0

After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler?

Say I am reversing an application, I hit the Ok button and then it generates a window. Pausing the application after that window is generated should show the message handler in the call stack right? I see a callstack with one of the last entries being the message loop itself (get translate and dispatch) but I don't see the callback function. Should I just try and go through dispatchmessage to get the message handler? Is there some resource which tells me where exactly the messagehandler is in dispatchmessage?

3

prototype of DispatchMessage() is

LRESULT DispatchMessage(
  const MSG *lpMsg
);

it takes only a pointer to struct MSG which has a hwnd as its first

typedef struct tagMSG {
  HWND   hwnd;
  UINT   message;
  WPARAM wParam;
  LPARAM lParam;
  DWORD  time;
  POINT  pt;
  DWORD  lPrivate;
} MSG, *PMSG, *NPMSG, *LPMSG;

this hwnd is validated and the appropriate callback is called by internal functions of user32.dll and comctl32.dll

you can get the window proc in the handles window in x64dbg

here is a screenshot of windows calc.exe paused at a breakpoint in user32.DispatchMessageW()

enter image description here

you can get the hwnd parameter by looking at the stack with log {x:[[esp+4]]} and following it up in handles window the screenshot shows the hwnd in status bar command in command window and the window proc in handles window

enter image description here

setting a breakpoint on the proc and hitting f9 will land us in the windowproc

Address   To        From      Size      Comment        
0012EFB4  770C5F9F  00631EDE  78        calc.00631EDE
0012F02C  770C4F0E  770C5F9F  5C        user32._GetRealWindowOwner@4+54
0012F088  770C4F7D  770C4F0E  28        user32._DispatchClientMessage@20+4B
0012F0B0  777B702E  770C4F7D  74        user32.___fnDWORD@4+24
0012F124  770CCC70  777B702E  10        ntdll.777B702E 
0012F134  00631CAC  770CCC70  D70       user32._DispatchMessageW@4+F
0012FEA4  0064219A  00631CAC  90        calc.00631CAC 
0012FF34  7748ED6C  0064219A  C         calc.0064219A
0012FF40  777D37EB  7748ED6C  40        kernel32.7748ED6C 
0012FF80  777D37BE  777D37EB  18        ntdll.777D37EB
0012FF98  00000000  777D37BE            ntdll.777D37BE 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.