How to pull out the pointer to the window in the intercepted EnumWindows function?

Question

C++ / C#

Hook on EnumWindows

//hook.h 
typedef BOOL(WINAPI *PNT_ENUMWINDOWS)(
  _In_ WNDENUMPROC lpEnumFunc,
  _In_ LPARAM      lParam
);

//hook.cpp 
PNT_ENUMWINDOWS TrueEnumWindows = (PNT_ENUMWINDOWS)::GetProcAddress(::GetModuleHandle(L"user32"), "EnumWindows");

BOOL WINAPI FalseEnumWindows(
    _In_ WNDENUMPROC lpEnumFunc,
    _In_ LPARAM      lParam
)
{
    // Если lParam содержит нужные данные, обработать их
    BOOL result = TrueEnumWindows(lpEnumFunc, lParam);
    return result;
}

As I understand it, lpEnumFunc is just a pointer to a custom callback function, and all data passed to it is encoded in lParam. How can you get them out of there?

Answer 1

As I understand it, lpEnumFunc is just a pointer to a custom callback function, and all data passed to it is encoded in lParam

You misunderstand. lParam is not all data, but only what the user wanted to transfer. lpEnumFunc has the following prototype:

BOOL CALLBACK EnumWindowsProc(
  _In_ HWND   hwnd,
  _In_ LPARAM lParam
);

and hwnd is passed to it by the EnumWindows function itself. Accordingly, to get hwnd you need to do something like this:

struct enumWindowsParams {
    WNDENUMPROC lpEnumProc;
    LPARAM lParam;
};

BOOL CALLBACK myEnumFunc(
  _In_ HWND   hwnd,
  _In_ LPARAM lParam
)
{
    // use hwnd as needed
    struct enumWindowsParams *ewp = (struct enumWindowsParams *)lParam;
    return ewp->lpEnumProc(hwnd, ewp->lParam);
}

BOOL WINAPI FalseEnumWindows(
    _In_ WNDENUMPROC lpEnumFunc,
    _In_ LPARAM      lParam
)
{
    struct enumWindowsParams ewp;
    ewp.lpEnumFunc= lpEnumFunc;
    ewp.lParam = lParam;
    BOOL result = TrueEnumWindows(myEnumFunc, (LPARAM)&ewp);
    return result;
}

Answer 2

You need to know what is encoded there.
Usually it is a pointer to some structure.
And why not:
PNT_ENUMWINDOWS TrueEnumWindows = ::EnumWindows;
?
Are you using /DEFAULTLIB for the build?