsNT Then 'WinNT staff
lpSysShared = GetMemSharedNT(pid, dwSize, hProcess)
WriteProcessMemory hProcess, ByVal lpSysShared, ByVal sTemp, dwSize, lWritten
For i = 0 To nCount - 1
lRet = SendMessage(hwndStBr, SB_GETTEXT, i, ByVal lpSysShared) 'lRet = number of characters returned
If lRet Then
ReadProcessMemory hProcess, ByVal lpSysShared, ByVal sTemp, dwSize, lWritten
SBText(i) = Left(sTemp, (lRet And &HFFFF&)) 'This is just empty squares, where is the real text?
End If
Next i
FreeMemSharedNT hProcess, lpSysShared, dwSize
Else 'Win9x staff
lpSysShared = GetMemShared95(dwSize, hFileMapping)
CopyMemory ByVal lpSysShared, ByVal sTemp, dwSize
For i = 0 To nCount - 1
lRet = SendMessage(hwndStBr, SB_GETTEXT, ByVal i, ByVal lpSysShared) 'This crashes PhD...
If lRet Then
CopyMemory ByVal sTemp, ByVal lpSysShared, dwSize
SBText(i) = Left(sTemp, (lRet And &HFFFF&))
End If
Next i
FreeMemShared95 hFileMapping, lpSysShared
End If
lblWinCaption.Caption = SBText(nCount - 1)

End Sub

[Quiver318]

For what it is worth, all of those characters appear to be SOH (start of header) characters. SOH is an unprintable character which is equivalent to chr$(1).

Have you tried this code on anything besides the msclts_statusbar32 with success?

[MartinLiss]

Those are not empty squares but rather unprintable characters. If you look at them in Hex you can probably figure out what they are.

[oprache]

To Quiver138:
No I have not tried it on anything else. I am not that familiar with using APIs but I am thinking of trying to write known data to the memory area and read it back (using the same functions) to see if that helps me pinpoint the problem

To Marty:
Thanks for the suggestion. Converting the string to hex returns a bunch of zeroes, maybe not such a surprise given Quiver138's comment.
I'll keep looking

[oprache]

Something new: In the code above I forced the string sTemp as follows:
sTemp = String(dwSize, "A")
I then ran the code and looked at the results of using the ReadProcessMemory function: surprise, surprise, sTemp has the same content.
So this means the WriteProcessMemory function does its job, the ReadProcessMemory function does its job, but the SendMessage(hwndStBr, SB_GETTEXT, i, ByVal lpSysShared) function does not. It looks like the call is incorrect?
Any ideas?

[oprache]

Problem Solved!
The following statement was missing:
tid = GetWindowThreadProcessId(hwndPHD, pid) (declare tid as long)
This statement must come before the memory allocation function which uses pid.
Once this was in, the code started working fine.
All the credit really goes to the original author, Arkadiy Olovyannikov.