Hacking Winamp... well not really

<Technobabble>
I've posted a small description of my creation on the Winamp forums, and I will duplicate it here, for I see no reason to reformulate what I've already written.

---

I was trying to get a program to retrieve the current track name from Winamp. To my disappointment, the IPC messages are divided in general-use and in-process messages. My first through was that I would have to go through the hassle of writing a general plugin, just for getting the track name!

However, there's another solution. Fortunately, Windows (NT+ definitely, not sure about 9x) allows you to read other processes' memory without having to inject a DLL in them. Later realizing that Winamp (probably) returns a static buffer from IPC_GETPLAYLISTTITLE relieved me, because that meant the lifetime of the buffer was rather long.

(For conciseness in my blog, you will need to click on the following link to see the actual code.)

HWND hwndWinamp;
UINT nPlaylistPosition;
DWORD dwPID, dwRead;
HANDLE hWinamp;
LPCSTR pcszTitle;
char szTitle[4096];

// find Winamp's main window
if(!(hwndWinamp = FindWindow(_T("Winamp v1.x"), NULL)))
 return;

// get the current (zero-based) playlist position
nPlaylistPosition = SendMessage(hwndWinamp, WM_WA_IPC, 0, IPC_GETLISTPOS);

// find Winamp's process ID
GetWindowThreadProcessId(hwndWinamp, &dwPID);

// ask Windows to allow us to read from Winamp's memory
if(!(hWinamp = OpenProcess(PROCESS_VM_READ, FALSE, dwPID)))
 return;

// get a pointer (in Winamp's memory map) to the entry title
pcszTitle = (LPCSTR)SendMessage(hwndWinamp, WM_WA_IPC, nPlaylistPosition, IPC_GETPLAYLISTTITLE);

// copy from Winamp's memory into ours
if(!ReadProcessMemory(hWinamp, pcszTitle, szTitle, sizeof(szTitle), &dwRead))
{
 CloseHandle(hWinamp);
 return;
}

// clean up as soon as possible
CloseHandle(hWinamp);

// check that something was copied
if(!dwRead)
 return;

// null-terminate the buffer, to be on the safe side
szTitle[dwRead - 1] = '\0';

...this general technique can be applied for most, if not all, "in-process" IPCs. For the messages that require you to pass a pointer to some data (ex. IPC_SETSKIN), one can use VirtualAllocEx to allocate memory in Winamp's process, and then WriteProcessMemory to transfer the data. The message can then be sent, and the memory can finally be freed with VirtualFreeEx. The downside is that VirtualAlloc/FreeEx are only supported in Windows NT and later.
</Technobabble>