I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory somehow.
I've looked into it with CheatEngine and found the strings I was looking for in several places. However, it seems that their location changes from time to time, because the value at the addresses changed, for example when new text was entered in the chat.
Unfortunately I'm no expert on this subject. My naive assumption would be, that the strings are contained in some vector-like data structure (and the changing values at the addresses could be caused by reallocation?), but I'm not sure about that ofcourse. I have written a basic MemoryScanner thats able to find some integer values (and I'm sure I could extend it to find strings as well), but how do I proceed from here, if I neither know the address of the chat messages nor the exact layout of the underlying data structure?
I'm grateful for any suggestions!
EDIT: I have started to analyze the program with IDA Pro. I have found several strings (in the .rdata section), that are regularly used in the chat, even 'printf'-like with name replacements. I have set breakpoints on these strings, as well as the functions that call these strings. However, they don't get triggered when chat messages are entered.
Is there something I need to know about the .rdata segment? Does it get loaded on program startup for example? If so, how would I proceed from here?