So, you've found that there is a second parameter which may be a pointer to the DOCKLET_DATA structure? Let me test it out.
Edit. Well it did not work, passing a pointer to the DOCKLET_DATA structure to the WPARAM parameter still crashes the dock. I think it will be needed to understand what OD does with that parameter during processing of message 0x58f. I tried sending a BOOL and the docklet handle to it, but it still crashes.
Ok, using IDA with a docklet I found the following code for the menu item which removes the docklet from the dock:
mov edx, [edi]
push 1
push edx
call sub_3B23B20
Which simply calls DockletRemoveSelf by getting a reference to the function using GetModuleHandle & GetProcAddress (as usual):
sub_3B23B20 proc near
arg_0= dword ptr 4
arg_4= dword ptr 8
push offset aDockletremoves ; "DockletRemoveSelf"
push 0 ; lpModuleName (ObjectDock.exe)
call ds:GetModuleHandleA
push eax ; hModule
call ds:GetProcAddress
test eax, eax
jz short locret_3B23B44
ecx, [esp+arg_4]
edx, [esp+arg_0]
push ecx
push edx
call eax
locret_3B23B44:
retn
sub_3B23B20 endp
So it seems that is simply calls DockletRemoveSelf passing the handler & a "1" (boolean)... which it was something I have already tried... then it returns and the menu handling routine and ends (OnRightButtonClick). So it seems that ObjectDock asyncronously displays the confirmation dialog and deletes the docklet. But as I said, calling it by passing a BOOLEAN 1 did not work.
This post has been edited by Smaky: 01 June 2009 - 06:10 PM