OllyDbg condition based on Windows Message for button click

Question

I am attempting to set a breakpoint after a user clicks a button on a Windows GUI program.

I load the program into OllyDbg, type in ctrl+g to search for a function, I then use the GetMessageW function. I then set a conditional breakpoint by typing ctrl+f4 and type in [esp+4] under the expression and decode the expression as a Pointer to MSGW.

All of that is working fine. Now I want to refine it so it only breaks when the Msg == WMLBUTTONDOWN for example (only when the user clicks)

Is that possible? What do I type in the conditional text box?

Answer 1

MSG Structure is as below

typedef struct tagMSG {
   HWND hwnd;
   UINT message;
   WPARAM wParam;
   LPARAM lParam;
   DWORD time;
   POINT pt;
} MSG;

GetMessageAorW is as below

BOOL WINAPI GetMessage(
  _Out_     LPMSG lpMsg,
  _In_opt_  HWND hWnd,
  _In_      UINT wMsgFilterMin,
  _In_      UINT wMsgFilterMax
);

so it takes a pointer to MSG structure as its first argument ie [esp+4] is a pointer to MSG Structure

so you need to dereference [[esp+4] + 4]

ollydbg understands most of the Messages

so you can set a condition like

[[esp+4]+4] == WM_COMMAND

set pause on condition log espession on condition and log function arg on condition and hit ok

and ollydbg will break on exact message

Log data
Address   Message
7744CDE8  INT3: arg1 = MSGW at address 0023EB60:
                  hWnd = 00400182, class = CalcFrame, text = Calculator
                  Msg = WM_COMMAND
                   = NotifyCode = MENU/BN_CLICKED..., ID = 305.
                  hControl = NULL
                  time = 114486575.
                  pt_X = 736.
                  pt_Y = 210.
7744CDE8  Call to USER32.GetMessageW from calc.002C1CB6
            0023EB60  pMsg = 0023EB60 -> MSGW {hWnd=00400182, class = CalcFrame, text = Calculator, Msg=WM_COMMAND, =NotifyCode = MENU/BN_CLICKED..., ID = 305., hControl=NULL, time=114486575., pt_X=736., pt_Y=210.}
            00000000  hWnd = NULL
            00000000  MsgFilterMin = 0
            00000000  MsgFilterMax = 0
7744CDE8  Conditional breakpoint at USER32.GetMessageW

you can see that MSGW structure contain 111 which is WM_COMMAND

if you ask ollydbg to decode it as structure

Structure MSGW at 0023EB60
Address   Hex dump      Decoded data             Comments
0023EB60  /.82014000    DD      00400182         ; /hWnd = 00400182, class = CalcFrame, text = Calculator
0023EB64  |.11010000    DD      00000111         ; |Msg = WM_COMMAND
0023EB68  |.31010000    DD      00000131         ; | = NotifyCode = MENU/BN_CLICKED..., ID = 305.
0023EB6C  |.00000000    DD      00000000         ; |hControl = NULL
0023EB70  |.2FEDD206    DD      06D2ED2F         ; |time = 114486575.
0023EB74  |.E0020000    DD      000002E0         ; |pt_X = 736.
0023EB78  \.D2000000    DD      000000D2         ; \pt_Y = 210.

in cases where ollydbg doesnt understand some XX_YYY you can substitute hex in place of XX_YYY

like [[esp+4]+4] == 1337 for the condition statement