利用Windows API的SendMessage发送WM_NOTIFY获取虚拟列表的内容失败

[小狐狸0_0]

想通过windows API的SendMessage跨进程获取另一个程序的表格中的数据。该表格为虚拟表格，表格的class为ListView20WndClass，父窗口为ThunderRT6FormDC。在SPY++中能捕获到父窗口发送WM_NOTIFY，消息为LVN_GETDISPINFOA。通过Window API，利用SendMessage发送WM_NOTIFY，获取失败，在SPY++中监测不到该信号。请高手帮忙debug下，谢谢。上代码，具体信息在代码注释中：

HWND form_hwnd = reinterpret_cast<HWND>(0x00101CF4); //父窗口ThunderRT6FormDC的句柄
HWND list_hwnd = reinterpret_cast<HWND>(0x001B2506); //父窗口ThunderRT6FormDC的句柄

char item[512], *_item;
HANDLE hProcess;
DWORD PID;

LV_DISPINFOA lvd, *_lvd;

//通过WM_GETTEXT获取父窗口的title，可正常获取，SPY++中监测到该信号。
int len = SendMessage(form_hwnd, WM_GETTEXTLENGTH, 0, 0);
char *buffer = new char[len+1];
SendMessage(form_hwnd, WM_GETTEXT, len+1, (lPARAM)buffer);

//获取父窗口进程ID
GetWindowThreadProcessID(form_hwnd, &PID);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID);

//在进程中开辟内存
_lvd = (LV_DISPINFOA*)VirtualAllocEx(hProcess, nullptr, sizeof(LV_DISPINFOA), MEM_COMMIT, PAGE_READWRITE);
_item = (char*)VirtualAllocEx(hProcess, nullptr, 512, MEM_COMMIT, PAGE_READWRITE);

//通过LVM_GETITEMCOUNT获取表格的行数（可正常获取到，也能在SPY++中监测到消息）
long long rows = SendMessage(list_hwnd, LVM_GETITEMCOUNT, 0, 0);
//通过LVM_GETHEADER得到表头的句柄（可以在SPY++中监测到该消息）
HWND headers = (HWND)SendMessage(list_hwnd, LVM_GETHEADER, 0, 0);
//获取列数（可正常获取到）
int cols = Header_GetItemCount(headers);

//赋值给NMHDR，消息为LVN_GETDISPINFOA，第一行第一列的text
lvd.hdr.hwndFrom = list_hwnd;
lvd.hdr.idForm = 0;
lvd.hdr.code = LVN_GETDISPINFOA;
lvd.item.mask = LVIF_TEXT;
lvd.item.cchTextMax = 512;
lvd.item.pszText = _item;
lvd.item.iSubItem = 0;
lvd.item.iItem = 0;

//将lvd写入目标进程
WriteProcessMemory(hProcess, _lvd, &lvd, sizeof(LV_DISPINFOA));
//发送WM_NOTIFY消息
//该消息发送失败，SPY++监测不到父窗口有该信号
SendMessage(form_hwnd, WM_NOTIFY, (WPARAM)0, (LPARAM)_lvd);
ReadProcessMemory(hProcess, _item, item, 512, 0);

CloseHandle(hwnd);
CloseHandle(hProcess);
VirtualFreeEx(hProcess, _lvd, 0, MME_RELEASE);
VirtualFreeEx(hProcess, _item, 0, MME_RELEASE);