ASM Community

code is in vb sorry and works on NT machines


code under command1 works fine
but when i click on command2 then it generates an error
and close the Task Manager


'-- -----------------------------------------------------------
'code starts here

Dim hTask, hInner, hTab, hList As Long

Private Sub Timer1_Timer()

hTask = FindWindow("#32770", "Windows task Manager")
hInner = FindWindowEx(hTask, 0, "#32770", vbNullString)
hTab = FindWindowEx(hTask, 0, "SysTabControl32", "Tab1")
hList = FindWindowEx(hInner, 0, "SysListView32", "Tasks")

End Sub

Private Sub Command1_Click()

bret = ListView_DeleteAllItems(hList)

End Sub


Private Sub Command2_Click()

Dim plvfi As LVFINDINFO
Dim bret As Long

bret = ListView_FindItem(hList, -1, plvfi)

End Sub


Private Function ListView_DeleteAllItems(hWnd As Long) As Boolean
ListView_DeleteAllItems = SendMessage(hWnd, LVM_DELETEALLITEMS, 0, 0)
End Function

Private Function ListView_FindItem(hWnd As Long, iStart, plvfi As LVFINDINFO) As Long
ListView_FindItem = SendMessage(hWnd, LVM_FINDITEM, ByVal iStart, plvfi)
End Function

Here you go, I had some free time to play with it...

FindTaskMan FRAME

	uses ebx

	LOCAL hTaskMan :D

	

	; Not sure if TaskMan is localized but this will

	; only find the handle for an English Task Manager



	invoke FindWindow,NULL,"Windows Task Manager"

	or eax,eax

	jnz >

		xor eax,eax

		dec eax

		RET

	:

	mov [hTaskMan],eax



	; Scan each of the tab dialogs in turn until

	; we find the one with the processes listview



	xor ebx,ebx

	F1:

	invoke FindWindowEx,[hTaskMan],ebx,"#32770",NULL

	or eax,eax

	jnz >

		xor eax,eax

		dec eax

		RET

	:

	; Save the dialog handle for the next search

	mov ebx,eax

	; See if our listview is here

	invoke FindWindowEx,eax,NULL,"Syslistview32","Processes"

	or eax,eax

	jz <F1



	RET



ENDF



TaskFindItem FRAME hlv,iStart,pLVFINDINFO

	uses ebx,edi

	LOCAL pMem		:D

	LOCAL PID		:D

	LOCAL hProcess		:D

	LOCAL cbWritten		:D



	mov D[PID],-1

	; Get the PID of the TaskMan from the listview handle

	invoke GetWindowThreadProcessId,[hlv],OFFSET PID

	

	; Open the TaskMan process

	invoke OpenProcess,PROCESS_VM_OPERATION\

		+PROCESS_VM_READ + PROCESS_VM_WRITE,NULL,[PID]

	mov [hProcess],eax

	or eax,eax

	jnz >

		xor eax,eax

		dec eax

		ret

	:



	; Allocate a 4K buffer in the TaskMan's space (4K is the minimum size)

	invoke VirtualAllocEx, eax, NULL, 4096, MEM_COMMIT, PAGE_READWRITE

	mov [pMem],eax

	or eax,eax

	jnz >

		invoke CloseHandle, [hProcess]

		xor eax,eax

		dec eax

		ret

	:



	mov edi,[pLVFINDINFO]

	mov ebx,[edi+LV_FINDINFO.psz]

	; Is this a string search

	mov eax,[edi+LV_FINDINFO.flags]

	test eax,LVFI_STRING

	jz > ; no? then skip the string copy

		; Need the string information

		invoke lstrlen,[edi+LV_FINDINFO.psz]

		inc eax



		mov ecx,[pMem]

		add ecx,256

		mov [edi+LV_FINDINFO.psz],ecx



		; Write the string

		invoke WriteProcessMemory, [hProcess], ecx,\

			 ebx, eax, OFFSET cbWritten

	:



	; Write the structure

	invoke WriteProcessMemory, [hProcess], [pMem],\

		 [pLVFINDINFO], SIZEOF LV_FINDINFO, OFFSET cbWritten



	; Finally we send our message

	invoke SendMessage,[hlv],LVM_FINDITEM,[iStart],[pMem]

	

	; push the result

	push eax



	; Reset the string pointer just in case it is needed elsewhere

	mov [edi+LV_FINDINFO.psz],ebx



	; Clean up the memory and close the process handle

	invoke VirtualFreeEx, [hProcess], [pMem], NULL, MEM_RELEASE

	invoke CloseHandle, [hProcess]

	

	; pop the result

	pop eax

	RET

ENDF

Tried it with this and it works fine :

.data

pSMSS	DB "SMSS.EXE",0

.code

invoke FindTaskMan

mov D[lvfi.flags],LVFI_STRING+LVFI_WRAP

mov D[lvfi.psz],offset pSMSS

mov D[lvfi.vkDirection],VK_DOWN

invoke TaskFindItem,eax,0,offset lvfi

PrintDec(eax)

thx

Sounds pretty fishy to me too. Doing nasty code, sihotaa?