My setup:

• Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
• Debuggee: Win7 Pro (running in a VM using VMWare Workstation)

I'm trying to follow the SendMessage call from the user space:

Into the kernel, by setting a conditional breakpoint on win32k!NtUserMessageCall:

If we take the declaration of the NtUserMessageCall function:

NTSTATUS NtUserMessageCall(
    HWND hWnd,
    UINT uMsg,
    WPARAM wParam,
    LPARAM lParam,
    ULONG_PTR ResultInfo,
    DWORD dwWndProcType,
    BOOL bAnsi);

The condition for the breakpoint is for uMsg == WM_SYSCOMMAND (or 0x112). I set it as such:

ba e 1 fffff960`00163318 "j (@rdx=0x112) ''; 'gc'"

I can then check that it was set up alright:

But when I then "Go" the OS:

The debuggee OS literally grids to a halt. I can't do anything. I can see some "life" in there by seeing the clock widget jumping by 20 second intervals but it is impossible to interact with windows or do anything. Note that if I disable the breakpoint above, everything starts working smoothly.

Can someone explain what am I doing wrong there? And how can I make it work?

My setup:

• Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
• Debuggee: Win7 Pro (running in a VM using VMWare Workstation)

I'm trying to follow the SendMessage call from the user space:

Into the kernel, by setting a conditional breakpoint on win32k!NtUserMessageCall:

If we take the declaration of the NtUserMessageCall function:

NTSTATUS NtUserMessageCall(
    HWND hWnd,
    UINT uMsg,
    WPARAM wParam,
    LPARAM lParam,
    ULONG_PTR ResultInfo,
    DWORD dwWndProcType,
    BOOL bAnsi);

The condition for the breakpoint is for uMsg == WM_SYSCOMMAND (or 0x112). I set it as such:

ba e 1 fffff960`00163318 "j (@rdx=0x112) ''; 'gc'"

I can then check that it was set up alright:

But when I then "Go" the OS:

The debuggee OS literally grinds to a halt. I can't do anything. I can see some "life" in there by seeing the clock widget jumping by 20 second intervals but it is impossible to interact with windows or do anything. Note that if I disable the breakpoint above, everything starts working smoothly.

Can someone explain what am I doing wrong there? And how can I make it work?