[anfractuosity]

I thought it might be using the windows equivalent of PTRACE_POKETEXT, to poke data into notepad's memory.

I've altered the contents of the gedit text editor within a linux VM, via PTRACE_ATTACH and PTRACE_PEEKTEXT/PTRACE_POKETEXT, to find and modify the text.

[quietbritishjim]

Notepad opens files using memory mapping, so an alternative might be to open the same file also using memory mapping, and then you have shared memory directly with notepad.

Except, that would mean notepad updates the display as the file changes, and I didn't think it did that. So I think I've got something wrong.

[benrow]

Maybe the edit buffer is a different area of memory to the mapped file. This would make sense as editing a file doesn't update it on disk until you choose to Save.