In some app like WinSpy/Spy++ to make adjustments to list controls. It can correctly set an app’s list control’s modes, alignments,
sorting, styles, and extended styles. It can also get the widths of the columns and count of items.

The problem is that you cannot seem to get the columns’ names or the item text. The app uses code like this, where lc is a pointer to the target app’s list control:

  lc->GetColumnWidth();
  lc->GetItemCount();
  lc->ModifyStyle();
  lc->SetExtendedStyle();
  lc->GetHeaderCtrl()->GetItemCount();

That all works fine, but when you try something like this, it doesn’t work:

  TCHAR colname[256]=_T("");
  LVCOLUMN lvcol;
  ZeroMemory(&lvcol, sizeof(lvcol));
  lvcol.mask=LVCF_TEXT;
  lvcol.cchTextMax=sizeof(colname)-1;
  lvcol.pszText=colname;
  lc->GetColumn(col, &lvcol);

GetColumn may return TRUE or FALSE, but the LVCOLUMN structure remains unchanged. If you tried using that same code in a test app to get the name of a column from that app’s own list control and it worked. It only seems to fail when use it from a different app.

Solution:

Well, there is no surprise here; in fact, if there is any surprise, it is that you did not manage to totally crash the target app (I presume that lc is a CListCtrl::FromHandle of an HWND in another process).

Think about this case:

you are passing the address of a data structure in YOUR process as a LPARAM-sized value to some totally different process, where that LPARAM value is completely and utterly meaningless.

David Ching did a remote-sendmessage DLL some time ago.  This essentially does DLL injection of the code so it is running in the target process; you can google for this by looking for SendMessageRemote.

http://www.dcsoft.com/private/sendmessageremote.cpp