关于修改外部ListView的问题

Question

procedure TForm1.Button1Click(Sender: TObject);
var
   lvi:TLVITEM;
   chr:pchar='ioriliao';
   s:longint;
begin
   lvi.iSubItem:=0;
   lvi.pszText:=chr;
   //如果我在Edit1.Text里输入的是本程序的ListView的句柄则程序可以正确运行，但输入外部程序的ListView的句柄则程序崩溃，外部程序的句柄是通过spy++获得的。请各位前辈指点。谢谢！
   s:=SendMessage(StrToInt(Edit1.Text),LVM_SETITEMTEXT,0,LongInt(@lvi));
   Edit1.Text:=intToStr(s);
end;  

Answer 1

我使用了内在映射也是不行，代码如下  
procedure TForm1.Button1Click(Sender: TObject);
var
   lvi:TLVITEM;
   chr:pchar;
   s:longint;
   FileMappingHandle:LongWord;
begin
   FileMappingHandle:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,10,'MappingFileName');
   chr:=MapViewOFFile(FileMappingHandle,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
   chr:='ioriliao';
   lvi.iSubItem:=0;
   lvi.pszText:=chr;
   s:=SendMessage(StrToInt(Edit1.Text),LVM_SETITEMTEXT,0,LongInt(@lvi));
   Edit1.Text:=intToStr(s);
end;         

Answer 2

我再改成如下也还是不行。弹出访问冲突的对话框。
procedure TForm1.Button1Click(Sender: TObject);
var
   lvi:PLVITEM;
   chr:pchar;
   s:longint;
   FileMappingHandle:LongWord;
   F:LongWord;
begin
   FileMappingHandle:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,10,'MappingFileName');
   F:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,SizeOf(TLVITEM),'M');
   lvi:=MapViewOFFile(F,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
   chr:=MapViewOFFile(FileMappingHandle,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
   chr:='ioriliao';
   lvi^.iSubItem:=0;
   lvi^.pszText:=chr;
   s:=SendMessage(StrToInt(Edit1.Text),LVM_SETITEMTEXT,0,LongInt(lvi));
   Edit1.Text:=intToStr(s);
end; 

Answer 3

外部的让你那么轻易的搞了，windows还有什么安全可言……

Answer 4

我又使用了Dll的方式也不行。如下
DLL代码library Unit1;{$mode delphi}{$H+}uses
  Classes, Unit2
  { you can add units after this };{$IFDEF WINDOWS}{$R Unit1.rc}{$ENDIF}
exports
       start;
begin
end. 
unit Unit2; {$mode delphi}{$H+}interfaceuses
  Classes, SysUtils,Windows,Messages;
  function start(hwnd:LongWord):LongInt;stdcall;
  var
  lvi:PLVITEM;
  chr:pchar;
  s:longint;
  FileMappingHandle:LongWord;
  F:LongWord;
implementation
  function start(hwnd:LongWord):LongInt;stdcall;  begin
      FileMappingHandle:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,10,'MappingFileName');
      F:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,SizeOf(TLVITEM),'M');
      lvi:=MapViewOFFile(F,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
      chr:=MapViewOFFile(FileMappingHandle,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
      chr:='ioriliao';
      lvi^.iSubItem:=0;
      lvi^.pszText:=chr;
      s:=SendMessage(hwnd,LVM_SETITEMTEXT,0,LongInt(lvi));
      //s:=SendMessage(hwnd,WM_SETTEXT,0,LongInt(chr));
      result:=s;
      CloseHandle(FileMappingHandle);
      CloseHandle(F);
  end;end.使用DLL的代码unit Unit1; {$mode delphi}{$H+}interfaceuses
  Windows,Messages,Classes, SysUtils, FileUtil, LResources, Forms, Controls, Graphics, Dialogs,
  StdCtrls, ComCtrls;type  { TForm1 }  TForm1 = class(TForm)
    Button1: TButton;
    Edit1: TEdit;
    ListView1: TListView;
    procedure Button1Click(Sender: TObject);
  private
    { private declarations }
  public
    { public declarations }
  end; var
  Form1: TForm1; implementation
function start(hwnd:LongWord):LongInt;stdcall;external 'Unit1.dll';
{ TForm1 }procedure TForm1.Button1Click(Sender: TObject);
{var
   lvi:PLVITEM;
   chr:pchar;
   s:longint;
   FileMappingHandle:LongWord;
   F:LongWord;}
begin
     edit1.Text:=IntToStr(start(StrToInt(edit1.Text)));
   {FileMappingHandle:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,10,'MappingFileName');
   F:=CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,SizeOf(TLVITEM),'M');
   lvi:=MapViewOFFile(F,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
   chr:=MapViewOFFile(FileMappingHandle,FILE_MAP_READ or FILE_MAP_WRITE,0,0,0);
   chr:='ioriliao';
   lvi^.iSubItem:=0;
   lvi^.pszText:=chr;
   s:=SendMessage(StrToInt(Edit1.Text),LVM_SETITEMTEXT,0,LongInt(lvi));
   Edit1.Text:=intToStr(s);
   CloseHandle(FileMappingHandle);
   CloseHandle(F);}
end;initialization
  {$I Unit1.lrs}end.    

Answer 5

八九不离十了，拿去调试吧
var
  hProcess : THandle;
begin hProcess := OpenProcess(PROCESS_VM_OPERATION
                                         or PROCESS_VM_READ
                                         or PROCESS_VM_WRITE
                                         or PROCESS_QUERY_INFORMATION,
                                       False,
                                       进程ID);  pText := VirtualAllocEx(hProcess, nil, 512, MEM_COMMIT, PAGE_READWRITE);
  pText := 'test';
  ListView_SetItemText(窗口句柄, 0, 0, pText);  VirtualFreeEx(hProcess, pText,0, MEM_RELEASE);  CloseHandle(hProcess );
end;

Answer 6

//////////////////////////////////////////////////////////////////////////////////
/*
 * Send LVM_SETITEMTEXT
 * 版权所有 (C) 2005 天津 赵春生
 * 2005.10.28
 * http://timw.yeah.net
 * http://timw.126.com
 * 本程序适用于:Win2KP+SP4[Windows TaskManager(5.0.2195.6620)]
 *  WinXP+SP1[Windows TaskManager]
 * 代码在Win2000P+SP4 + VC6+SP6测试通过
*/
//////////////////////////////////////////////////////////////////////////////////#include<windows.h>
#include<commctrl.h>int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
 
{
HWND hwnd;
int iItem=0;
LVITEM lvitem, *plvitem;
DWORD PID;
HANDLE hProcess;
char *p_MyItemText;//目标程序中用来存放TEXT的地址 //The pszText member is the pointer to a null-terminated
//  string containing the new text; it can also be NULL.
//以上信息是从API手册中获得的，故在本例中字符串长度不能>=12，
//以确保字符串后有NULL。
char str_MyItemText[12]={0};
strcpy(str_MyItemText,"天津 赵春生");


hwnd=FindWindow("#32770","Windows 任务管理器");
hwnd=FindWindowEx(hwnd,0,"#32770",0);
hwnd=FindWindowEx(hwnd,0,"SysListView32",0); if (!hwnd)
MessageBox(NULL,"[Windows 任务管理器] 尚未启动！","错误！",NULL);
else
{
GetWindowThreadProcessId(hwnd, &PID);

hProcess=OpenProcess(PROCESS_ALL_ACCESS,false,PID);
if (!hProcess)
MessageBox(NULL,"获取进程句柄操作失败！","错误！",NULL);
else
{
plvitem=(LVITEM*)VirtualAllocEx(hProcess, NULL, sizeof(LVITEM), MEM_COMMIT, PAGE_READWRITE);
p_MyItemText=(char*)VirtualAllocEx(hProcess, NULL, 12, MEM_COMMIT, PAGE_READWRITE); if ((!plvitem)||(!p_MyItemText))
MessageBox(NULL,"无法分配内存！","错误！",NULL);
else
{
MessageBox(NULL,"本演示程序将更改TaskManager中第6个项目中第1列的内容。","提示",NULL);

iItem=5;//5在这里是第六个（从零开始）
lvitem.iSubItem=0;//同上
lvitem.pszText=p_MyItemText;

WriteProcessMemory(hProcess, p_MyItemText, &str_MyItemText, 12, NULL);
WriteProcessMemory(hProcess, plvitem, &lvitem, sizeof(LVITEM), NULL);
//向目标程序发送LVM_SETITEMTEXT消息
SendMessage(hwnd, LVM_SETITEMTEXT, (WPARAM)iItem, (LPARAM)plvitem);
}
}
}

//释放内存
CloseHandle(hwnd);
CloseHandle(hProcess);
VirtualFreeEx(hProcess, plvitem, 0, MEM_RELEASE);
VirtualFreeEx(hProcess, p_MyItemText, 0, MEM_RELEASE);

return 0;
}三、以上代码在Win2000P+SP4 + VC6+SP6测试通过。具体源码可在
http://www.vckbase.com/document/viewdoc/?id=1556
下载，