why don't you use the predefined messages ?
just try to get the informations by sending
--"TB_BUTTONCOUNT" (-> tells you how many "buttons" there are)
--"TB_GETBUTTON" (-> moves the information to the allocated memory in the same process)
to
Shell_TrayWnd .-> TrayNotifyWnd .-> SysPager .-> ToolbarWindow32
