I've a very intensive Office plugin.
In addition to the standard Office extensability points, I'm hooking many Win32 API such as kernel32!CreateFileW, ole32!StgCreateStorageEx, etc. (I'm using IAT hooking).
However, one issue I haven't been able to solve (although somehow unrliably work arround) is to get a poiner to a Document interface from hwnd.
However, I've noticed that Office (in all programs, in all versions) puts a pointer - probably to an internal object - in the Windows storage at the GWL_USERDATA.
How do I know this is a pointer to object? Because it's first DWORD is a pointer to what looks like a v-table (bunch of addresses, all starts with 'push ebp, move ebp,esp'). Moreover, the first 3 methods of this v-table appears to have IUnknown logic (the first method calls MsoHrSimpleQueryInterface2, the second method does an 'inc' and returns the incremented value, and the 3rd method seems to do the usual Release logic).
And yet, I'm unable to do farther progress. I'm trying various QueryInterface calls to this object, and I'm trying to read the other methods - with no much luck.
I wonder if anyone ever marched on this path with better result?
preguntado el 01 de julio de 12 a las 15:07