在不同的进程中取得IE的Webbrowser控件的IHTMLDocument2接口,请参阅MSDN上的一篇文章,标题是:HOWT Get IHTMLDocument2 from a HWND(根据HWND取得IHTMLDocument2接口).它的实现机理是向Webbrowser控件(窗口类名是"Internet
Explorer_Server")发一个WM_HTML_GETOBJECT,然后把返回值传给Microsoft Active Accessibility (MSAA) 函数ObjectFromLresult,这样你会取得一个已经编排(Marshaling)过的COM接口.如下函数所示:

IHTMLDocument2* GetDocInterface(HWND hWnd)
{
	// 我们需要显示地装载OLEACC.DLL,这样我们才知道有没有安装MSAA
	HINSTANCE hInst = ::LoadLibrary( _T("OLEACC.DLL") );
	IHTMLDocument2* pDoc2=NULL;
	if ( hInst != NULL )
	{
		if ( hWnd != NULL )
		{
			CComPtr spDoc=NULL;
			LRESULT lRes;		/*由于WM_HTML_GETOBJECT非Windows标准消息,所以需要RegisterWindowMessage*/
			UINT nMsg = ::RegisterWindowMessage( _T("WM_HTML_GETOBJECT") );
			::SendMessageTimeout( hWnd, nMsg, 0L, 0L, SMTO_ABORTIFHUNG, 1000, (DWORD*)&lRes );   /*取得ObjectFromLresult函数的地址*/
			LPFNOBJECTFROMLRESULT pfObjectFromLresult = (LPFNOBJECTFROMLRESULT)::GetProcAddress( hInst, _T("ObjectFromLresult") );
			if ( pfObjectFromLresult != NULL )
			{
				HRESULT hr;
				hr=pfObjectFromLresult(lRes,IID_IHTMLDocument,0,(void**)&spDoc);
				if ( SUCCEEDED(hr) )
				{ 
					CComPtr spDisp;
					CComQIPtr spWin;  
					spDoc->get_Script( &spDisp ); 
					spWin = spDisp;   
					spWin->get_document( &pDoc2 ); 
				} 
			} 
		} 
		::FreeLibrary(hInst);
		}  else
		{//如果没有安装MSAA
			AfxMessageBox(_T("请您安装Microsoft Active Accessibility")); 
		}
	return pDoc2;
} 

这样,我们就取得了IHTMLDocument2*接口了,要取得密码框的密码还得一番周折,首先得构造一个基于对话框的MFC程序,增加一个按钮,在主对话框类增加一个成员变量m_bCapture,在构造函数中初始化为FALSE.
然后处理该按钮的Click事件:

void CXXXXDlg::OnGetHtmlClick()
{ 
	SetCapture();//跟踪鼠标 
	m_bCapture=TRUE;
}

接着应该处理WM_LBUTTONUP消息:

void CXXXXDlg::OnLButtonUp(UINT nFlags, CPoint point) 
{ 
	if(m_bCapture)
	{ 
		m_bCapture=FALSE; 
		ReleaseCapture();//释放鼠标  
		static TCHAR buf[100];  
		POINT pt;  
		GetCursorPos(&pt); 
		HWND hwnd=::WindowFromPoint(pt);
		if(hwnd!=NULL)
		{   
			::GetClassName( hwnd, (LPTSTR)&buf, 100 );
			if ( _tcscmp( buf, _T("Internet Explorer_Server") ) == 0 )
			{   
				POINT iept=pt;    
				::ScreenToClient(hwnd,&iept);    
				GetPassword(GetDocInterface(hwnd),iept);   
			} 
		} 
	}
	CDialog::OnLButtonUp(nFlags, point);
}

GetPassword函数是这样实现的,基本可以模仿VBScript的调用,但要复杂一些:

void GetPassword(IHTMLDocument2* pDoc2,POINT pt)
{ 
	if(pDoc2==NULL)
		return;
		CComPtr pElement; 
		HRESULT hr=pDoc2->elementFromPoint(pt.x,pt.y,&pElement);//取得鼠标所在的元素 
		if(SUCCEEDED(hr))
		{  
			CComPtr pPwdElement;  
			hr=pElement->QueryInterface(IID_IHTMLInputTextElement,   (void**)&pPwdElement);//是否有表单输入元素  
			
			if(SUCCEEDED(hr))
			{   
				CComBSTR type;   
				hr=pPwdElement->get_type(&type);  
				if(SUCCEEDED(hr))
				{   
					if(type==_T("password")){//是密码框吗? 
					CComBSTR pwd;     
					hr=pPwdElement->get_value(&pwd);  
					if(SUCCEEDED(hr))
					{     
						if(pwd.Length()!=0)
						{//有密码则显示       
							CComBSTR msg=_T("密码是:");     
							msg+=pwd;       
							CString str(msg);   
							AfxMessageBox(str);    
						}      
						else
						{   
							AfxMessageBox(_T("密码为空!"));  
						}    
					}   
				}   
			} 
		} 
	} 
	pDoc2->Release();
}

使用这种方法要注意:
1.如果程序在Windows95,98和NT 4.0 Service With Pack 4 or
5下运行必须要把Microsoft Active Accessibility
(MSAA)运行时组件(RDK)与程序一起发布(Windows2000及Windows NT 4.0 Service With Pack
6中已经有了,所以不用).
2.这种方法只适用用于Internet Explorer (Programming) versions 4.0, 4.01,
4.01 SP1, 4.01 SP2,
5
3.使用这种方法前要调用CoInitialize(NULL);然后应该相应地调用CoUninitialize();
4.Microsoft
Active Accessibility (MSAA)可从href="http://f14K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1j5h3u0D9k6g2)9J5c8X3#2K6j5h3q4Q4x3V1k6V1L8%4N6F1L8r3!0S2k6q4)9J5k6h3S2@1L8b7`.`."
target=_blank>5e8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3#2A6j5%4u0G2M7$3!0X3N6q4)9J5k6h3y4G2L8g2)9J5c8X3g2F1j5h3u0D9k6g2)9J5c8X3#2K6j5h3q4Q4x3V1k6V1L8%4N6F1L8r3!0S2k6q4)9J5k6h3S2@1L8g2!0q4y4q4!0n7z5q4)9^5b7W2!0q4z5q4!0n7c8q4!0n7c8l9`.`.