BitBlt

Hello,

I have a program that loads a DLL into a remote process and hooks the "BitBlt" function. Now the problem's as follows; I'm attempting to get the coordinates of where a certain device context is copied into on the on-screen one, but all my logs of the invocations to the "BitBlt" function show that both, the source and the destination coordinates are the same. It seems as if the targeted application double buffers each device context (which I find quite strange, to be honest), but assumedly, the process should then at some point copy it onto the "absolute" HDC (relative to the window's client area). I've truncated the logs to show only the HDCs I'm interested in (which is identified by a certain width and height):

Code:

[BEGIN PAINT] <blah blah> [ HDC[1140922105] -> HDC[251729776] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[251729776] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[268506992] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[268506992] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[285284208] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[285284208] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[302061424] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[302061424] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[318838640] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[318838640] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[335615856] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[335615856] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[352393072] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[352393072] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[369170288] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[369170288] -> HDC[1140922105] ]src: 0, 0 dest: 0, 0 width: 93, 30 (or 93, 30) [ HDC[1140922105] -> HDC[-1996417122] ]src: 0, 0 dest: 0, 0 width: 790, 429 (or 790, 429) [END PAINT]

As you can see, it's quite strange. The program copies the HDC into another one and then copies it back into it. Then, the last log entry is it copying the assumed off-screen device context to the on-screen one.

And yes, I'm invalidating the complete window area so a full repaint is necessary.

I've also checked for calls to "SelectClipRgn", but none are outputted in the selected window (they are however in another window created by the process, but I'm not interested in that one).

Here is the function import list in alphabetical order:

Quote:

user32.ActivateKeyboardLayout
user32.AdjustWindowRectEx
msimg32.AlphaBlend
kernel32.Beep
user32.BeginDeferWindowPos
user32.BeginPaint
gdi32.BitBlt
user32.CallNextHookEx
user32.CallWindowProcA
user32.CallWindowProcW
user32.CharLowerA
user32.CharLowerBuffA
user32.CharNextA
user32.CharNextA
user32.CharToOemA
user32.CharUpperA
user32.CharUpperBuffA
user32.CharUpperBuffW
user32.CharUpperW
user32.CheckMenuItem
user32.ChildWindowFromPoint
user32.ClientToScreen
user32.CloseClipboard
gdi32.CloseEnhMetaFile
kernel32.CloseHandle
winspool.ClosePrinter
ole32.CLSIDFromString
ole32.CoCreateGuid
ole32.CoCreateGuid
ole32.CoCreateInstance
ole32.CoGetClassObject
ole32.CoInitialize
kernel32.CompareStringA
kernel32.CompareStringW
gdi32.CopyEnhMetaFileA
kernel32.CopyFileA
ole32.CoRegisterClassObject
ole32.CoTaskMemAlloc
ole32.CoTaskMemFree
ole32.CoTaskMemFree
ole32.CoUninitialize
gdi32.CreateBitmap
gdi32.CreateBrushIndirect
gdi32.CreateCompatibleBitmap
gdi32.CreateCompatibleDC
gdi32.CreateDCA
gdi32.CreateDIBitmap
gdi32.CreateDIBSection
kernel32.CreateDirectoryA
gdi32.CreateEnhMetaFileA
oleaut32.CreateErrorInfo
kernel32.CreateEventA
kernel32.CreateFileA
kernel32.CreateFileW
gdi32.CreateFontIndirectA
gdi32.CreateHalftonePalette
gdi32.CreateICA
user32.CreateIcon
user32.CreateMDIWindowW
user32.CreateMenu
kernel32.CreateMutexA
gdi32.CreatePalette
gdi32.CreatePen
gdi32.CreatePenIndirect
user32.CreatePopupMenu
kernel32.CreateProcessA
gdi32.CreateRectRgnIndirect
gdi32.CreateSolidBrush
ole32.CreateStreamOnHGlobal
kernel32.CreateThread
kernel32.CreateThread
user32.CreateWindowExA
user32.CreateWindowExW
user32.DeferWindowPos
user32.DefFrameProcA
user32.DefFrameProcW
user32.DefMDIChildProcA
user32.DefMDIChildProcW
user32.DefWindowProcA
user32.DefWindowProcW
kernel32.DeleteCriticalSection
kernel32.DeleteCriticalSection
gdi32.DeleteDC
gdi32.DeleteEnhMetaFile
kernel32.DeleteFileA
user32.DeleteMenu
gdi32.DeleteObject
user32.DestroyCursor
user32.DestroyIcon
user32.DestroyMenu
user32.DestroyWindow
kernel32.DeviceIoControl
user32.DispatchMessageA
user32.DispatchMessageW
winspool.DocumentPropertiesA
kernel32.DosDateTimeToFileTime
user32.DrawEdge
user32.DrawFocusRect
user32.DrawFrameControl
user32.DrawIcon
user32.DrawIconEx
user32.DrawMenuBar
user32.DrawTextA
user32.DrawTextW
gdi32.Ellipse
user32.EmptyClipboard
user32.EnableMenuItem
user32.EnableScrollBar
user32.EnableWindow
user32.EndDeferWindowPos
gdi32.EndDoc
gdi32.EndPage
user32.EndPaint
kernel32.EnterCriticalSection
kernel32.EnterCriticalSection
kernel32.EnumCalendarInfoA
user32.EnumClipboardFormats
user32.EnumDisplayDevicesW
user32.EnumDisplaySettingsW
winspool.EnumPrintersA
user32.EnumThreadWindows
user32.EnumWindows
user32.EqualRect
gdi32.ExcludeClipRect
kernel32.ExitProcess
kernel32.ExitThread
gdi32.ExtTextOutA
gdi32.ExtTextOutW
kernel32.FileTimeToDosDateTime
kernel32.FileTimeToLocalFileTime
kernel32.FileTimeToSystemTime
user32.FillRect
kernel32.FindClose
kernel32.FindClose
kernel32.FindFirstFileA
kernel32.FindFirstFileA
kernel32.FindFirstFileW
kernel32.FindNextFileA
kernel32.FindResourceA
user32.FindWindowA
user32.FlashWindow
user32.FlashWindowEx
kernel32.FormatMessageA
kernel32.FormatMessageW
user32.FrameRect
kernel32.FreeLibrary
kernel32.FreeLibrary
kernel32.FreeResource
gdi32.GdiFlush
kernel32.GetACP
oleaut32.GetActiveObject
user32.GetActiveWindow
gdi32.GetBitmapBits
gdi32.GetBrushOrgEx
user32.GetCapture
user32.GetClassInfoA
user32.GetClassInfoW
user32.GetClassNameA
user32.GetClassNameW
user32.GetClientRect
user32.GetClipboardData
gdi32.GetClipBox
kernel32.GetCommandLineA
kernel32.GetCommandLineW
kernel32.GetComputerNameA
kernel32.GetComputerNameW
kernel32.GetCPInfo
kernel32.GetCurrentDirectoryA
gdi32.GetCurrentPositionEx
kernel32.GetCurrentProcessId
kernel32.GetCurrentThreadId
kernel32.GetCurrentThreadId
user32.GetCursor
user32.GetCursorPos
kernel32.GetDateFormatA
user32.GetDC
user32.GetDCEx
gdi32.GetDCOrgEx
user32.GetDesktopWindow
gdi32.GetDeviceCaps
gdi32.GetDIBColorTable
gdi32.GetDIBits
kernel32.GetDiskFreeSpaceA
user32.GetDlgItem
gdi32.GetEnhMetaFileBits
gdi32.GetEnhMetaFileDescriptionA
gdi32.GetEnhMetaFileHeader
gdi32.GetEnhMetaFilePaletteEntries
kernel32.GetEnvironmentVariableA
oleaut32.GetErrorInfo
kernel32.GetExitCodeProcess
kernel32.GetExitCodeThread
kernel32.GetFileAttributesA
kernel32.GetFileAttributesExA
kernel32.GetFileAttributesW
kernel32.GetFileSize
kernel32.GetFileTime
version.GetFileVersionInfoA
version.GetFileVersionInfoSizeA
user32.GetFocus
user32.GetForegroundWindow
kernel32.GetFullPathNameA
kernel32.GetFullPathNameW
wsock32.gethostbyname
wsock32.gethostname
user32.GetIconInfo
user32.GetKeyboardLayout
user32.GetKeyboardLayoutList
user32.GetKeyboardState
user32.GetKeyboardType
user32.GetKeyNameTextA
user32.GetKeyNameTextW
user32.GetKeyState
user32.GetLastActivePopup
kernel32.GetLastError
kernel32.GetLastError
kernel32.GetLocaleInfoA
kernel32.GetLocaleInfoA
kernel32.GetLocalTime
user32.GetMenu
user32.GetMenuItemCount
user32.GetMenuItemID
user32.GetMenuItemInfoA
user32.GetMenuItemInfoW
user32.GetMenuState
user32.GetMenuStringA
user32.GetMenuStringW
user32.GetMessagePos
user32.GetMessageTime
kernel32.GetModuleFileNameA
kernel32.GetModuleFileNameA
kernel32.GetModuleFileNameW
kernel32.GetModuleHandleA
kernel32.GetModuleHandleA
kernel32.GetModuleHandleA
gdi32.GetNearestPaletteIndex
gdi32.GetObjectA
comdlg32.GetOpenFileNameA
gdi32.GetPaletteEntries
user32.GetParent
gdi32.GetPixel
kernel32.GetPrivateProfileStringA
kernel32.GetProcAddress
kernel32.GetProcAddress
kernel32.GetProfileStringA
user32.GetPropA
comdlg32.GetSaveFileNameA
user32.GetScrollInfo
user32.GetScrollPos
user32.GetScrollRange
kernel32.GetStartupInfoA
kernel32.GetStdHandle
kernel32.GetStdHandle
gdi32.GetStockObject
kernel32.GetStringTypeExA
kernel32.GetStringTypeExW
user32.GetSubMenu
user32.GetSysColor
user32.GetSysColorBrush
kernel32.GetSystemDirectoryA
kernel32.GetSystemInfo
user32.GetSystemMenu
user32.GetSystemMetrics
gdi32.GetSystemPaletteEntries
kernel32.GetSystemTime
kernel32.GetTempFileNameA
kernel32.GetTempPathA
gdi32.GetTextExtentPoint32A
gdi32.GetTextExtentPoint32W
gdi32.GetTextExtentPointA
gdi32.GetTextExtentPointW
gdi32.GetTextMetricsA
kernel32.GetThreadLocale
kernel32.GetThreadLocale
kernel32.GetTickCount
kernel32.GetTickCount
kernel32.GetTimeZoneInformation
user32.GetTopWindow
user32.GetUpdateRect
kernel32.GetUserDefaultLCID
kernel32.GetVersion
kernel32.GetVersion
kernel32.GetVersionExA
kernel32.GetVolumeInformationA
kernel32.GetVolumeInformationW
user32.GetWindow
user32.GetWindowDC
user32.GetWindowLongA
user32.GetWindowLongW
gdi32.GetWindowOrgEx
user32.GetWindowPlacement
user32.GetWindowRect
user32.GetWindowTextA
user32.GetWindowTextLengthA
user32.GetWindowTextLengthW
user32.GetWindowTextW
user32.GetWindowThreadProcessId
gdi32.GetWinMetaFileBits
kernel32.GlobalAddAtomA
kernel32.GlobalAlloc
kernel32.GlobalDeleteAtom
kernel32.GlobalFindAtomA
kernel32.GlobalFree
kernel32.GlobalHandle
kernel32.GlobalLock
kernel32.GlobalMemoryStatus
kernel32.GlobalReAlloc
kernel32.GlobalSize
kernel32.GlobalUnlock
wininet.HttpOpenRequestA
wininet.HttpQueryInfoA
wininet.HttpSendRequestA
comctl32.ImageList_Add
comctl32.ImageList_BeginDrag
comctl32.ImageList_Create
comctl32.ImageList_Destroy
comctl32.ImageList_DragEnter
comctl32.ImageList_DragLeave
comctl32.ImageList_DragMove
comctl32.ImageList_DragShowNolock
comctl32.ImageList_Draw
comctl32.ImageList_DrawEx
comctl32.ImageList_EndDrag
comctl32.ImageList_GetBkColor
comctl32.ImageList_GetDragImage
comctl32.ImageList_GetIconSize
comctl32.ImageList_GetImageCount
comctl32.ImageList_Read
comctl32.ImageList_Remove
comctl32.ImageList_Replace
comctl32.ImageList_ReplaceIcon
comctl32.ImageList_SetBkColor
comctl32.ImageList_SetDragCursorImage
comctl32.ImageList_SetIconSize
comctl32.ImageList_Write
wsock32.inet_ntoa
user32.InflateRect
comctl32.InitCommonControls
kernel32.InitializeCriticalSection
kernel32.InitializeCriticalSection
user32.InsertMenuA
user32.InsertMenuItemA
kernel32.InterlockedDecrement
kernel32.InterlockedDecrement
kernel32.InterlockedExchange
kernel32.InterlockedIncrement
kernel32.InterlockedIncrement
wininet.InternetCloseHandle
wininet.InternetConnectA
wininet.InternetOpenA
wininet.InternetOpenUrlA
wininet.InternetQueryDataAvailable
wininet.InternetQueryOptionA
wininet.InternetReadFile
wininet.InternetSetOptionA
wininet.InternetTimeFromSystemTime
wininet.InternetTimeToSystemTime
gdi32.IntersectClipRect
user32.IntersectRect
user32.InvalidateRect
ole32.IsAccelerator
user32.IsChild
user32.IsClipboardFormatAvailable
kernel32.IsDebuggerPresent
user32.IsDialogMessageA
user32.IsDialogMessageW
ole32.IsEqualGUID
user32.IsIconic
user32.IsRectEmpty
kernel32.IsValidLocale
user32.IsWindow
user32.IsWindowEnabled
user32.IsWindowUnicode
user32.IsWindowVisible
user32.IsZoomed
user32.KillTimer
kernel32.LeaveCriticalSection
kernel32.LeaveCriticalSection
gdi32.LineTo
user32.LoadBitmapA
user32.LoadCursorA
user32.LoadIconA
user32.LoadKeyboardLayoutA
kernel32.LoadLibraryA
kernel32.LoadLibraryExA
kernel32.LoadLibraryW
kernel32.LoadResource
user32.LoadStringA
user32.LoadStringA
user32.LoadStringW
oleaut32.LoadTypeLib
kernel32.LocalAlloc
kernel32.LocalAlloc
kernel32.LocalFileTimeToFileTime
kernel32.LocalFree
kernel32.LockResource
kernel32.lstrcmpA
kernel32.lstrcmpW
kernel32.lstrcpyA
kernel32.lstrcpynA
kernel32.lstrlenA
kernel32.lstrlenA
user32.MapVirtualKeyA
user32.MapVirtualKeyW
user32.MapWindowPoints
gdi32.MaskBlt
winmm.mciGetErrorStringA
winmm.mciSendStringA
user32.MessageBeep
user32.MessageBoxA
user32.MessageBoxA
user32.MessageBoxW
<ModuleEntryPoint>
kernel32.MoveFileA
gdi32.MoveToEx
user32.MsgWaitForMultipleObjects
kernel32.MulDiv
kernel32.MultiByteToWideChar
kernel32.MultiByteToWideChar
user32.OemToCharA
user32.OffsetRect
ole32.OleDraw
ole32.OleInitialize
ole32.OleSetMenuDescriptor
ole32.OleUninitialize
user32.OpenClipboard
winspool.OpenPrinterA
kernel32.OpenProcess
kernel32.OutputDebugStringA
gdi32.PatBlt
user32.PeekMessageA
gdi32.PlayEnhMetaFile
gdi32.Polygon
gdi32.Polyline
user32.PostMessageA
user32.PostMessageW
user32.PostQuitMessage
user32.PostThreadMessageA
ole32.ProgIDFromCLSID
user32.PtInRect
kernel32.QueryPerformanceCounter
kernel32.QueryPerformanceCounter
kernel32.QueryPerformanceFrequency
kernel32.RaiseException
kernel32.ReadFile
gdi32.RealizePalette
gdi32.Rectangle
gdi32.RectVisible
user32.RedrawWindow
advapi32.RegCloseKey
advapi32.RegCloseKey
advapi32.RegCreateKeyExA
advapi32.RegDeleteKeyA
advapi32.RegDeleteValueA
advapi32.RegEnumKeyExA
advapi32.RegFlushKey
user32.RegisterClassA
user32.RegisterClassW
user32.RegisterClipboardFormatA
oleaut32.RegisterTypeLib
user32.RegisterWindowMessageA
advapi32.RegOpenKeyExA
advapi32.RegOpenKeyExA
advapi32.RegQueryInfoKeyA
advapi32.RegQueryValueExA
advapi32.RegQueryValueExA
advapi32.RegSetValueExA
user32.ReleaseCapture
user32.ReleaseDC
kernel32.ReleaseMutex
kernel32.RemoveDirectoryA
user32.RemoveMenu
user32.RemovePropA
kernel32.ResetEvent
gdi32.RestoreDC
kernel32.ResumeThread
gdi32.RoundRect
kernel32.RtlUnwind
oleaut32.SafeArrayAccessData
oleaut32.SafeArrayCreate
oleaut32.SafeArrayGetLBound
oleaut32.SafeArrayGetUBound
oleaut32.SafeArrayPtrOfIndex
oleaut32.SafeArrayPutElement
oleaut32.SafeArrayUnaccessData
gdi32.SaveDC
user32.ScreenToClient
user32.ScrollWindow
gdi32.SelectClipRgn
gdi32.SelectObject
gdi32.SelectPalette
user32.SendMessageA
user32.SendMessageW
gdi32.SetAbortProc
user32.SetActiveWindow
gdi32.SetBkColor
gdi32.SetBkMode
gdi32.SetBrushOrgEx
user32.SetCapture
user32.SetClassLongA
user32.SetClipboardData
kernel32.SetCurrentDirectoryA
user32.SetCursor
gdi32.SetDIBColorTable
kernel32.SetEndOfFile
gdi32.SetEnhMetaFileBits
oleaut32.SetErrorInfo
kernel32.SetErrorMode
kernel32.SetEvent
kernel32.SetFileAttributesA
kernel32.SetFilePointer
kernel32.SetFileTime
user32.SetFocus
user32.SetForegroundWindow
kernel32.SetLastError
gdi32.SetMapMode
user32.SetMenu
user32.SetMenuItemInfoA
user32.SetMenuItemInfoW
user32.SetParent
gdi32.SetPixel
user32.SetPropA
user32.SetRect
gdi32.SetROP2
user32.SetScrollInfo
user32.SetScrollPos
user32.SetScrollRange
wsock32.setsockopt
gdi32.SetStretchBltMode
gdi32.SetTextColor
kernel32.SetThreadLocale
user32.SetTimer
gdi32.SetViewportOrgEx
user32.SetWindowLongA
user32.SetWindowLongW
gdi32.SetWindowOrgEx
user32.SetWindowPlacement
user32.SetWindowPos
user32.SetWindowsHookExA
user32.SetWindowsHookExW
user32.SetWindowTextA
user32.SetWindowTextW
gdi32.SetWinMetaFileBits
shell32.SHBrowseForFolderA
shell32.ShellExecuteA
shell32.ShellExecuteW
shell32.SHGetDesktopFolder
shell32.SHGetMalloc
shell32.SHGetPathFromIDListA
user32.ShowCursor
user32.ShowOwnedPopups
user32.ShowScrollBar
user32.ShowWindow
kernel32.SizeofResource
kernel32.Sleep
kernel32.Sleep
gdi32.StartDocA
gdi32.StartPage
gdi32.StretchBlt
gdi32.StretchDIBits
ole32.StringFromCLSID
ole32.StringFromCLSID
oleaut32.SysAllocStringLen
oleaut32.SysFreeString
oleaut32.SysFreeString
oleaut32.SysReAllocStringLen
user32.SystemParametersInfoA
kernel32.SystemTimeToFileTime
winmm.timeGetTime
kernel32.TlsGetValue
kernel32.TlsSetValue
user32.TrackPopupMenu
user32.TranslateMDISysAccel
user32.TranslateMessage
kernel32.UnhandledExceptionFilter
user32.UnhookWindowsHookEx
gdi32.UnrealizeObject
user32.UnregisterClassA
user32.UnregisterClassW
user32.UpdateWindow
user32.ValidateRect
oleaut32.VariantChangeType
oleaut32.VariantClear
oleaut32.VariantCopy
oleaut32.VariantCopyInd
oleaut32.VariantInit
version.VerQueryValueA
kernel32.VirtualAlloc
kernel32.VirtualAlloc
kernel32.VirtualFree
kernel32.VirtualProtect
kernel32.VirtualQuery
kernel32.VirtualQuery
user32.WaitForInputIdle
kernel32.WaitForSingleObject
user32.WaitMessage
winmm.waveOutGetDevCapsA
winmm.waveOutGetNumDevs
kernel32.WideCharToMultiByte
kernel32.WideCharToMultiByte
user32.WindowFromPoint
kernel32.WinExec
user32.WinHelpA
kernel32.WriteFile
kernel32.WriteFile
kernel32.WritePrivateProfileStringA
wsock32.WSACleanup
wsock32.WSAStartup

I've basically checked any other pixel transfer method used on that list and they aren't the one to copy the HDCs I'm targetting.

Any ideas would be appreciated.

The source and dest coordinates are for the upper left corner of each. Without showing your call to BitBlt I have no idea what you pass.

Quote:

Originally Posted by DaveH

The source and dest coordinates are for the upper left corner of each. Without showing your call to BitBlt I have no idea what you pass.

I know that..

I think you completely missed the point. The BitBlt calls aren't originating from my window, they are originating from a window pertaining to an external process which I injected a DLL in. I hook BitBlt, which is how I'm receiving these calls. Now, the "components" I'm trying to identify each have their own HDC. I'm attempting to track down the call where they are copied to the actual window's device context. But as you can see from the logs, the only device contexts copied are the component's into what appears to be their respective off-screen buffers (since the destination coordinates are at 0, 0, when they should be more a long the lines of the center of the window or so).

Let me be a bit clearer. Take this image as a representation of the window that's invoking these BitBlt calls.
http://i.imgur.com/vbRtN.png
For some reason, I can't find the call that copies the component HDC into the window's one.

Looks like the BitBlt() is coping to a back buffer, performing some operation (merge, invert, save) and then coping the result back to the source.

As expected the coords on the destination DC are (0,0) and (width, height).

Not many apps ever copy the whole DC in a paint, they only re-draw the minimum required region of the client area (ie only the invalidated client area) to increase speed.

Before we go any futher, exactly why do you need to hook BitBlt()?

Quote:

Originally Posted by novacain

Looks like the BitBlt() is coping to a back buffer, performing some operation (merge, invert, save) and then coping the result back to the source.

As expected the coords on the destination DC are (0,0) and (width, height).

Not many apps ever copy the whole DC in a paint, they only re-draw the minimum required region of the client area (ie only the invalidated client area) to increase speed.

Before we go any futher, exactly why do you need to hook BitBlt()?

Yeah, I was guessing that. Now, recall that I invalidate the whole window right after I hook this function, so it does perform a full paint.

The reason I want to hook BitBlt is because I'm trying to obtain some text via hooking ExtTextOut, but the x/y coords are at 0,0. So I cache the HDC used to draw the string I'm targeting and then compare it with the 'srcHDC' passed to the BitBlt function. No results are found however, other than those back-buffering methods. I know it must use some other pixel copying method, but I've already checked all of the following to no avail:
- AlphaBlend
- MaskBlt
- PlgBlt
- SetDIBColorTable
- SetPixel
- StretchBlt
- StrecthDIBits

I've also checked functions like SelectClipRgn, etc. Any other ideas?

Why cant you use some other IPC method?

Why hack the system DLLs?

BTW you invalidated the client area, not the non client area (I assume these are control DCs based on the size).

Quote:

Originally Posted by novacain

Why cant you use some other IPC method?

Why hack the system DLLs?

BTW you invalidated the client area, not the non client area (I assume these are control DCs based on the size).

Because the application is third-party software.

Why would I want to invalidate anything other than the client area..That's pointless, the rendering is occurring in the client area. Regardless, let's just leave it at the fact that I'm sure everything is being redrawn. I just need to know what other functions are commonly used to transfer/copy device contexts or any other method the software is likely to use.

Good luck with that then.

I have solved this. Although this problem was completely application specific, in case anyone ever comes across a problem similar to this one, the function the application used was SetWindowOrgEx, which obviously makes 0,0 be relative to the specified point in the HDC.