ReadProcessMemory function

i just found out that it works to read memory from a 64 bit app by a 32 bit app (at least as long as the high 32bit of the address is zero)

for those who want to get the notify icon rectangle within WinXP64 (i think the function of the subroutines defined by me are clear ennough not to place here)

  

  

  
typedef struct
{
  INT       iBitmap;
  INT       idCommand;
  BYTE      fsState;
  BYTE      fsStyle;
  BYTE      bReserved[6];
  UINT64    dwData;
  UINT64    iString;
  //
} TBBUTTON64;

  

  

  
BOOL _TrayTools_GetSysTrayIconRectTB(HWND in_hClient, INT in_TrayID, RECT *out_Rect)
{
    /* locals */
    INT        lv_N;
    INT        lv_BtnCnt;
    BOOL       lv_Result;
    BOOL       lv_IsWOW64;
    HWND       lv_hNotifyTB;
    VOID      *lv_hProcMem;
    HANDLE     lv_hProcess;
    INT_PTR    lv_UserData[2];
    UINT64     lv_UserData64[2];
    INT        lv_BtnInfoSize;
    TBBUTTON   lv_BtnInfo;
    TBBUTTON64 lv_BtnInfo64;

  

  

  
  // find the toolbar
  if ((lv_hNotifyTB = Shell_GetSysTaskbarNotifyWindowTB()) == NULL)
    return FALSE;

  
  // is this 32bit process running on x64?
  lv_IsWOW64 = Is32BitBuildOnWin64();

  
  // determine size
  if (lv_IsWOW64)
    lv_BtnInfoSize = sizeof(TBBUTTON64);
  else
    lv_BtnInfoSize = sizeof(TBBUTTON);

  
  // allocate button structure in context of explorer process
  if ((lv_hProcMem = AllocProcessHWND(lv_hNotifyTB, lv_BtnInfoSize, &lv_hProcess)) == NULL)
    return FALSE;

  
  // not yet found
  lv_Result = FALSE;

  
  // get number of toolbar buttons
  lv_BtnCnt = SendMessage(lv_hNotifyTB, TB_BUTTONCOUNT, 0,0);

  
  // loop through buttons
  for (lv_N = lv_BtnCnt-1; lv_N >= 0; --lv_N)
  {
    // get button info
    if (SendMessage(lv_hNotifyTB, TB_GETBUTTON, lv_N, (LPARAM)lv_hProcMem))
    {
      // adjust for WOW64?
      if (lv_IsWOW64)
      {
        // get the actual contents
        if (ReadProcess(lv_hProcess, lv_hProcMem, &lv_BtnInfo64, sizeof(TBBUTTON64)))
        {
          // the userdata starts with the attached window and uID (in XP/Vista/Win7)
          if (ReadProcess(lv_hProcess, (VOID*)lv_BtnInfo64.dwData, lv_UserData64, 2*sizeof(UINT64)))
          {
            // compare
            if (lv_UserData64[0] == (UINT64)in_hClient && (lv_UserData64[1]&0xFFFFFFFF) == in_TrayID)
            {
              // got it, not hidden?
              lv_Result = ((lv_BtnInfo64.fsState & TBSTATE_HIDDEN) == 0);

              // loop no further
              break;
            }
          }
        }
      }
      else
      {
        // get the actual contents
        if (ReadProcess(lv_hProcess, lv_hProcMem, &lv_BtnInfo, sizeof(TBBUTTON)))
        {
          // the userdata starts with the attached window and uID (in XP/Vista/Win7)
          if (ReadProcess(lv_hProcess, (VOID*)lv_BtnInfo.dwData, lv_UserData, 2*sizeof(INT_PTR)))
          {
            // compare
            if (lv_UserData[0] == (INT_PTR)in_hClient && lv_UserData[1] == in_TrayID)
            {
              // got it, not hidden?
              lv_Result = ((lv_BtnInfo.fsState & TBSTATE_HIDDEN) == 0);

              // loop no further
              break;
            }
          }
        }
      }
    }
  }

  
  // found the button?
  if (lv_Result)
  {
    // get the item rectangle, reuse processmemory as a RECT is smaller than TBBUTTON
    lv_Result = SendMessage(lv_hNotifyTB, TB_GETITEMRECT, lv_N, (LPARAM)lv_hProcMem);

  
    // get the contents
    if (lv_Result)
      lv_Result = ReadProcess(lv_hProcess, lv_hProcMem, out_Rect, sizeof(RECT));

  
    // to screen coordinates
    if (lv_Result)
      ClientToScreenRect(lv_hNotifyTB, out_Rect);
  }

  
  // free process memory again
  FreeProcess(lv_hProcess, lv_hProcMem, TRUE);

  
  // done
  return lv_Result;
}

If you want to start a 64 bit app. from a 32 bit application for debugging (using DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS flags) then the CreateProcess will fail and GetLastError() function will return code 50 ("The request is not supported."). If the debugger app. is a 64 bit app. and the debuggee app. is a 64 bit app. too then it will work (assuming you have the necessary rights).