//本例以获取程序托盘图标位置为例
//根据需要还可以获取不少信息
//以下代码网上收集的,变量 初始化 指针句柄 及函数是否成功都没判定
//需要的自己加下判定,有时间再改了
struct TRAYDATA
{
HWND hwnd;
UINT uID;
UINT uCallbackMessage;
DWORD Reserved[2];
HICON hIcon;
};
void CTray::GetTrayRect()
{HWND hWnd,hWndPaper;
unsigned long lngPID;
long ret,lngButtons;
HANDLE hProcess;
LPVOID lngAddress;
long lngTextAdr,lngHwndAdr,lngHwnd,lngButtonID;
TCHAR strBuff[1024]={0};
TRAYDATA trayData = {0};
TBBUTTON btnData={0};
hWnd = FindWindow(_T("Shell_TrayWnd"), NULL);
hWnd = FindWindowEx(hWnd, 0, _T("TrayNotifyWnd"), NULL);
hWndPaper = FindWindowEx(hWnd, 0, _T("SysPager"), NULL);
if(!hWndPaper)
hWnd = FindWindowEx(hWnd, 0, _T("ToolbarWindow32"), NULL);
else
hWnd = FindWindowEx(hWndPaper, 0, _T("ToolbarWindow32"), NULL);
ret = GetWindowThreadProcessId(hWnd, &lngPID);
hProcess = OpenProcess(PROCESS_ALL_ACCESS|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE,0,lngPID);
lngAddress = VirtualAllocEx(hProcess,0, 0x4096, MEM_COMMIT, PAGE_READWRITE);
lngButtons = SendMessage(hWnd, TB_BUTTONCOUNT, 0, 0);
RECT rc; POINT point;
LPVOID lngRect = VirtualAllocEx(hProcess,0,sizeof(RECT), MEM_COMMIT, PAGE_READWRITE);
CRect rect;
for(int i=0 ;i< lngButtons;i++)
{
int j = i;
ret = SendMessage(hWnd,TB_GETBUTTON,j,long(lngAddress));
ret = ReadProcessMemory(hProcess, LPVOID(long(lngAddress) + 16),&lngTextAdr,4,0);
if(lngTextAdr != -1)
{
ret = ReadProcessMemory(hProcess, LPVOID(lngTextAdr),strBuff,1024,0);
//ret = ReadProcessMemory(hProcess, LPVOID(long(lngAddress) + 12),&lngHwndAdr,4,0); //获取句柄
//ret = ReadProcessMemory(hProcess, LPVOID(lngHwndAdr),&lngHwnd, 4,0);
//ret = ReadProcessMemory(hProcess, LPVOID(long(lngAddress) + 4),&lngButtonID,4,0);//获取buttonID
CString str(strBuff);
if (str.Compare(m_NotifyIconData.szTip) == 0)
{
::SendMessage(hWnd,TB_GETITEMRECT,(WPARAM)j,(LPARAM)lngRect);
ReadProcessMemory(hProcess,lngRect,&rc, sizeof(rc),0); //获取托盘图标区域
CWnd::FromHandle(hWnd)->ClientToScreen(&rc);
}
//以下是隐藏托盘图标
// {
// if(show)
// {
// SendMessage(hWnd,TB_HIDEBUTTON,lngButtonID,0);
// }
// else
// {
// SendMessage(hWnd,TB_HIDEBUTTON,lngButtonID,1);
// }
// }
}
}
VirtualFreeEx( hProcess, lngAddress, 0x4096, MEM_DECOMMIT);
VirtualFreeEx( hProcess, lngAddress, 0, MEM_RELEASE);
VirtualFreeEx( hProcess, lngRect, sizeof(RECT), MEM_DECOMMIT);
VirtualFreeEx( hProcess, lngRect, 0, MEM_RELEASE);
CloseHandle(hProcess);
}
//另一例子
VOID StartStorm()
{
HWND hMain = FindWindow("animate_layered_window_class", "暴风媒体中心");
if ( hMain )
{
ShowWindow(hMain, SW_HIDE);
}
//得到工具栏句柄
HWND hTray = FindWindow("Shell_TrayWnd", NULL);
hTray = FindWindowEx(hTray, 0, "TrayNotifyWnd", NULL);
hTray = FindWindowEx(hTray, 0, "SysPager", NULL);
hTray = FindWindowEx(hTray, 0, "ToolbarWindow32", NULL);
//获取explore进程ID
DWORD TrayPid;
GetWindowThreadProcessId(hTray, &TrayPid);
//打开进程 并且开辟进程空间
RECT rect;
TBBUTTON tb;
TBBUTTON pTb;
LPVOID lpAddr;
DWORD dwThreadIdOfICO;
DWORD dwTempId = FindStorm("Stormtray.exe"); //你要点击的进程的PID
TRAYDATA traydata;
HANDLE hOpen = OpenProcess(PROCESS_ALL_ACCESS, FALSE, TrayPid);
lpAddr = VirtualAllocEx(hOpen, NULL, sizeof(tb) + sizeof(rect), MEM_COMMIT, PAGE_READWRITE);
int nCount = SendMessage(hTray, TB_BUTTONCOUNT, 0, 0);
int i;
DWORD dwOutWrite;
for ( i = 0; i < nCount; i ++)
{
ZeroMemory(&tb, sizeof(tb));
ZeroMemory(&rect, sizeof(rect));
//把参数写进目标进程
WriteProcessMemory(hOpen, lpAddr, &tb, sizeof(tb), &dwOutWrite);
//WriteProcessMemory(hOpen, (LPVOID)((DWORD)lpAddr + sizeof(pTb)), &rect, sizeof(rect), &dwOutWrite);
//获取BUTTON
SendMessage(hTray, TB_GETBUTTON, i, LPARAM(lpAddr));
//读取TBBUTTON结构
ReadProcessMemory(hOpen, lpAddr, &pTb, sizeof(TBBUTTON), &dwOutWrite);
//读取TRAYDATA结构
ReadProcessMemory(hOpen, (LPVOID)pTb.dwData, &traydata, sizeof(TRAYDATA), &dwOutWrite);
GetWindowThreadProcessId(traydata.hwnd, &dwThreadIdOfICO);
if ( dwThreadIdOfICO == dwTempId )
{
//获取ICO的RECT
LPVOID lp = (LPVOID)((DWORD)lpAddr + sizeof(pTb));
SendMessage(hTray, TB_GETITEMRECT, i, (LPARAM)lp);
LPVOID lpdata = (LPVOID)((DWORD)lpAddr + sizeof(TBBUTTON));
ReadProcessMemory(hOpen, lpdata, &rect, sizeof(rect), &dwOutWrite);
int iGap = rect.right/2; //得到图标的中间坐标的间隔
//点击
SendMessage(hTray, WM_LBUTTONDOWN, MK_LBUTTON, MAKELPARAM(rect.right - iGap, rect.bottom - iGap));
SendMessage(hTray, WM_LBUTTONUP, 0, MAKELPARAM(rect.right - iGap, rect.bottom - iGap));
//
CloseHandle(hOpen);
break;;
}
}
}
//以下是隐藏在托盘区中的托盘信息,用以上的方法找不到,因为在NotifyIconOverflowWindow里
Fhwnd = FindWindow("NotifyIconOverflowWindow", NULL)
参考文章:http://topic.csdn.net/u/20101003/23/859851ee-5aa1-4476-8ce1-1359826df2b0.html