How can I get the text of another process’ window?

As you’ve probably found out by now, calling GetWindowText() won’t work most of the time. The reason for this is that GetWindowText() won’t do the necessary translation between the address spaces of the two processes. This is required because address that the calling process passes to GetWindowText() in the lpString parameter is not valid in the address space of the target process, so some translation is required.

However, there is one way to get around it, and that is sending a WM_GETTEXT message to the target window. Now you might be wondering how this could work, if, after all, GetWindowText() sends a WM_GETTEXT message as part of its implementation.

The answer is that Windows treats some messages differently when they are sent directly across process boundaries, and provides support for address translation (which is not a translation at all. Windows uses memory mapped files to accomplish the copy). WM_GETTEXT is one of those, as are WM_SETTEXT and WM_COPYDATA.

Keep in mind, however, that this will not work for all windows, for the simple reason that they do not store their text using WM_SETTEXT and use their own buffers for it, but don’t handle the WM_GETTEXT message appropriately.

Finally, note that GetWindowText() will work under some circumstances, namely, when the target window passes WM_SETTEXT messages to DefWindowProc(). In this case, Windows holds the window text itself in internal structures, which happens to be saved in memory shared by all processes (a memory-mapped file), so GetWindowText() will retrieve the text directly, without needing to go across process boundaries.