Read RTF of RichTextBox in Another Application

Question

I'm having difficulties in getting the RTF of a RichTextBox from another application.

For now, lets work with WordPad.

I can get the handle for the text area in WordPad just fine. And I can even get the plain text from the text area using SendMessage and WM_GETTEXT. This is all good.

However, I need to get the RTF from the other application. In the docs, I see that EM_STREAMOUT should be used with the EDITSTREAM structure.

Here is the code that I have for this so far.

private const uint WM_USER = 0x0400;
private const uint EM_STREAMOUT = WM_USER + 74;
private const uint SF_RTF = 2;

[DllImport("user32.dll", EntryPoint="GetForegroundWindow")]
private static extern IntPtr GetForegroundWindow();

[DllImport("user32.dll", EntryPoint="GetWindowThreadProcessId", SetLastError=true)]
private static extern IntPtr GetWindowThreadProcessId(IntPtr hWnd, out IntPtr lpdwProcessId);

[DllImport("user32.dll", EntryPoint="GetGUIThreadInfo", SetLastError=true)]
private static extern bool GetGUIThreadInfo(IntPtr hThreadID, ref GUITHREADINFO lpgui);

[DllImport("user32.dll", EntryPoint = "SendMessage", CharSet = CharSet.Auto)]
private static extern IntPtr SendMessage(IntPtr hWnd, uint msg, uint wParam, ref EDITSTREAM lParam);

private delegate int EditStreamCallback(MemoryStream dwCookie, IntPtr pbBuff, int cb, out int pcb);

private static int EditStreamProc(MemoryStream dwCookie, IntPtr pbBuff, int cb, out int pcb)
{
    pcb = cb;
    byte[] buffer = new byte[cb];
    Marshal.Copy(pbBuff, buffer, 0, cb);
    dwCookie.Write(buffer, 0, cb);
    return 0;
}

[StructLayout(LayoutKind.Sequential)]
private class EDITSTREAM
{
    public MemoryStream dwCookie;
    public uint dwError;
    public EditStreamCallback pfnCallback;
}

private struct RECT
{
    public int iLeft;
    public int iTop;
    public int iRight;
    public int iBottom;
}

private struct GUITHREADINFO
{
    public int cbSize;
    public int flags;
    public IntPtr hwndActive;
    public IntPtr hwndFocus;
    public IntPtr hwndCapture;
    public IntPtr hwndMenuOwner;
    public IntPtr hwndMoveSize;
    public IntPtr hwndCaret;
    public RECT rectCaret;
}

public static string GetRTFFromActiveWindowElement()
{
    try
    {
        IntPtr windowHWnd = GetForegroundWindow();
        IntPtr lpdwProcessId;
        IntPtr threadId = GetWindowThreadProcessId(windowHWnd, out lpdwProcessId);

        GUITHREADINFO lpgui = new GUITHREADINFO();
        lpgui.cbSize = Marshal.SizeOf(lpgui);

        GetGUIThreadInfo(threadId, ref lpgui);

        string result = String.Empty;
        using (MemoryStream stream = new MemoryStream())
        {
            EDITSTREAM editStream = new EDITSTREAM();
            editStream.pfnCallback = new EditStreamCallback(EditStreamProc);
            editStream.dwCookie = stream;

            SendMessage(lpgui.hwndFocus, EM_STREAMOUT, SF_RTF, ref editStream);

            stream.Seek(0, SeekOrigin.Begin);
            using (StreamReader reader = new StreamReader(stream))
            {
                result = reader.ReadToEnd();
            }
        }

        return result;
    }
    catch (Exception e)
    {
        Console.Write(e.Message);
        return null;
    }
}

When I call the GetRTFFromActiveWindowElement method, the other application that I am trying to read from (WordPad) crashes. Originally I was getting the option to debug the other program and saw that it was a memory access violation. However, I cannot duplicate seeing this error message any more. In the current state, the other application just locks up and crashes with no error message.

Just a note: WordPad is just an easy application to test with. I've also done this with my own simple WinForms app that just has a RichTextBox in it and the same problem exists.

After solving this issue, I would also like to be able to write RTF back to the other application.

Suggestions?