quote:
Originally posted by SmokingCookie
But there's a snake in the grass: CallWindowProc() allows up to four parameters. So I'd think that this will only work for procedures that take exactly four parameters. However, please do correct me if I'm wrong 
Yes and no. It highly depends on how that procedure reads its input data. For all you know the first input 'parameter' of that procedure can actually be a pointer to an array of data (aka parameters). So, in that case you would only need to use 1 parameter of the
CallWindowProc API (the rest is simply ignored).
In real assembler code (which is essentially what you call with this API), parameters as you know it from the common programming languages don't even exist. Input and output data is handled via registers and the stack.
Also, you can call your own small assembler stub/snippet instead, which will take the first parameter of
CallWindowProc, interpret it as a pointer to the other input data, read in and manipulate that data, and put it into the proper registers and stacks and call the procedure you wanted to call in the first place, on its turn (which can then use those registers/stack). This is what "injecting code" often means when you read it somewhere. So, no, there are no limits in what you can do with this.
Bleh, maybe someone with true assembler knowledge can explain it way better. But the point is that if you don't know how much 'parameters' the procedure uses, or you don't know how or where it gets its data from, then you shouldn't be attempting to use the
CallWindowProc API for something like this though, because you will screw things up (bsod and the likes). This is one of those rare things you can not solve with simple trial and error; you need to know exactly what you're doing and know exactly how the procedure works before attempting to call it (reverse engeneering).
quote:
Originally posted by SmokingCookie
Edit: ain't this exactly what SendMessage() does?
Nope, not at all. The
SendMessage API places a value in a window's Message queue which is a special dedicated array so to speak. The SendMessage API is like the array.push() method in JScript (sort of, in a very remote and oversimplified way). It has absolutely nothing to do with calling procedures.
EDIT:
here is an example of using the
CallWindowProc API to call an ASM routine:
Call ASM routine from your script (with example)
/ 
