Exploiting ObjectFromLresult() to get the IHTMLDocument2 from a window handle

Assume you have a window handle to a html control (which implements IHTMLDocument2) within a browser page (which is an IWebBrowser2), how would you access the HTML elements?

This is interesting as with just a window handle, it was relatively unknown on how that can be mapped to an object.

What you need to do is this:

1.) Register the windows message WM_HTML_GETOBJECT

2.) Send this message to the window handle we have in hand using a SendMessageTimeOut(). The out parameter in the lpdwResult returns you an UIntPtr to the object after the call.

3.) Next, use this out parameter as part of the ObjectFromLresult() call:
ObjectFromLresult(result from sendmessagetimeout, IHtmlDocument, 0)

4.) Cast the result from ObjectFromLresult() to IHTMLDocument2.

5.) Use the all property to get the HTML elements.

The powerfull function here definitely is the ObjectFromLResult() which effectively returns you an object that is 'accessible'. Accessible in terms of the user accessibility factor.

A framework worth checking out in this regard is the UIA framework that allows manipulating individual entities on the screen be it winforms, browser controls...