var
hProcess, hShellTrayWnd, hTrayNotifyWnd, hSyspager, hToolbarWindow32, hTargetHwnd : THandle;
i : Integer;
tb : _TBBUTTON;
szBuffer : array[0..255] of Char;
dwProcessId, dwNumberOfBytesRead, dwSize : DWORD;
pBase : Pointer;
begin
hShellTrayWnd := FindWindow('Shell_TrayWnd', nil);
hTrayNotifyWnd := FindWindowEx( hShellTrayWnd, 0, 'TrayNotifyWnd', nil );
hSyspager := FindWindowEx( hTrayNotifyWnd, 0, 'Syspager', nil );
hToolbarWindow32 := FindWindowEx( hSyspager, 0, 'ToolbarWindow32', nil );
GetWindowThreadProcessId( hShellTrayWnd, @dwProcessId );
hProcess := OpenProcess( PROCESS_ALL_ACCESS or PROCESS_VM_OPERATION or PROCESS_VM_READ or PROCESS_VM_WRITE, false, dwProcessId );
if( hProcess <> 0 ) then
begin
dwSize := sizeof(_TBBUTTON) + 255;
pBase := VirtualAllocEx( hProcess, nil, dwSize, MEM_COMMIT, PAGE_READWRITE );
for i := 0 to SendMessage( hToolbarWindow32, TB_BUTTONCOUNT, 0, 0 ) - 1 do
begin
if SendMessage( hToolbarWindow32, TB_GETBUTTON, i, LPARAM(pBase) ) <> 0 then
begin
ReadProcessMemory( hProcess, pBase, @tb, sizeof(_TBBUTTON), dwNumberOfBytesRead );
SendMessage( hToolbarWindow32, TB_GETBUTTONTEXT, tb.idCommand, LongInt(pBase) + sizeof(_TBBUTTON) );
// 取得标题
ReadProcessMemory( hProcess, Pointer(LongInt(pBase) + sizeof(_TBBUTTON)), @szBuffer[0], dwSize - sizeof(_TBBUTTON), dwNumberOfBytesRead );
// 取得窗口
ReadProcessMemory( hProcess, Pointer(tb.dwData), @hTargetHwnd, sizeof(THandle), dwNumberOfBytesRead );
//
ShowMessage(szBuffer);
end;
end;
VirtualFree( pBase, dwSize, MEM_RELEASE );
end;
CloseHandle(hProcess);