From Forum Nokia Wiki

Introduction

As far as I understand it, on platforms based on Symbian OS it is not a easy job to extract all the texts on screen (the reason is complex and "which this margin is too narrow to contain" (1637, Pierre de Fermat)), but I do have a partial solution which can get some of them.

Solution

Step 1: Hacking into the applications

For example by writing your own FEP plug-in.

"S60 Platform: FEP Example v2.0"

Step 2: Hooking the "draw text" methods of the system GC.

Every application has a system GC, i.e. the CWindowGc object returned by CCoeEnv::SystemGc(), and normally it will be called by controls to draw texts on screen.

Though we don't have the API similar to the Windows SetWindowsHookEx(), we can still hook the CWindowGc:rawText() by creating a CWindowGc derived class, and then Overriding its virtual fucntion DrawText(), and then replace the vtable of the system Gc with that of the derived class.

I've successfully created a "proof of concept" plug-in which can get the texts on softkeys, menu commands and application title but no more than that.

MyFepPlugin(200901112155)S60.zip

It is a minimal FEP plugin that hacks into all applications and hooks all the Window GC draw text functions.

Tested on S60 3rd Edition emulator only, need the FEP Setup application in S60 Fep Example v2 to load the FEP.

After being loaded see the debug output for the logs printed by the 'hooker' Window GC.

NOTE

Not all the controls use the system gc to draw themselves, for example listbox etc. But if these controls are still using a CWindowGc then their drawings can also be hooked by another 'nice hack':

"Explore and Hack the Server Heap in Symbian" by Oasis Feng http://blog.oasisfeng.com/2007/04/26/explore-and-hack-the-server-heap-in-symbian/#more-235

That means we can step further to find all the CWindowGc objects (including the system gc) by the THeapSearch class, and then replace their VPTRs, and then we can hook all the "draw text" calls!